tegwick
4a59b234b9
Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a10780-6d41-7952-9718-dfbc1f41236f
3 KiB
| id | type | title | domain | repo | status | owner | topic_slug | created | updated | related | ||
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| STATE-WP-0096 | workplan | Private decision memo dispatch for the selected State Hub workload | infotech | state-hub | active | codex | netkingdom | 2026-10-04 | 2026-10-04 |
|
Founder requested continued production delivery and selected the existing system:serviceaccount:state-hub:state-hub identity. No new public privileged forwarding endpoint: the existing Hub API has no suitable authenticated-caller boundary for delegating its projected token to arbitrary requests.
Compose the durable private queue worker
id: STATE-WP-0096-T01
status: done
priority: high
Explicit local enqueue, durable replay/receipt ledger, single-attempt process lock, rotating intake-audience token and fixed bounded no-proxy/no-redirect transport. No API startup hook, auto-discovery, human binding or hub-resolution mutation. Preserve native approval uncertainty: the intake service decides replay versus unresolved refusal. Only reviewed local workload execution queues content.
Package and validate the concrete deployment candidate
id: STATE-WP-0096-T02
status: progress
priority: high
Standalone non-root image using only standard-library dependencies; isolated single-replica Recreate worker/PVC, existing exact State Hub service account, projected audience token and exact intake network peer. Build/scan, local restart/rotation/concurrency proof and server dry-run. Explicit queue entry means new decisions require no infrastructure rollout. Source assertions do not become caller identity.
Approved deployment and native agent-human-agent acceptance
id: STATE-WP-0096-T03
status: todo
priority: high
Under the concrete INFD-WP-0007 rollout go, deploy the worker after requester custody and intake/PDP prerequisites. Queue a retained lifecycle review envelope, verify stable receipt and protected human review. Human alone accepts; retrieve native outcome and audit evidence. Unresolved/blocked attempts require review, never automatic clearing. No automatic Hub decision scanning or public enqueue route is included in this initial workload composition.
Implementation evidence — 2026-10-04
The initial cross-service test exposed an overly narrow Hub envelope contract: lifecycle review snapshots do not necessarily name a Hub decision. The parser now accepts exactly the retained review-UUID id/key when serves is absent, while preserving the stable Hub-derived key requirement whenever serves is supplied. No relationship, receipt or approval is invented.
The real Approval Engine/Audit Core component test exercises private queueing, lost response after native creation, restart, same-key receipt replay (201 then 200), human-only review and independent evidence. Identity/custody remain fixtures. Five installed-container checks prove private storage, explicit enqueue, restart and SIGTERM with no network. The three deployment objects pass server dry-run; no live worker or token projection has been created.