From 7721ec6a31d453ed9b5f3b28ac970cc74e2b0b1d Mon Sep 17 00:00:00 2001 From: tegwick Date: Mon, 7 Sep 2026 13:44:47 +0200 Subject: [PATCH] Track the two external dispositions as TEN-WP-0012 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit TEN-WP-0011 closed correctly: T04 and T06 built everything this repo owns. What neither could close is the other side — a sender credential audit-core issues (AUDIT-IN-0002) and a canon edit only net-kingdom may make (NET-IN-0002). Both intakes were filed outbound, so nothing in this checkout held them. Session protocol Step 3 scans workplans/ for open work. With every workplan finished it found none, and each session re-derived the same two externally-owned gaps from SCOPE.md prose and the audit-core source before concluding there was nothing to do. TEN-WP-0012 holds that conclusion so it is read rather than rediscovered, as a blocked workplan with two wait tasks — the convention's status for work owed by another party. Records for each what would close it, including the decline branch, and states the two things not to do: no editing net-kingdom canon from here, and no requesting the audit-core token over the message bus. No code change; 287 tests pass and ruff is clean. Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_01HHwvAEQfmzLHtrFGhXtVjq Assistant: claude-code Assistant-Model: opus Assistant-Process: 823014@bnt-lap001 Assistant-Session: 2a0786b1-efea-4c38-959b-6e86a493f259 --- SCOPE.md | 14 ++- .../TEN-WP-0012-external-conformance-waits.md | 103 ++++++++++++++++++ 2 files changed, 114 insertions(+), 3 deletions(-) create mode 100644 workplans/TEN-WP-0012-external-conformance-waits.md diff --git a/SCOPE.md b/SCOPE.md index bd9385d..ddb5160 100644 --- a/SCOPE.md +++ b/SCOPE.md @@ -91,7 +91,8 @@ Production service, not a bootstrap. Workplans `TEN-WP-0001` through boundary-contract APIs, the `flex-auth` write authorizer, lifecycle, guardrails, PostgreSQL as the production store, mutable grouping, staged-promotion onboarding, and the security-layer conformance surfaces. -No workplan in this repo is currently open. +The only open workplan is `TEN-WP-0012`, which tracks two dispositions +owed by other repos and expects no code change here. | Surface | Shipped | Notes | | --- | --- | --- | @@ -107,7 +108,7 @@ No workplan in this repo is currently open. | Machine-readable `layer.yaml` | yes | `TEN-WP-0011-T01`; check in `scripts/check_layer_conformance.py` | | Persisted `authorization_decision_id` | yes | `authz_records` plus mutation event payload (`TEN-WP-0011-T02`) | | Published unreachable-engine stance map | yes | `pep-stance.yaml`, fail-closed, tested equal to shipped behaviour | -| Independent audit-core emission | path shipped, sender pending | Local outbox + POST `/v1/events`; `AUDIT-IN-0002` | +| Independent audit-core emission | path shipped, sender pending | Local outbox + POST `/v1/events`; waiting on `AUDIT-IN-0002` (`TEN-WP-0012-T01`) | | Bounded event-read interface | yes | `events_for(tenant_id)` only (`TEN-WP-0011-T05`) | | Claim freshness / input-class lifetime | yes | `pip-claims.yaml` (`TEN-WP-0011-T03`) | @@ -115,7 +116,13 @@ The boundary contract still labels guardrail policy "reserved, not implemented" and still calls this repo "not a policy enforcement point". Both sentences are stale: guardrails shipped, and the write path is PEP-shaped even though this repo is not a PDP. Amendment is a -`net-kingdom` change, requested from `TEN-WP-0011`. +`net-kingdom` change, requested from `TEN-WP-0011` as `NET-IN-0002` and +tracked here as `TEN-WP-0012-T02`. + +Those two rows are the only open items in this repo, and neither is ours +to close: one waits on a credential audit-core issues, the other on a +canon edit only `net-kingdom` may make. `TEN-WP-0012` holds both so they +are read rather than re-derived each session. ## Getting Oriented @@ -127,6 +134,7 @@ PEP-shaped even though this repo is not a PDP. Amendment is a - Layer declaration: `decisions/decisions.md` `TEN-DEC-2026-001` - Review: `history/2026-08-29-security-layer-intent-scope-review.md` - Evolution workplan: `workplans/TEN-WP-0011-security-layer-conformance.md` +- External waits: `workplans/TEN-WP-0012-external-conformance-waits.md` - flex-auth write-authorization integration: `docs/flex-auth-integration.md` - Guardrail contract: `docs/tenant-guardrail-policy.md` - Lifecycle contract: `docs/tenant-lifecycle-api.md` diff --git a/workplans/TEN-WP-0012-external-conformance-waits.md b/workplans/TEN-WP-0012-external-conformance-waits.md new file mode 100644 index 0000000..ff6b8cd --- /dev/null +++ b/workplans/TEN-WP-0012-external-conformance-waits.md @@ -0,0 +1,103 @@ +--- +id: TEN-WP-0012 +type: workplan +title: "Track the two external dispositions tenant-engine is waiting on" +domain: infotech +repo: tenant-engine +status: blocked +owner: claude +topic_slug: netkingdom +created: "2026-09-07" +updated: "2026-09-07" +depends_on: + - TEN-WP-0011 +unblocks: [] +origin: residual +origin_ref: TEN-WP-0011 +--- + +# TEN-WP-0012 — Track the two external dispositions tenant-engine is waiting on + +`TEN-WP-0011` closed correctly. Its T04 and T06 are `done` in the sense that +matters here: this repository built everything it owns. What neither task +could close is the other side — a credential audit-core issues, and a canon +edit only `net-kingdom` may make. + +Those two waits have no durable local record. The intakes were filed +outbound, on other repositories' intake files, so nothing in this checkout +holds them. `SCOPE.md` mentions both in prose, but prose is not scanned. + +The cost is small and repeating: session protocol Step 3 scans `workplans/` +for open work, finds none, and each session re-derives the same two +externally-owned gaps from `SCOPE.md` and the audit-core source before +concluding — correctly — that there is nothing to do. This workplan holds +that conclusion so it is read rather than rediscovered. + +## Why this is a workplan and not an intake + +This repository's intake files record work *it* may act on. Both records +here are the opposite: work filed elsewhere, awaiting someone else's +disposition. Only `workplans/` is read at session start, and `wait` is the +convention's status for work that is blocked on another party. + +## Non-goals + +- Not editing `net-kingdom` canon from this repository. `TEN-WP-0011-T06` + settled that: file an intake, never fork the contract. +- Not requesting a credential over the message bus. Credential routing is + explicit that `POST /messages/` asking for a token is an anti-pattern; + sender registration is audit-core's to issue. +- Not re-opening `TEN-WP-0011`. Our side of both items shipped. +- No code change is expected from this workplan. If either disposition + arrives and *does* require code, that becomes its own workplan. + +## T01 — audit-core sender registration (AUDIT-IN-0002) + +```task +id: TEN-WP-0012-T01 +status: wait +priority: medium +``` + +The emission path shipped in `TEN-WP-0011-T04`: the local outbox is inside +the mutation transaction, the drain POSTs `/v1/events` and never fails a +mutation, and the trade is declared in `docs/evidence-emission.md`. What is +missing is sender registration — a credential audit-core issues and holds +custody of. `src/tenant_engine/audit_core.py` documents that this module +holds no audit-core credential beyond that sender token. + +Waiting on: `AUDIT-IN-0002`, filed on audit-core. + +Done when: audit-core registers the sender and production mutations land +externally, **or** audit-core declines and `SCOPE.md` row +"Independent audit-core emission" is restated to say so. + +Do not: request the token by message, or synthesize a local stand-in that +would make the outbox look drained when it is not. + +## T02 — boundary-contract amendment (NET-IN-0002) + +```task +id: TEN-WP-0012-T02 +status: wait +priority: low +``` + +`net-kingdom/canon/standards/tenant-engine-boundary-contract_v0.1.md` still +calls guardrail/quota policy "reserved, not implemented" and this repository +"not a policy enforcement point". Guardrails shipped in `TEN-WP-0006`/`0007`, +and the write path is PEP-shaped without this repository being a PDP, so +both sentences now mislead a reader who trusts the contract over the code. + +Waiting on: `NET-IN-0002`, filed on `net-kingdom` by `TEN-WP-0011-T06`. + +Done when: the contract is amended at its next cut, **or** `net-kingdom` +declines and the standing divergence is recorded here rather than left as +a live contradiction between contract and code. + +## Closing this workplan + +Close when both tasks reach a disposition, whichever way each falls. If +either stays open long enough to stop being worth re-reading, `cancel` the +task and say in `SCOPE.md` that the gap is permanent — an accepted, +documented divergence beats an indefinite `wait`.