The claims name the workloads covered by RELREG-WP-0004. Each pin is a digest the live object already shows.
Assistant: grok
Assistant-Session: 01a16880-25e0-7031-b553-a1e0321ff397
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 276069@bnt-lap001
Assistant-Session: 2e192b3d-b3e8-4403-94d4-d55a2c8b476c
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 276069@bnt-lap001
Assistant-Session: 2e192b3d-b3e8-4403-94d4-d55a2c8b476c
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 8340@bnt-lap001
Assistant-Session: 2e192b3d-b3e8-4403-94d4-d55a2c8b476c
Receiving workplan for the 2026-10-21 node allocation review
(RESOURCE-WP-0008-T03 / CUST-WP-0071-T03). Wave-2 apply is human-gated;
no manifest changes. WORK-RECORDS.md regenerated from staged sources.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 8340@bnt-lap001
Assistant-Session: 2e192b3d-b3e8-4403-94d4-d55a2c8b476c
Updated by fix-consistency on 2026-09-22:
- update .custodian-brief.md for tenant-engine
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 7184@bnt-lap001
Assistant-Session: 4b436ae2-b17c-4b40-8754-200b161b26e4
statehub register left the literal token (fixed in state-hub 19450d7).
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 7184@bnt-lap001
Assistant-Session: 4b436ae2-b17c-4b40-8754-200b161b26e4
VALIDATED_AGAINST now names the accepted security-layer-model v0.7
(net-kingdom@66dc491) as amended by GH-DEC-2026-017, -020, -021
(gate-house@39d9287), not the held v0.8 (021 §2).
The A12 detector converges on ops-warden's playbook reference plus the
021 §3 addition (a version in a standard:/companion: value is a pin).
A prose citation such as 'the v0.7 scope rule' is no longer failed
(021 §1); tests updated. The layer.yaml note rewording stays.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 63291@bnt-lap001
Assistant-Session: 8bd77868-ca68-4f49-bb1e-d539ecc0d703
scripts/check_layer_conformance.py now prints, on every run (success and
failure), the standard text it checks against (VALIDATED_AGAINST:
security-layer-model_v0.8.md @ net-kingdom f9e1611 with gate-house A9, A11,
A12 r2 @ 104f3fc) and its scope. A12 detection widens from the key name
standard_version to any *_version key (companion_version included), a
versioned standard/companion path, or a bare vN.N token in any key or value
of INTENT.md frontmatter or layer.yaml. schema_version and comments are not
reached; pep-stance.yaml and pip-claims.yaml are not read for A12 and keep
their version fields (GH-DEC-2026-020 §3).
The widened check found one value the key-name check could not: the
state-hub-work-records note in layer.yaml cited "the v0.7 scope rule". It is
reworded to "the standard's scope rule"; no layer or role value changes.
Tests fail if a versioned standard: path, a companion_version or a bare
version token returns, and if a run stops stating its version and scope.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 63291@bnt-lap001
Assistant-Session: 8bd77868-ca68-4f49-bb1e-d539ecc0d703
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 63291@bnt-lap001
Assistant-Session: 8bd77868-ca68-4f49-bb1e-d539ecc0d703
Updated by fix-consistency on 2026-09-21:
- update .custodian-brief.md for tenant-engine
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 63291@bnt-lap001
Assistant-Session: 8bd77868-ca68-4f49-bb1e-d539ecc0d703
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 63291@bnt-lap001
Assistant-Session: 8bd77868-ca68-4f49-bb1e-d539ecc0d703
Remove standard_version from layer.yaml and the INTENT.md frontmatter (A12),
mark layer.yaml derived: true / derived_from: INTENT.md (A11), and change the
conformance checker and its tests in the same commit so the conforming
declaration does not fail as malformed.
The checker now requires the INTENT.md layer: key, rejects standard_version
in either form, checks the layer against the closed four-token vocabulary
(A9), and reports a layer/role disagreement between the two forms after an
ASCII case-fold. Nothing is re-spelled: INTENT.md keeps Engine/PIP and
layer.yaml keeps engine/pip. pep-stance.yaml and pip-claims.yaml keep their
standard_version; neither is a layer declaration.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 63291@bnt-lap001
Assistant-Session: 8bd77868-ca68-4f49-bb1e-d539ecc0d703
TEN-DEC-2026-002 answers flex-auth's FLEX-WP-0022-T01, open since
2026-09-15: `tenant` denotes the target tenant record, equals
`resource.id` by intent, and the write API is cross-tenant by design —
no action is refused on the subject/tenant relationship, and
tenant.guardrail.read must not differ because flex-auth itself calls it
across tenants. docs/flex-auth-integration.md states the relation in
this repo's voice.
TEN-IN-0004 is the live record flex-auth asked for on FLEX-WP-0020.
Runtime names stay flex-auth (FLEX-DEC-2026-013) and all deploy, cluster
and settings coordinates verify as retained; only five documentation
repository paths change when the rename lands.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 63291@bnt-lap001
Assistant-Session: 8bd77868-ca68-4f49-bb1e-d539ecc0d703
Updated by fix-consistency on 2026-09-21:
- update .custodian-brief.md for tenant-engine
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 63291@bnt-lap001
Assistant-Session: 8bd77868-ca68-4f49-bb1e-d539ecc0d703
Set flavor on open workplans from origin/prose/status. Copy existing
depends_on aliases only. Do not promote residuals.
Assistant: grok
Assistant-Session: 01a09dc1-b21e-77e1-919e-fcad2f82b267
audit-core registered our sender (AUDIT-IN-0002) and, reviewing the
emitter, found that no event we sent could ever have been accepted.
envelope_for sent five of the eight required fields under its own names
-- event_id, action, resource, observed_at, details -- and omitted
correlation_id entirely. normalize() rejects that whole, 400.
Our drain treated 400 as terminal, so every event would have been marked
handled here while audit-core held only an unchained dead letter: lost on
both sides, silently, with the integration looking healthy.
- envelope_for emits exactly the eight required fields and none of the
six audit-core derives. The acting principal moves into `data`, where
it reads as our claim rather than the archive's finding.
- Thread correlation_id through create / revoke / plan, which had no such
field. Optional on those three bodies for compatibility; when a caller
supplies none this engine mints req-<uuid> for the operation it
performed and returns it. The store mints op-<uuid> as a floor for
direct callers, written into the local payload so both records agree.
- Send Idempotency-Key equal to the body id.
- A 400 no longer dead-letters. The row stays pending with the reason
recorded on it: a 400 is an integration defect to fix, not a delivery
outcome to record.
- wire_envelope upgrades outbox rows written in the old shape at send
time, and refuses to send one whose correlation cannot be recovered
from its payload rather than inventing one.
Verified by running all nine event types, through the API, through
audit-core's actual normalize() with a matching SenderIdentity -- all
accepted. A live non-production 202 still needs the token, so
TEN-WP-0012-T01 stays `wait`.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01DFmHM6fugwfqoobUCp9GiQ
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 2106375@bnt-lap001
Assistant-Session: aa26c34d-71e8-4478-a962-c79c74694dc8
fix-consistency C-06 wrote state_hub_workstream_id and the two
state_hub_task_ids back into the workplan file and regenerated
WORK-RECORDS.md. Committing the writeback so the file and hub agree.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HHwvAEQfmzLHtrFGhXtVjq
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 823014@bnt-lap001
Assistant-Session: 2a0786b1-efea-4c38-959b-6e86a493f259
Updated by fix-consistency on 2026-09-07:
- update .custodian-brief.md for tenant-engine
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 823014@bnt-lap001
Assistant-Session: 2a0786b1-efea-4c38-959b-6e86a493f259
TEN-WP-0011 closed correctly: T04 and T06 built everything this repo
owns. What neither could close is the other side — a sender credential
audit-core issues (AUDIT-IN-0002) and a canon edit only net-kingdom may
make (NET-IN-0002). Both intakes were filed outbound, so nothing in this
checkout held them.
Session protocol Step 3 scans workplans/ for open work. With every
workplan finished it found none, and each session re-derived the same two
externally-owned gaps from SCOPE.md prose and the audit-core source
before concluding there was nothing to do. TEN-WP-0012 holds that
conclusion so it is read rather than rediscovered, as a blocked workplan
with two wait tasks — the convention's status for work owed by another
party.
Records for each what would close it, including the decline branch, and
states the two things not to do: no editing net-kingdom canon from here,
and no requesting the audit-core token over the message bus.
No code change; 287 tests pass and ruff is clean.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HHwvAEQfmzLHtrFGhXtVjq
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 823014@bnt-lap001
Assistant-Session: 2a0786b1-efea-4c38-959b-6e86a493f259
Updated by fix-consistency on 2026-09-07:
- update .custodian-brief.md for tenant-engine
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 823014@bnt-lap001
Assistant-Session: 2a0786b1-efea-4c38-959b-6e86a493f259
The .claude/rules/ files still carried the seed placeholders. The
practical failure: session-protocol.md told agents to check the inbox
with to_agent="repo-seed", which returns [] regardless. Three unread
messages from gate-house and risk-nexus sat unread for days behind that
wrong query until fix-consistency's C-28 surfaced them. Replaced
repo-seed with tenant-engine throughout, and REPO-WP- with this repo's
actual TEN-WP- prefix.
Also records that no MCP server is registered (dev-hub was deregistered
2026-09-04), so the REST paths are the default rather than the fallback,
and fixes the root CLAUDE.md heading, still "Repo Seed".
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HHwvAEQfmzLHtrFGhXtVjq
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 823014@bnt-lap001
Assistant-Session: 2a0786b1-efea-4c38-959b-6e86a493f259
Updated by fix-consistency on 2026-09-07:
- update .custodian-brief.md for tenant-engine
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 823014@bnt-lap001
Assistant-Session: 2a0786b1-efea-4c38-959b-6e86a493f259
SCOPE.md still said TEN-WP-0008 was "ready, not done" two paragraphs
above its own table listing staged promotion as shipped, and its list of
finished workplans omitted 0008 and 0011. All twelve workplans are
finished; say so once.
.claude/rules/architecture.md still described `guardrail/` as a reserved,
unimplemented namespace and the production store as TBD. Guardrails
shipped in TEN-WP-0006/0007 and PostgreSQL became the production store in
TEN-WP-0009. Also corrects the live-lookup caller to `access-engine`,
matching SCOPE.md and the boundary contract.
No behaviour change; 287 tests pass unchanged.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HHwvAEQfmzLHtrFGhXtVjq
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 823014@bnt-lap001
Assistant-Session: 2a0786b1-efea-4c38-959b-6e86a493f259
Updated by fix-consistency on 2026-08-29:
- update .custodian-brief.md for tenant-engine
Assistant: grok
Assistant-Session: 01a04cea-e5e8-7081-a0fc-808ebbc35fa9
TEN-WP-0008. railiance/app.toml declares criticality=high, empty secrets,
isolated canary, and the live PostgreSQL digest as previous_stable.
Manifests render through kustomize (deploy/ and deploy/canary/). Stage 1
passed. Stage 2/3 Helm-only CLI gap requested as RAIL-BS-IN-0001 rather
than a dummy chart.
Assistant: grok
Assistant-Session: 01a04cea-e5e8-7081-a0fc-808ebbc35fa9
Updated by fix-consistency on 2026-08-29:
- update .custodian-brief.md for tenant-engine
Assistant: grok
Assistant-Session: 01a04cea-e5e8-7081-a0fc-808ebbc35fa9
Engine/PIP declaration is now checkable (layer.yaml plus a Tooling-client
scan). Writes persist a decision record or the published fail-closed
stance, live-lookup freshness is published, events_for is tenant-scoped,
and mutation evidence drains to audit-core from a local outbox without
blocking the mutation.
Sender registration is requested as AUDIT-IN-0002. Boundary-contract
amendment is requested as NET-IN-0002.
Assistant: grok
Assistant-Session: 01a04cea-e5e8-7081-a0fc-808ebbc35fa9
Updated by fix-consistency on 2026-08-29:
- update .custodian-brief.md for tenant-engine
Assistant: grok
Assistant-Session: 01a04cea-e5e8-7081-a0fc-808ebbc35fa9
