tegwick
7721ec6a31
TEN-WP-0011 closed correctly: T04 and T06 built everything this repo owns. What neither could close is the other side — a sender credential audit-core issues (AUDIT-IN-0002) and a canon edit only net-kingdom may make (NET-IN-0002). Both intakes were filed outbound, so nothing in this checkout held them. Session protocol Step 3 scans workplans/ for open work. With every workplan finished it found none, and each session re-derived the same two externally-owned gaps from SCOPE.md prose and the audit-core source before concluding there was nothing to do. TEN-WP-0012 holds that conclusion so it is read rather than rediscovered, as a blocked workplan with two wait tasks — the convention's status for work owed by another party. Records for each what would close it, including the decline branch, and states the two things not to do: no editing net-kingdom canon from here, and no requesting the audit-core token over the message bus. No code change; 287 tests pass and ruff is clean. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01HHwvAEQfmzLHtrFGhXtVjq Assistant: claude-code Assistant-Model: opus Assistant-Process: 823014@bnt-lap001 Assistant-Session: 2a0786b1-efea-4c38-959b-6e86a493f259
103 lines
4 KiB
Markdown
103 lines
4 KiB
Markdown
---
|
|
id: TEN-WP-0012
|
|
type: workplan
|
|
title: "Track the two external dispositions tenant-engine is waiting on"
|
|
domain: infotech
|
|
repo: tenant-engine
|
|
status: blocked
|
|
owner: claude
|
|
topic_slug: netkingdom
|
|
created: "2026-09-07"
|
|
updated: "2026-09-07"
|
|
depends_on:
|
|
- TEN-WP-0011
|
|
unblocks: []
|
|
origin: residual
|
|
origin_ref: TEN-WP-0011
|
|
---
|
|
|
|
# TEN-WP-0012 — Track the two external dispositions tenant-engine is waiting on
|
|
|
|
`TEN-WP-0011` closed correctly. Its T04 and T06 are `done` in the sense that
|
|
matters here: this repository built everything it owns. What neither task
|
|
could close is the other side — a credential audit-core issues, and a canon
|
|
edit only `net-kingdom` may make.
|
|
|
|
Those two waits have no durable local record. The intakes were filed
|
|
outbound, on other repositories' intake files, so nothing in this checkout
|
|
holds them. `SCOPE.md` mentions both in prose, but prose is not scanned.
|
|
|
|
The cost is small and repeating: session protocol Step 3 scans `workplans/`
|
|
for open work, finds none, and each session re-derives the same two
|
|
externally-owned gaps from `SCOPE.md` and the audit-core source before
|
|
concluding — correctly — that there is nothing to do. This workplan holds
|
|
that conclusion so it is read rather than rediscovered.
|
|
|
|
## Why this is a workplan and not an intake
|
|
|
|
This repository's intake files record work *it* may act on. Both records
|
|
here are the opposite: work filed elsewhere, awaiting someone else's
|
|
disposition. Only `workplans/` is read at session start, and `wait` is the
|
|
convention's status for work that is blocked on another party.
|
|
|
|
## Non-goals
|
|
|
|
- Not editing `net-kingdom` canon from this repository. `TEN-WP-0011-T06`
|
|
settled that: file an intake, never fork the contract.
|
|
- Not requesting a credential over the message bus. Credential routing is
|
|
explicit that `POST /messages/` asking for a token is an anti-pattern;
|
|
sender registration is audit-core's to issue.
|
|
- Not re-opening `TEN-WP-0011`. Our side of both items shipped.
|
|
- No code change is expected from this workplan. If either disposition
|
|
arrives and *does* require code, that becomes its own workplan.
|
|
|
|
## T01 — audit-core sender registration (AUDIT-IN-0002)
|
|
|
|
```task
|
|
id: TEN-WP-0012-T01
|
|
status: wait
|
|
priority: medium
|
|
```
|
|
|
|
The emission path shipped in `TEN-WP-0011-T04`: the local outbox is inside
|
|
the mutation transaction, the drain POSTs `/v1/events` and never fails a
|
|
mutation, and the trade is declared in `docs/evidence-emission.md`. What is
|
|
missing is sender registration — a credential audit-core issues and holds
|
|
custody of. `src/tenant_engine/audit_core.py` documents that this module
|
|
holds no audit-core credential beyond that sender token.
|
|
|
|
Waiting on: `AUDIT-IN-0002`, filed on audit-core.
|
|
|
|
Done when: audit-core registers the sender and production mutations land
|
|
externally, **or** audit-core declines and `SCOPE.md` row
|
|
"Independent audit-core emission" is restated to say so.
|
|
|
|
Do not: request the token by message, or synthesize a local stand-in that
|
|
would make the outbox look drained when it is not.
|
|
|
|
## T02 — boundary-contract amendment (NET-IN-0002)
|
|
|
|
```task
|
|
id: TEN-WP-0012-T02
|
|
status: wait
|
|
priority: low
|
|
```
|
|
|
|
`net-kingdom/canon/standards/tenant-engine-boundary-contract_v0.1.md` still
|
|
calls guardrail/quota policy "reserved, not implemented" and this repository
|
|
"not a policy enforcement point". Guardrails shipped in `TEN-WP-0006`/`0007`,
|
|
and the write path is PEP-shaped without this repository being a PDP, so
|
|
both sentences now mislead a reader who trusts the contract over the code.
|
|
|
|
Waiting on: `NET-IN-0002`, filed on `net-kingdom` by `TEN-WP-0011-T06`.
|
|
|
|
Done when: the contract is amended at its next cut, **or** `net-kingdom`
|
|
declines and the standing divergence is recorded here rather than left as
|
|
a live contradiction between contract and code.
|
|
|
|
## Closing this workplan
|
|
|
|
Close when both tasks reach a disposition, whichever way each falls. If
|
|
either stays open long enough to stop being worth re-reading, `cancel` the
|
|
task and say in `SCOPE.md` that the gap is permanent — an accepted,
|
|
documented divergence beats an indefinite `wait`.
|