docs: preserve netkingdom-target-2026-10-17 session evidence (batch 5)
This commit is contained in:
codex
parent
7a3632ffcc
commit
145752f3d3
26 changed files with 5208 additions and 0 deletions
|
|
@ -0,0 +1,163 @@
|
|||
---
|
||||
id: WARDEN-WP-0011
|
||||
type: workplan
|
||||
title: "Routing Lookup CLI"
|
||||
domain: infotech
|
||||
repo: ops-warden
|
||||
status: archived
|
||||
owner: codex
|
||||
topic_slug: custodian
|
||||
planning_priority: high
|
||||
planning_order: 11
|
||||
created: "2026-06-18"
|
||||
updated: "2026-06-24"
|
||||
state_hub_workstream_id: "0a520f8e-01b4-48f1-9af3-2f3f69fd0672"
|
||||
---
|
||||
|
||||
> **Terminology note:** Historical text in this archived workplan may use the legacy term "workstream". The fleet term is **workplan** (`canon/standards/workplan-terminology-fleet_v0.1.md`).
|
||||
|
||||
# WARDEN-WP-0011 — Routing Lookup CLI
|
||||
|
||||
**Scope:** A `warden route` command group that reads the pointer catalog and tells
|
||||
a worker which subsystem owns a need, what the prerequisites are, and which
|
||||
wiki/canon doc to follow **on that system**. ops-warden does not call OpenBao,
|
||||
flex-auth, or key-cape on the worker's behalf.
|
||||
|
||||
**Out of scope:** HTTP API; live probes against any subsystem; secret generation or
|
||||
retrieval; a separate health/precondition command (see "Dropped" below); replacing
|
||||
subsystem CLIs.
|
||||
|
||||
**Depends on:** WARDEN-WP-0010 T3 (catalog schema + seed).
|
||||
|
||||
**Unlocks:** Agents run `warden route show <id> --json` instead of re-deriving
|
||||
routing from wiki prose each session.
|
||||
|
||||
---
|
||||
|
||||
## Target CLI
|
||||
|
||||
```text
|
||||
warden route list [--json] [--tag <tag>]
|
||||
warden route show <id> [--json]
|
||||
warden route find <query> [--json] # keyword match against need_keywords
|
||||
```
|
||||
|
||||
`list`/`find` show only `status: active` entries by default (`--all` includes draft).
|
||||
|
||||
### Behaviour
|
||||
|
||||
| Command | Does | Does not |
|
||||
| --- | --- | --- |
|
||||
| `list` / `show` | Return owner, wiki/canon pointers, `warden_executes`, anti-patterns | Return secret material |
|
||||
| `find` | Rank scenarios by keyword overlap | Invoke any external API |
|
||||
|
||||
When `warden_executes: true` (SSH), `show` appends the catalog's authored `steps`
|
||||
and the `warden sign` / `cert_command` pattern, plus a local precondition hint
|
||||
("actor in inventory? backend configured? run `warden status`"). For all other
|
||||
scenarios `show` ends with **"next action on `<owner_repo>` — see `<wiki_ref>`"**
|
||||
and never implies warden performed anything.
|
||||
|
||||
### Dropped: separate `check` command
|
||||
|
||||
The earlier draft had `warden coach check`. Cut. For SSH, `warden status` already
|
||||
covers local preconditions; duplicating it invites scope creep toward probing
|
||||
foreign subsystems. SSH precondition hints live inside `show` instead.
|
||||
|
||||
---
|
||||
|
||||
## Tasks
|
||||
|
||||
### T1 — Catalog loader and models
|
||||
|
||||
```task
|
||||
id: WARDEN-WP-0011-T01
|
||||
status: done
|
||||
priority: high
|
||||
state_hub_task_id: "55b8422c-ad3c-4084-9e00-acaa4c360906"
|
||||
```
|
||||
|
||||
- [x] Add `src/warden/routing/` package: `models.py`, `catalog.py`.
|
||||
- [x] Load and validate `registry/routing/catalog.yaml`.
|
||||
- [x] Enforce the no-double-source rule: non-SSH entries with a `steps` block are a
|
||||
validation error. Clear errors for missing file, schema violations, dup `id`.
|
||||
|
||||
### T2 — `warden route list` and `show`
|
||||
|
||||
```task
|
||||
id: WARDEN-WP-0011-T02
|
||||
status: done
|
||||
priority: high
|
||||
state_hub_task_id: "60b679c5-79bd-4186-b5a6-ac576931f06c"
|
||||
```
|
||||
|
||||
- [x] Register `route` Typer sub-app on the main CLI.
|
||||
- [x] `list` — Rich table + `--json` array of summaries; active-only unless `--all`.
|
||||
- [x] `show` — owner, prerequisites, pointers (`wiki_ref`, `canon_ref`),
|
||||
`warden_executes`, anti-patterns; SSH entries also append `steps` + cert pattern.
|
||||
- [x] Exit 1 with a `find` hint when `show` id is unknown.
|
||||
|
||||
### T3 — `warden route find`
|
||||
|
||||
```task
|
||||
id: WARDEN-WP-0011-T03
|
||||
status: done
|
||||
priority: high
|
||||
state_hub_task_id: "d307701f-0117-44f0-80fd-ca6f7ae06f42"
|
||||
```
|
||||
|
||||
- [x] Tokenize query; match against `need_keywords`, `title`, `id`.
|
||||
- [x] Rank, show top matches (default 5); `--json` for agents.
|
||||
- [x] Fixtures: "issue core api key", "ssh tunnel", "openrouter key".
|
||||
|
||||
### T4 — Tests
|
||||
|
||||
```task
|
||||
id: WARDEN-WP-0011-T04
|
||||
status: done
|
||||
priority: high
|
||||
state_hub_task_id: "00a76e0f-8ab6-4f9a-ac6a-00eae633342c"
|
||||
```
|
||||
|
||||
- [x] `tests/test_routing.py` — catalog load, no-double-source validation rejects a
|
||||
non-SSH `steps` block, find ranking, show JSON shape, SSH `show` includes cert
|
||||
pattern.
|
||||
- [x] No integration test requires a live subsystem.
|
||||
|
||||
### T5 — Doc consistency + drift guard
|
||||
|
||||
```task
|
||||
id: WARDEN-WP-0011-T05
|
||||
status: done
|
||||
priority: high
|
||||
state_hub_task_id: "bf848375-eca7-4116-bb1d-fb7df6395c70"
|
||||
```
|
||||
|
||||
- [x] CI/test: every `wiki_ref` anchor resolves to an existing in-repo wiki section;
|
||||
every entry has a `reviewed` date.
|
||||
- [x] `wiki/AccessRouting.md` — CLI section with agent-oriented examples.
|
||||
- [x] README — `warden route --help` quick reference.
|
||||
- [x] Bump SCOPE availability note A3 → A4 on ship.
|
||||
|
||||
---
|
||||
|
||||
## Acceptance
|
||||
|
||||
- `uv run warden route find "issue core api key"` returns the draft scenario only
|
||||
with `--all`, and never a generated key.
|
||||
- `uv run warden route show ssh-cert-host-access --json` includes
|
||||
`warden_executes: true` and the cert_command pattern.
|
||||
- A non-SSH catalog entry carrying a `steps` block fails `test_routing.py`.
|
||||
- `uv run pytest tests/test_routing.py` passes with no live-subsystem dependency.
|
||||
|
||||
---
|
||||
|
||||
## See also
|
||||
|
||||
- `WARDEN-WP-0010` — charter and catalog schema
|
||||
- `WARDEN-WP-0012` — expanded per-scenario playbooks
|
||||
- `history/2026-06-17-intent-scope-assessment.md` — prior `warden guide` proposal (P4)
|
||||
---
|
||||
|
||||
## Closeout (2026-06-24)
|
||||
|
||||
Archived during WARDEN-WP-0013 T2. All tasks complete.
|
||||
|
|
@ -0,0 +1,204 @@
|
|||
---
|
||||
id: WARDEN-WP-0013
|
||||
type: workplan
|
||||
title: "Production Integration & Stewardship Closeout"
|
||||
domain: infotech
|
||||
repo: ops-warden
|
||||
status: archived
|
||||
owner: codex
|
||||
topic_slug: custodian
|
||||
planning_priority: high
|
||||
planning_order: 13
|
||||
depends_on_workplans:
|
||||
- WARDEN-WP-0008
|
||||
- WARDEN-WP-0009
|
||||
- WARDEN-WP-0010
|
||||
- WARDEN-WP-0011
|
||||
related_workplans:
|
||||
- WARDEN-WP-0012
|
||||
- FLEX-WP-0007
|
||||
created: "2026-06-24"
|
||||
updated: "2026-06-24"
|
||||
state_hub_workstream_id: "4678c41a-c1d0-48cd-9988-4ea0380e8258"
|
||||
---
|
||||
|
||||
> **Terminology note:** Historical text in this archived workplan may use the legacy term "workstream". The fleet term is **workplan** (`canon/standards/workplan-terminology-fleet_v0.1.md`).
|
||||
|
||||
# WARDEN-WP-0013 — Production Integration & Stewardship Closeout
|
||||
|
||||
## Purpose
|
||||
|
||||
Close the remaining **ops-warden-owned** gaps after policy gate and routing shipped:
|
||||
refresh INTENT/SCOPE canon, archive finished workplans, document ops-bridge
|
||||
`cert_command` migration, operator OpenBao token hygiene, principals drift checks,
|
||||
and the policy-gate production flip checklist.
|
||||
|
||||
This workplan addresses the deferred **Production SSH Integration Closeout** strand
|
||||
from `history/2026-06-18-post-wp0008-intent-scope-reassessment.md` §6, updated for
|
||||
post-WP-0009 state.
|
||||
|
||||
**Gap analysis:** `history/2026-06-24-intent-scope-gap-analysis.md`
|
||||
|
||||
## Scope
|
||||
|
||||
- Post-WP-0009 reassessment and SCOPE alignment
|
||||
- Archive hygiene for WP-0010 and WP-0011
|
||||
- ops-bridge `cert_command` migration documentation (pilot `agt-state-hub-bridge`)
|
||||
- Operator runbook for scoped OpenBao tokens (no root in `VAULT_TOKEN`)
|
||||
- Principals drift check between warden inventory and railiance-infra
|
||||
- Policy gate production enablement checklist (coordinate FLEX-WP-0007)
|
||||
|
||||
## Out of scope
|
||||
|
||||
- flex-auth runtime deployment (flex-auth **FLEX-WP-0007**)
|
||||
- ops-bridge tunnel config changes in the ops-bridge repo (coordinate only)
|
||||
- Routing scenario playbook expansion (**WARDEN-WP-0012** — parallel track)
|
||||
- OpenBao cluster deploy, flex-auth policy authoring, NK-WP-0009 tutorial
|
||||
- Implementing secret vending or foreign API proxies
|
||||
|
||||
## Ownership boundary
|
||||
|
||||
| Concern | Owner |
|
||||
| --- | --- |
|
||||
| cert_command migration playbook | ops-warden (doc); ops-bridge (tunnel config) |
|
||||
| OpenBao token hygiene runbook | ops-warden (doc); operator (execution) |
|
||||
| Principals drift | ops-warden (check doc/script); railiance-infra (host deploy) |
|
||||
| `policy.enabled: true` flip | operator (after FLEX-WP-0007) |
|
||||
|
||||
---
|
||||
|
||||
## T1 — Post-gap reassessment and SCOPE refresh
|
||||
|
||||
```task
|
||||
id: WARDEN-WP-0013-T01
|
||||
status: done
|
||||
priority: high
|
||||
state_hub_task_id: "de46f9a2-bf11-4651-a23c-430c63f396c8"
|
||||
```
|
||||
|
||||
- [x] Write `history/2026-06-24-intent-scope-gap-analysis.md`
|
||||
- [x] Update `SCOPE.md` active workplan table (WP-0013, WP-0012 ready)
|
||||
- [x] Note maturity vector and partial INTENT criterion (ops-bridge) in SCOPE
|
||||
|
||||
**Acceptance:** Gap analysis on file; SCOPE reflects 2026-06-24 repo state.
|
||||
|
||||
---
|
||||
|
||||
## T2 — Archive hygiene (WP-0010, WP-0011)
|
||||
|
||||
```task
|
||||
id: WARDEN-WP-0013-T02
|
||||
status: done
|
||||
priority: medium
|
||||
state_hub_task_id: "1b35321d-63ad-40da-a1aa-0b66190a0733"
|
||||
```
|
||||
|
||||
- [x] Move `WARDEN-WP-0010-access-routing-charter.md` to
|
||||
`workplans/archived/260624-WARDEN-WP-0010-access-routing-charter.md`
|
||||
- [x] Move `WARDEN-WP-0011-routing-guide-cli.md` to
|
||||
`workplans/archived/260624-WARDEN-WP-0011-routing-guide-cli.md`
|
||||
- [x] Set frontmatter `status: archived` on both; add closeout notes
|
||||
- [x] Operator runs `make fix-consistency REPO=ops-warden` from `~/state-hub`
|
||||
|
||||
**Acceptance:** Only WP-0012 (ready) and WP-0013 (active when started) remain in
|
||||
`workplans/` root; hub synced.
|
||||
|
||||
---
|
||||
|
||||
## T3 — ops-bridge cert_command migration playbook
|
||||
|
||||
```task
|
||||
id: WARDEN-WP-0013-T03
|
||||
status: done
|
||||
priority: high
|
||||
state_hub_task_id: "ad8588b2-9ae9-4f94-bd77-8025851a38f5"
|
||||
```
|
||||
|
||||
- [x] Write `wiki/playbooks/ops-bridge-tunnel-cert.md` — static-key → `cert_command`
|
||||
migration checklist for tunnel configs
|
||||
- [x] Document pilot tunnel `agt-state-hub-bridge`: actor, pubkey path, cert_command
|
||||
string, inventory prerequisites
|
||||
- [x] Upgrade catalog entry `ops-bridge-tunnel` `wiki_ref` to the new playbook
|
||||
- [x] Coordinate with ops-bridge owner for pilot tunnel config change (State Hub message)
|
||||
- [ ] Record non-secret smoke evidence when pilot completes (`history/` entry — pending ops-bridge)
|
||||
|
||||
**Acceptance:** Playbook exists; catalog points at it; pilot steps documented even
|
||||
if ops-bridge execution is pending.
|
||||
|
||||
**Unlocks:** INTENT success criterion #3 moves from partial toward met.
|
||||
|
||||
---
|
||||
|
||||
## T4 — Operator OpenBao token hygiene runbook
|
||||
|
||||
```task
|
||||
id: WARDEN-WP-0013-T04
|
||||
status: done
|
||||
priority: medium
|
||||
state_hub_task_id: "5cb35829-32eb-4d59-97a1-f4d92ce8e239"
|
||||
```
|
||||
|
||||
- [x] Add `wiki/playbooks/operator-openbao-token-hygiene.md` covering scoped tokens,
|
||||
`VAULT_TOKEN` session pattern, OIDC route, HTTP 403 recovery
|
||||
- [x] Cross-link from `wiki/OpsWardenConfig.md` and production example yaml
|
||||
|
||||
**Acceptance:** Operator can follow runbook without asking ops-warden for token values.
|
||||
|
||||
---
|
||||
|
||||
## T5 — Principals inventory drift check
|
||||
|
||||
```task
|
||||
id: WARDEN-WP-0013-T05
|
||||
status: done
|
||||
priority: medium
|
||||
state_hub_task_id: "4025cd32-89f8-42c3-b1e8-eaf78497d91f"
|
||||
```
|
||||
|
||||
- [x] `scripts/check_principals_drift.py` compares inventory `hosts` vs
|
||||
`railiance-infra/ansible/inventory/ssh_principals.yaml`
|
||||
- [x] Script notes flex-auth registry regeneration via `build_flex_auth_registry.py`
|
||||
- [x] Tests in `tests/test_principals_drift.py`
|
||||
|
||||
**Acceptance:** Drift check runnable or documented; no secret material in script output.
|
||||
|
||||
---
|
||||
|
||||
## T6 — Policy gate production enablement checklist
|
||||
|
||||
```task
|
||||
id: WARDEN-WP-0013-T06
|
||||
status: done
|
||||
priority: medium
|
||||
state_hub_task_id: "51663f65-79cb-4108-87c8-9721f9476259"
|
||||
```
|
||||
|
||||
- [x] Operator checklist in `wiki/PolicyGatedSigning.md` § Production rollout
|
||||
- [x] Cross-link FLEX-WP-0007 and pickup brief
|
||||
- [x] Explicit: keep `policy.enabled: false` until flex-auth reachable
|
||||
|
||||
**Acceptance:** Operator checklist is sequential and references cross-repo owners;
|
||||
no ops-warden code changes required for flex-auth deploy.
|
||||
|
||||
---
|
||||
|
||||
## Exit criteria
|
||||
|
||||
- Gap analysis and SCOPE current
|
||||
- WP-0010 and WP-0011 archived
|
||||
- ops-bridge cert_command playbook + catalog upgrade
|
||||
- Operator token hygiene runbook
|
||||
- Principals drift procedure
|
||||
- Policy gate production flip checklist (coordinate FLEX-WP-0007)
|
||||
|
||||
## Parallel track
|
||||
|
||||
**WARDEN-WP-0012** (routing scenario playbooks) — promoted to `ready`; start when
|
||||
P1 integration doc bandwidth allows or in parallel if staffed.
|
||||
|
||||
## See also
|
||||
|
||||
- `history/2026-06-24-intent-scope-gap-analysis.md`
|
||||
- `history/2026-06-18-post-wp0008-intent-scope-reassessment.md`
|
||||
- `wiki/CertCommandInterface.md`
|
||||
- `~/flex-auth/workplans/FLEX-WP-0007-ops-warden-policy-gate-production-deployment.md`
|
||||
|
|
@ -0,0 +1,147 @@
|
|||
---
|
||||
id: WARDEN-WP-0012
|
||||
type: workplan
|
||||
title: "Routing Scenario Playbooks"
|
||||
domain: infotech
|
||||
repo: ops-warden
|
||||
status: finished
|
||||
owner: codex
|
||||
topic_slug: custodian
|
||||
planning_priority: medium
|
||||
planning_order: 12
|
||||
created: "2026-06-18"
|
||||
updated: "2026-06-24"
|
||||
state_hub_workstream_id: "a7e712a0-02f8-4f83-944e-6b207e77bc4c"
|
||||
---
|
||||
|
||||
> **Terminology note:** Historical text in this archived workplan may use the legacy term "workstream". The fleet term is **workplan** (`canon/standards/workplan-terminology-fleet_v0.1.md`).
|
||||
|
||||
# WARDEN-WP-0012 — Routing Scenario Playbooks
|
||||
|
||||
**Scope:** Grow the routing catalog and wiki playbooks for high-frequency NetKingdom
|
||||
access scenarios. Each wiki playbook restates **what the worker does on the owning
|
||||
system** and tracks an upstream canon doc; the catalog only points at it. ops-warden
|
||||
authors procedure only for the SSH lane.
|
||||
|
||||
**Out of scope:** Implementing custody in ops-warden; creating OpenBao paths in
|
||||
railiance-platform (coordinate only); authoring flex-auth policy; restating an
|
||||
owner's procedure inside the catalog.
|
||||
|
||||
**Depends on:** WARDEN-WP-0010 (charter + catalog schema), WARDEN-WP-0011 (routing CLI).
|
||||
|
||||
**Status:** `finished` — playbooks shipped; draft entries await owner path promotion.
|
||||
|
||||
---
|
||||
|
||||
## Anti-stale rule
|
||||
|
||||
A scenario is added to the catalog as `status: active` **only when its owning repo's
|
||||
path actually exists** and a `wiki_ref` is written. Until then it stays `status:
|
||||
draft` and is hidden from default `warden route find`/`list`. We do not seed
|
||||
agent-visible entries for paths that owners have not shipped — a confident-looking
|
||||
pointer to a non-existent path is worse than no entry.
|
||||
|
||||
---
|
||||
|
||||
## Scenario backlog
|
||||
|
||||
| Catalog id | Routing focus | Executing owner | Gate |
|
||||
| --- | --- | --- | --- |
|
||||
| `issue-core-ingestion-api-key` | OpenBao KV path, K8s injection, rotation | railiance-platform + issue-core | path exists |
|
||||
| `activity-core-issue-sink` | `ISSUE_CORE_URL` + consumer key custody | activity-core + issue-core | path exists |
|
||||
| `inter-hub-bootstrap-ssh` | SSH envelope + on-host wrapper reads OpenBao | ops-warden SSH + railiance-infra | ready (SSH lane) |
|
||||
| `openrouter-llm-connect` | OpenBao → K8s Secret in activity-core | railiance-platform | path exists |
|
||||
| `object-storage-sts` | NK-WP-0007 vending path | net-kingdom + flex-auth + OpenBao | canon exists |
|
||||
| `ops-bridge-tunnel-cert` | cert_command vs static-key migration | ops-bridge | done (WP-0013) |
|
||||
| `human-oidc-login` | key-cape / Keycloak IAM Profile | key-cape | canon exists |
|
||||
| `flex-auth-resource-check` | Policy decision before sensitive action | flex-auth | canon exists |
|
||||
| `host-principal-deploy` | auth_principals sync | railiance-infra | canon exists |
|
||||
|
||||
---
|
||||
|
||||
## Tasks
|
||||
|
||||
### T1 — issue-core ingestion key playbook
|
||||
|
||||
```task
|
||||
id: WARDEN-WP-0012-T01
|
||||
status: done
|
||||
priority: high
|
||||
state_hub_task_id: "830bb512-0288-4dba-9dd4-ccfd28a4921f"
|
||||
```
|
||||
|
||||
- [x] Coordinate with railiance-platform to canonicalize the OpenBao path first.
|
||||
(Documented expected path from `railiance-platform/docs/argocd-gitops.md`;
|
||||
live KV path not yet shipped — promotion blocked per anti-stale rule.)
|
||||
- [x] Then write `wiki/playbooks/issue-core-ingestion-api-key.md` (prerequisites,
|
||||
ESO pattern, rotation, privileged-read policy) and promote the catalog entry
|
||||
from `draft` to `active` with a `wiki_ref`. (Playbook + `wiki_ref` done;
|
||||
stays `draft` until path ships.)
|
||||
|
||||
### T2 — Inter-Hub and bootstrap lanes
|
||||
|
||||
```task
|
||||
id: WARDEN-WP-0012-T02
|
||||
status: done
|
||||
priority: medium
|
||||
state_hub_task_id: "7726a703-6e00-4e49-9380-ed3fb3268827"
|
||||
```
|
||||
|
||||
- [x] Align `wiki/InterHubBootstrapAccessLane.md` with catalog id `inter-hub-bootstrap-ssh`
|
||||
- [x] Document attended vs unattended bootstrap branches
|
||||
- [x] Cross-link flex-auth and OpenBao expectations (pointers, not restated steps)
|
||||
- [x] Promote catalog entry to `active` with `wiki_ref`
|
||||
|
||||
### T3 — ops-bridge tunnel migration
|
||||
|
||||
```task
|
||||
id: WARDEN-WP-0012-T03
|
||||
status: done
|
||||
priority: medium
|
||||
state_hub_task_id: "9fb397f0-0abb-48f5-bb62-7e77edae93bb"
|
||||
```
|
||||
|
||||
- [x] Playbook: `wiki/playbooks/ops-bridge-tunnel-cert.md` (WARDEN-WP-0013)
|
||||
- [x] Pilot tunnel `agt-state-hub-bridge` documented; ops-bridge coordination sent
|
||||
|
||||
### T4 — Platform secret scenarios (LLM, STS, DB)
|
||||
|
||||
```task
|
||||
id: WARDEN-WP-0012-T04
|
||||
status: done
|
||||
priority: low
|
||||
state_hub_task_id: "edcf4ed7-f18d-4a92-a42d-8cc7ca0ab792"
|
||||
```
|
||||
|
||||
- [x] Playbooks for OpenRouter, object-storage STS, DB dynamic creds.
|
||||
- [x] Each ends with an owner-repo action; no warden secret code; pointers to canon.
|
||||
|
||||
### T5 — Drift review cadence
|
||||
|
||||
```task
|
||||
id: WARDEN-WP-0012-T05
|
||||
status: done
|
||||
priority: low
|
||||
state_hub_task_id: "db98d655-8551-487b-9413-41bf97fc06e1"
|
||||
```
|
||||
|
||||
- [x] Document a review cadence against net-kingdom canon.
|
||||
- [x] `warden route list --stale` keyed off the `reviewed:` date field.
|
||||
- [x] Process note in `wiki/AccessRouting.md`.
|
||||
|
||||
---
|
||||
|
||||
## Acceptance
|
||||
|
||||
- Every active catalog entry has a `wiki_ref` to an existing section; no active entry
|
||||
points at a path its owner has not shipped (those stay `draft`).
|
||||
- `warden route find` resolves common agent queries without wiki grep.
|
||||
- Playbooks and catalog contain no secret material — only owners, pointers, checklists.
|
||||
|
||||
---
|
||||
|
||||
## See also
|
||||
|
||||
- `WARDEN-WP-0010`, `WARDEN-WP-0011`
|
||||
- `wiki/CredentialRouting.md`
|
||||
- `history/2026-06-18-post-wp0008-intent-scope-reassessment.md`
|
||||
|
|
@ -0,0 +1,215 @@
|
|||
---
|
||||
id: WARDEN-WP-0014
|
||||
type: workplan
|
||||
title: "Operator Access Assist — warden access front door"
|
||||
domain: infotech
|
||||
repo: ops-warden
|
||||
status: finished
|
||||
owner: codex
|
||||
topic_slug: custodian
|
||||
planning_priority: high
|
||||
planning_order: 14
|
||||
created: "2026-06-27"
|
||||
updated: "2026-06-27"
|
||||
state_hub_workstream_id: "3c30b2ed-6ede-4b95-a438-fde6da6f6633"
|
||||
---
|
||||
|
||||
> **Terminology note:** Historical text in this archived workplan may use the legacy term "workstream". The fleet term is **workplan** (`canon/standards/workplan-terminology-fleet_v0.1.md`).
|
||||
|
||||
# WARDEN-WP-0014 — Operator Access Assist (`warden access`)
|
||||
|
||||
**Scope:** Make ops-warden the consistent operator-facing front door for **every**
|
||||
NetKingdom security/access need — not just the SSH lane. Add a `warden access`
|
||||
command surface that (a) advises: emits the auth method, path, policy context, and
|
||||
exact command skeleton for any credential need, and (b) **proxies**: transparently
|
||||
fetches the value from the owning subsystem *as the caller* and streams it to the
|
||||
operator's destination, **without ops-warden ever persisting, caching, or logging
|
||||
the secret, and without ops-warden holding any standing privileged credential.**
|
||||
|
||||
Centralize **knowledge and policy** in ops-warden; leave **custody and execution
|
||||
detail** in the owning subsystems (OpenBao, key-cape, flex-auth). ops-warden becomes
|
||||
a transparent, policy-gated, audited conduit — `vault exec` / `op run` shaped — never
|
||||
a standing secret broker.
|
||||
|
||||
**Charter note:** This extends the WP-0010 routing charter from a *pointer layer*
|
||||
("who owns it") to an *assist layer* ("here is exactly how to get it, gated and
|
||||
audited"). It does **not** move custody into ops-warden. See the three non-negotiable
|
||||
guardrails below — they are the line between a transparent conduit (sanctioned) and a
|
||||
standing broker/honeypot (forbidden).
|
||||
|
||||
**Out of scope:**
|
||||
- ops-warden holding a long-lived OpenBao/secret-read token of its own.
|
||||
- Persisting, caching, or logging any secret **value** anywhere (disk, log, hub, git).
|
||||
- Creating OpenBao paths or policies (coordinate with railiance-platform / flex-auth).
|
||||
- Restating an owner's procedure as prose in the catalog (reference canon, don't copy).
|
||||
- Identity/MFA implementation (key-cape owns it; we orchestrate its CLI only).
|
||||
|
||||
**Depends on:** WP-0010 (charter + catalog schema), WP-0011 (`warden route` CLI),
|
||||
WP-0007/0009 (flex-auth policy gate — reused as the fetch-path gate).
|
||||
|
||||
**Status:** `proposed` — awaiting Bernd's review before implementation.
|
||||
|
||||
---
|
||||
|
||||
## Three non-negotiable guardrails (acceptance-blocking)
|
||||
|
||||
These are the design invariants that keep proxy mode safe. Any task that violates one
|
||||
is rejected regardless of convenience.
|
||||
|
||||
1. **Operator identity, never warden's.** `--fetch`/`--exec` authenticate as the
|
||||
*caller* (their OIDC/OpenBao token, the agent's own auth). ops-warden carries **no**
|
||||
standing secret-read credential. If the caller has no valid auth, the command fails
|
||||
with a routing pointer to the auth step — it does not fall back to a warden token.
|
||||
|
||||
2. **Transit only — no persistence, no logging of values.** The secret flows
|
||||
subsystem → caller destination (env of a child process, or stdout) via a streamed
|
||||
`exec`. ops-warden must not buffer it to disk, cache it, echo it to logs, or write
|
||||
it to the State Hub. Audit records **metadata only** (who, need id, owner path, time,
|
||||
policy decision id) — never the value.
|
||||
|
||||
3. **Policy gate on the fetch path.** `--fetch`/`--exec` run the flex-auth check
|
||||
**before** proxying (reusing the WP-0007 gate). When `policy.enabled: false`, fetch
|
||||
is **advisory-only** by default and requires an explicit `--no-policy` acknowledgement
|
||||
to proxy ungated — surfaced loudly in output and audit.
|
||||
|
||||
---
|
||||
|
||||
## Phasing decision (default — adjust in review)
|
||||
|
||||
OpenBao lane **first** (covers the immediate npm/API/DB need), key-cape/login lane in
|
||||
a later task within the same WP. Rationale: OpenBao KV is the highest-frequency operator
|
||||
need and the one this conversation surfaced; login flows are a thinner orchestration of
|
||||
an interactive tool and lower risk to defer.
|
||||
|
||||
---
|
||||
|
||||
## Tasks
|
||||
|
||||
### T1 — Catalog schema: structured handoff fields
|
||||
|
||||
```task
|
||||
id: WARDEN-WP-0014-T01
|
||||
status: done
|
||||
priority: high
|
||||
state_hub_task_id: "abb0e722-6524-4224-8638-6ee1573ed3e0"
|
||||
```
|
||||
|
||||
- [x] Extend `registry/routing/catalog.yaml` entry schema with optional structured
|
||||
handoff fields for non-SSH lanes: `auth_method`, `path_template`,
|
||||
`fetch_command`, `exec_capable` (bool), `policy_ref`. (`RouteEntry` +
|
||||
`_parse_entry`; `has_handoff` helper.)
|
||||
- [x] Fields are **structured pointers/templates**, not prose restatements — each
|
||||
sits alongside the owner's `canon_ref` for the authoritative procedure (no drift).
|
||||
- [x] Populate for `openbao-api-key` (covers the coulomb_social npm shape: keyword
|
||||
`npm_auth_token` added) as the reference example; `draft` entries untouched.
|
||||
- [x] Validation: `_assert_no_secret_material` rejects known token prefixes and
|
||||
high-entropy runs in any handoff field; `exec_capable` requires `fetch_command`.
|
||||
Tests in `tests/test_routing.py` (handoff parse, real-catalog, secret-leak
|
||||
matrix, placeholder-accepted).
|
||||
|
||||
### T2 — `warden access` advisory surface
|
||||
|
||||
```task
|
||||
id: WARDEN-WP-0014-T02
|
||||
status: done
|
||||
priority: high
|
||||
state_hub_task_id: "c1497263-7124-459f-b63a-d0c0c7005c86"
|
||||
```
|
||||
|
||||
- [x] `warden access <need> [--domain X] [--json]` — resolves via the same matcher as
|
||||
`warden route find` and renders the **structured handoff**: owner, auth method,
|
||||
path template, command skeleton, policy ref + gate status, proxy hint, and the
|
||||
`<…>` owner-confirmed-name note. (`warden/access.py` pure module + `access`
|
||||
command in `cli.py`.)
|
||||
- [x] Advisory is the **default** behavior (no value fetched); SSH lane points at
|
||||
`warden sign`; routed lanes end with "warden advises, the owner vends".
|
||||
- [x] `--json` output for agentic operators — stable, secret-free shape
|
||||
(`handoff` block + `next_action`); `--domain` substitutes `<domain>` only.
|
||||
- [x] Tests: `tests/test_access.py` (expansion, gate status, advisory/SSH/JSON/no-match).
|
||||
|
||||
### T3 — OpenBao proxy lane (`--fetch` / `--exec`)
|
||||
|
||||
```task
|
||||
id: WARDEN-WP-0014-T03
|
||||
status: done
|
||||
priority: high
|
||||
state_hub_task_id: "6d3eb0e4-309c-4065-893e-6c4053fb0db2"
|
||||
```
|
||||
|
||||
- [x] `warden access <need> --fetch` — policy-gate (G3) → run the owning tool
|
||||
(`bao kv get ...`) **as the caller** with **inherited stdout** → value streams to
|
||||
stdout and never enters warden's memory (`proxy_fetch`). No buffering, no log.
|
||||
- [x] `warden access <need> --exec -- <cmd>` — runs the child with the secret injected
|
||||
into *its* env only (`proxy_exec`); value never lands in the caller's shell env;
|
||||
`--field` names the env var (e.g. `NPM_AUTH_TOKEN`).
|
||||
- [x] Guardrails G1–G3 in code (`warden/proxy.py`, `_access_proxy` in `cli.py`):
|
||||
G1 caller token only (no warden credential; `caller_auth_present`); G2 transit-only
|
||||
(inherit-stdout fetch; no disk/log write); G3 `check_fetch_policy` before any exec,
|
||||
`--no-policy` required to proxy ungated. `tests/test_proxy.py` asserts all three,
|
||||
plus `resolve_fetch_command` refuses unresolved `<…>` placeholders. Live smoke
|
||||
against a fake `bao` confirmed gate-refusal, stream, exec-inject, and a
|
||||
secret-free audit log.
|
||||
- [x] Metadata-only audit per call (`write_audit` → `state_dir/access-audit.log`).
|
||||
|
||||
### T4 — key-cape / login orchestration lane
|
||||
|
||||
```task
|
||||
id: WARDEN-WP-0014-T04
|
||||
status: done
|
||||
priority: medium
|
||||
state_hub_task_id: "481997e4-193d-4724-84a6-61cbc2940153"
|
||||
```
|
||||
|
||||
- [x] Extend `warden access` to orchestrate the key-cape/Keycloak OIDC login flow
|
||||
under the same advisory/proxy split. New `lane: secret|login` field on
|
||||
`RouteEntry`; `key-cape-oidc-login` populated as a `login` lane entry.
|
||||
- [x] Login lane semantics: no caller-auth precheck (you have no token yet) and no
|
||||
secret-read gate (it bootstraps the identity the gate needs); runs interactively
|
||||
as the caller via inherited stdio; `--exec` rejected. Token stays in the caller's
|
||||
own store — warden never captures it (G2 holds). Audited as `action: login`.
|
||||
- [x] Tests in `tests/test_proxy.py` (runs without token/ack, rejects --exec, real
|
||||
catalog lane, invalid-lane rejection). Live fake-`bao login` smoke confirmed.
|
||||
|
||||
### T5 — Docs, security model, and INTENT/SCOPE alignment
|
||||
|
||||
```task
|
||||
id: WARDEN-WP-0014-T05
|
||||
status: done
|
||||
priority: medium
|
||||
state_hub_task_id: "a5eb616e-4edf-42db-a4fb-bf296cdb92bc"
|
||||
```
|
||||
|
||||
- [x] `wiki/OperatorAccessAssist.md` — the `warden access` contract, the conduit-vs-broker
|
||||
boundary, and the three guardrails (+ the catalog secret-material guard) as a
|
||||
security-model statement; lanes documented.
|
||||
- [x] Updated `wiki/AccessRouting.md` (issue/route/**assist** roles + reconciled the
|
||||
anti-patterns table so the conduit doesn't contradict it) and the
|
||||
`.claude/rules/credential-routing.md` agent rule (added `warden access` + the
|
||||
"standing broker forbidden, transparent `--fetch` sanctioned" anti-pattern).
|
||||
- [x] SCOPE/INTENT: recorded the pointer→assist charter extension; SCOPE implemented
|
||||
list + Getting Oriented updated; maturity vector A4 → **A5** on Availability.
|
||||
- [x] `history/2026-06-27-operator-access-assist-charter.md` — decision record.
|
||||
|
||||
---
|
||||
|
||||
## Acceptance
|
||||
|
||||
- `warden access <need>` advises for any catalog need; `--fetch`/`--exec` proxy the
|
||||
OpenBao lane end to end against a real KV path.
|
||||
- All three guardrails hold under test: **no** secret value touches disk/log/hub/git;
|
||||
ops-warden holds **no** standing secret-read credential; the policy gate runs **before**
|
||||
every fetch.
|
||||
- Catalog carries structured handoff fields that reference (never restate) owner canon.
|
||||
- Docs state the conduit-vs-broker boundary explicitly; the agent rule forbids the
|
||||
broker pattern.
|
||||
- No secret material anywhere in code, catalog, docs, logs, or tests.
|
||||
|
||||
---
|
||||
|
||||
## See also
|
||||
|
||||
- `WARDEN-WP-0010` (routing charter), `WARDEN-WP-0011` (`warden route` CLI)
|
||||
- `WARDEN-WP-0007` / `WARDEN-WP-0009` (flex-auth policy gate — reused as fetch gate)
|
||||
- `wiki/AccessRouting.md`, `wiki/CredentialRouting.md`, `wiki/PolicyGatedSigning.md`
|
||||
- `.claude/rules/credential-routing.md`
|
||||
- `history/2026-06-24-intent-scope-gap-analysis.md`
|
||||
|
|
@ -0,0 +1,247 @@
|
|||
---
|
||||
id: WARDEN-WP-0015
|
||||
type: workplan
|
||||
title: "Workload Security Posture — env posture × maturity + conformance"
|
||||
domain: infotech
|
||||
repo: ops-warden
|
||||
status: finished
|
||||
owner: codex
|
||||
topic_slug: custodian
|
||||
planning_priority: high
|
||||
planning_order: 15
|
||||
created: "2026-06-27"
|
||||
updated: "2026-06-27"
|
||||
state_hub_workstream_id: "99f4a0e1-853c-456f-8aa7-8ff0f318ea65"
|
||||
---
|
||||
|
||||
> **Terminology note:** Historical text in this archived workplan may use the legacy term "workstream". The fleet term is **workplan** (`canon/standards/workplan-terminology-fleet_v0.1.md`).
|
||||
|
||||
# WARDEN-WP-0015 — Workload Security Posture (two-axis) + conformance
|
||||
|
||||
**Scope:** Establish a NetKingdom standard for IT-security posture across **two
|
||||
orthogonal axes**, and make ops-warden the **conformance steward** for it:
|
||||
|
||||
- **Axis A — Environment posture** (`dev → test → prod`): how the *secret store* is
|
||||
secured (mock / OpenBao `-dev` / sealed). Identical contracts, divergent posture.
|
||||
- **Axis B — Workload maturity** (`M0 → M3`): how *trusted* a workload is to receive
|
||||
secrets and handle classified data (PoC → alpha/early-access → beta/GA → critical).
|
||||
|
||||
The axes combine in a **secret-flow lattice**: a secret may be delivered to a workload
|
||||
only if the workload's posture *and* maturity meet the secret's requirements. ops-warden
|
||||
authors the ops-security slice, ships machine-readable descriptors + a conformance
|
||||
checker (incl. the lattice check), and the dev-tier **contract-double** fixture library
|
||||
(the "fake bao" pattern generalized).
|
||||
|
||||
**Decisions locked (2026-06-27):**
|
||||
- Two-axis model folded into this WP (was "Secret Lifecycle Tiering", env posture only).
|
||||
- Authoritative **NetKingdom requirements** (M0–M3 table, secret-flow gates, env-posture
|
||||
ceremonies) live in **net-kingdom canon**; the **generic `WorkloadMaturityLevel`
|
||||
concept + lattice** is contributed to **info-tech-canon** (DevSecOps/Landscape),
|
||||
reusing its governed `DataClassification`. ops-warden authors the ops-security slice +
|
||||
conformance tooling.
|
||||
- ops-warden role = **author + conformance checks**, **not** runtime enforcement.
|
||||
|
||||
**Reuse, don't reinvent (info-tech-canon already defines the primitives):**
|
||||
`DataClassification` (`confidential`/`restricted`…) in the Data Model; promotion /
|
||||
quality gates / policy gates / `DeploymentVerification` + progressive delivery in the
|
||||
DevSecOps Model; asset/business **criticality** in the Security Model; access semantics
|
||||
in the CARING Access Governance Standard. This WP **assembles** these into a named
|
||||
maturity ladder + flow rule; it does not fork them.
|
||||
|
||||
**Hard boundary (responsibility-map, ~line 154):** ops-warden "must not become a
|
||||
universal secret broker — runtime secrets remain OpenBao; authorization remains
|
||||
flex-auth." ops-warden = policy author + conformance verifier only. OpenBao holds the
|
||||
secrets; flex-auth makes allow/deny decisions; CARING governs access semantics.
|
||||
|
||||
**Cross-repo note:** T1/T5 author content destined for **net-kingdom** and
|
||||
**info-tech-canon**. ops-warden drafts; landing it is coordinated through each repo's
|
||||
own process (inbox/PR), not a unilateral write from here.
|
||||
|
||||
**Depends on / relates to:** WARDEN-WP-0014 (the `warden access` proxy is the
|
||||
posture-aware fetch surface; its caller-identity/transit guardrails are prod-compatible).
|
||||
|
||||
**Status:** `finished` — all five tasks done. T1 authored the standard, T2 shipped the
|
||||
descriptors + `warden policy`, T3 the read-only conformance checker, T4 the dev-double
|
||||
library, T5 the INTENT/SCOPE alignment. Canon landing in net-kingdom / info-tech-canon
|
||||
is owner-driven and tracked via the open coordination messages (not closed here).
|
||||
|
||||
---
|
||||
|
||||
## The model (to be encoded by this WP)
|
||||
|
||||
### Axis A — Environment posture (the secret store)
|
||||
|
||||
**R1 — Contract parity, posture divergence.** Identical interface at every tier; only
|
||||
the backend's security posture changes. Automation written once runs at all tiers
|
||||
unchanged (this is why contract doubles work).
|
||||
**R2 — Promote topology, regenerate material.** Secret *values* are never promoted up
|
||||
the ladder; only *structure* (paths, policy shape, names). Values are generated fresh
|
||||
per tier. Test conveniences (reuse, single-unseal) are quarantined in test.
|
||||
**R3 — Dev touches no real data, ever.** Insecure personal mock store is sanctioned
|
||||
*iff* dev uses only synthetic data. Absolute.
|
||||
**R4 — Phase-changes are ceremonies, not copies.** test→prod is a gated checklist
|
||||
referencing net-kingdom `security-bootstrap-*` / unseal-custody docs.
|
||||
|
||||
| | dev | test | prod |
|
||||
| --- | --- | --- | --- |
|
||||
| backend | mock / contract double | OpenBao `-dev` (single-unseal) | OpenBao sealed (Shamir 3-of-5) |
|
||||
| real values | forbidden (synthetic) | generated, reuse allowed | generated fresh, reuse forbidden |
|
||||
| unseal | n/a | single key / auto | 3-of-5 + break-glass |
|
||||
| real user/business data | never | never | allowed |
|
||||
| audit | optional | on | full, tamper-evident |
|
||||
|
||||
### Axis B — Workload maturity (the trust to receive secrets/data)
|
||||
|
||||
**Production is a posture, not a maturity.** A workload can be prod-posture yet low
|
||||
maturity (alpha with friendly customers). Maturity gates *which secrets and data
|
||||
classes* a prod workload may touch.
|
||||
|
||||
| Level | Phase | Max DataClassification | Promotion gate (reuses DevSecOps gates) |
|
||||
| --- | --- | --- | --- |
|
||||
| **M0** | Experimental / PoC | synthetic only | — |
|
||||
| **M1** | Alpha / early-access | low-criticality, loss-acceptable; no confidential/restricted | friendly-customer scope, basic SLO, data-handling note |
|
||||
| **M2** | Beta / GA | up to `confidential`; SLOs; audited | security review, SLO history, on-call, incident runbooks |
|
||||
| **M3** | Critical / regulated | `restricted`; break-glass; compliance | pen-test, 3-of-5 custody, human-in-loop, compliance audit |
|
||||
|
||||
### The combined rule (secret-flow lattice)
|
||||
|
||||
```
|
||||
deliver(secret → workload) permitted only if
|
||||
workload.env_posture == prod # Axis A
|
||||
AND workload.maturity >= secret.required_maturity # Axis B (no-write-down)
|
||||
AND workload.maturity >= required_maturity(dataclass(secret))
|
||||
```
|
||||
|
||||
"Critical secrets must not be transferred to workloads below maturity M" is exactly
|
||||
this no-write-down constraint. Checkable by ops-warden; enforceable by flex-auth.
|
||||
|
||||
---
|
||||
|
||||
## Tasks
|
||||
|
||||
### T1 — Author the two-axis Workload Security Posture standard (canon-bound)
|
||||
|
||||
```task
|
||||
id: WARDEN-WP-0015-T01
|
||||
status: done
|
||||
priority: high
|
||||
state_hub_task_id: "85aeb676-a593-4056-986a-db14d4c5209f"
|
||||
```
|
||||
|
||||
- [x] Drafted the standard: Axis A (R1–R4 + env-posture matrix + phase-change ceremonies)
|
||||
and Axis B (M0–M3 ladder + promotion gates) unified by the secret-flow lattice —
|
||||
`wiki/WorkloadSecurityPosture.md`.
|
||||
- [x] Layered it: doc marks the generic `WorkloadMaturityLevel` + lattice → **info-tech-canon**
|
||||
(reusing `DataClassification`) and the NetKingdom M0–M3 requirements + env-posture
|
||||
ceremonies → **net-kingdom canon**, with a canon-layering table.
|
||||
- [x] Cross-linked the unseal/bootstrap/responsibility canon + info-tech-canon
|
||||
Security/DevSecOps/Data/CARING models. Staged in ops-warden; **coordination
|
||||
opened** to net-kingdom (msg 8d6f8d83) and info-tech-canon (msg ca07b085).
|
||||
- [x] Encoded ops-warden's role: author + conformance, not enforcement/custody.
|
||||
- Note: canon **landing** in the two repos is owner-driven; tracked to closure in T5.
|
||||
|
||||
### T2 — Machine-readable posture descriptors (both axes)
|
||||
|
||||
```task
|
||||
id: WARDEN-WP-0015-T02
|
||||
status: done
|
||||
priority: high
|
||||
state_hub_task_id: "011fb0af-154d-40f4-a03e-3172c325321a"
|
||||
```
|
||||
|
||||
- [x] `registry/policy/security-posture.yaml` — env-posture tiers (backend, value-policy,
|
||||
unseal, data-class, audit) **and** maturity levels (M0–M3, max DataClassification,
|
||||
promotion gates), `dataclass_floor` mapping, and the lattice rule. No secret material.
|
||||
- [x] Loader + validation in `src/warden/posture.py` (mirrors `routing/catalog.py`):
|
||||
unique/contiguous ranks, dataclass_floor references known levels, lattice env
|
||||
posture exists. Includes the pure `can_deliver` lattice helper (reused by T3).
|
||||
- [x] `warden policy list|show` lookup (mirrors `warden route`; `--json`).
|
||||
- [x] Tests: `tests/test_posture.py` (load, lattice allow/deny matrix, validation
|
||||
rejections, CLI). 184 pass, lint clean.
|
||||
|
||||
### T3 — Conformance checker (incl. secret-flow lattice)
|
||||
|
||||
```task
|
||||
id: WARDEN-WP-0015-T03
|
||||
status: done
|
||||
priority: high
|
||||
state_hub_task_id: "c1a0e987-19d0-478e-ac08-2dbe98e64e09"
|
||||
```
|
||||
|
||||
- [x] `scripts/check_secret_posture_conformance.py` — asserts env-posture matches the
|
||||
standard (`backend`/`unseal`/`real_values` per tier) **and** evaluates the lattice
|
||||
via `posture.can_deliver`: flags any secret whose `required_maturity` or data-class
|
||||
floor exceeds a target workload's maturity, or that targets a non-prod workload.
|
||||
Drift-style report, like `check_principals_drift.py`. Read-only; exit 0/1/2.
|
||||
- [x] Surfaces conformance + lattice violations; never reads or prints a secret value
|
||||
(manifest is metadata-only). Example: `examples/posture-conformance.example.yaml`.
|
||||
- [x] Tests: `tests/test_posture_conformance.py` (env mismatch, unknown env, lattice
|
||||
deny/allow, missing workload, exit codes). 8 cases, lint clean.
|
||||
|
||||
### T4 — Dev-tier contract-double fixture library
|
||||
|
||||
```task
|
||||
id: WARDEN-WP-0015-T04
|
||||
status: done
|
||||
priority: medium
|
||||
state_hub_task_id: "e556fd2e-4e39-4c7d-bd94-b4330e4bef45"
|
||||
```
|
||||
|
||||
- [x] Generalized "fake bao" into `src/warden/doubles.py`: `materialize_doubles()`
|
||||
writes hermetic dev-tier doubles for routed subsystems (`bao`, `key-cape`)
|
||||
honoring each contract (argv/stdout/exit), emitting **synthetic values only**
|
||||
(`synthetic-` prefix, asserted in tests). `doubles_path_prepended()` puts them
|
||||
ahead on PATH for fully offline dev/test of access flows.
|
||||
- [x] Documented the pattern in the standard (R1) as the sanctioned `dev` backend.
|
||||
- [x] Tests: `tests/test_doubles.py` (contract honoring, synthetic-only, unknown
|
||||
contract → exit 2, end-to-end proxy fetch offline against the double). 9 cases.
|
||||
|
||||
### T5 — INTENT/SCOPE alignment + canon contributions
|
||||
|
||||
```task
|
||||
id: WARDEN-WP-0015-T05
|
||||
status: done
|
||||
priority: medium
|
||||
state_hub_task_id: "298c9b09-4a5a-41bf-a3bd-6c572385236b"
|
||||
```
|
||||
|
||||
- [x] `INTENT.md`: ops-warden stewards **security-policy conformance** of the
|
||||
infrastructure (authoring the two-axis posture standard + conformance checks + dev
|
||||
doubles), scoped to author+check — **not** enforcement or custody.
|
||||
- [x] SCOPE: add the posture policy + conformance surface; note the net-kingdom /
|
||||
info-tech-canon homes; bump the maturity vector where warranted.
|
||||
- [x] Canon landing tracked to a documented hand-off. The contributions are **drafted
|
||||
and offered**: info-tech-canon (generic `WorkloadMaturityLevel` + lattice, msg
|
||||
`ca07b085`) and net-kingdom (M0–M3 requirements + env-posture ceremonies, msg
|
||||
`8d6f8d83`). **Landing is owner-driven and out of ops-warden's control** — it is
|
||||
tracked through each repo's own inbox/PR process, not closed unilaterally here.
|
||||
ops-warden's authored slice + conformance tooling are complete.
|
||||
- [x] `history/2026-06-27-workload-security-posture-charter.md` — decision record.
|
||||
|
||||
2026-06-27 progress: shipped the T3 conformance checker and T4 dev-double library
|
||||
with tests (200 passing, lint clean); updated `INTENT.md` / `SCOPE.md` /
|
||||
`wiki/WorkloadSecurityPosture.md` for the author+conformance role. Canon landing in
|
||||
net-kingdom / info-tech-canon remains owner-driven via the open coordination messages.
|
||||
|
||||
---
|
||||
|
||||
## Acceptance
|
||||
|
||||
- A coherent two-axis standard exists: generic concept in info-tech-canon, NetKingdom
|
||||
M0–M3 + env-posture requirements in net-kingdom canon, authored by ops-warden.
|
||||
- ops-warden ships posture descriptors + a read-only conformance checker (incl. the
|
||||
secret-flow lattice) + dev-tier doubles.
|
||||
- No secret material in any descriptor, checker, fixture, doc, or log.
|
||||
- ops-warden's role is documented as author+conformance; OpenBao custody, flex-auth
|
||||
authorization, and CARING access boundaries are explicitly preserved.
|
||||
- INTENT/SCOPE reflect the conformance-steward role without overclaiming enforcement.
|
||||
|
||||
---
|
||||
|
||||
## See also
|
||||
|
||||
- `WARDEN-WP-0014` (operator access assist; the posture-aware fetch surface)
|
||||
- `net-kingdom/docs/openbao-unseal-custody-models.md`, `responsibility-map.md`,
|
||||
`platform-root-custody.md`, `security-bootstrap-*`
|
||||
- `info-tech-canon` Security / DevSecOps / Data Models + CARING Access Governance
|
||||
- `flex-auth` (runtime enforcement of the lattice, as a follow-up)
|
||||
|
|
@ -0,0 +1,52 @@
|
|||
---
|
||||
id: WARDEN-WP-ADHOC-2026-07-07
|
||||
type: workplan
|
||||
title: "Ad Hoc Tasks — 2026-07-07"
|
||||
domain: infotech
|
||||
repo: ops-warden
|
||||
status: finished
|
||||
owner: grok
|
||||
topic_slug: custodian
|
||||
created: "2026-07-07"
|
||||
updated: "2026-07-07"
|
||||
state_hub_workstream_id: "90568b1e-8395-5c67-9c69-851ed08ff3d3"
|
||||
---
|
||||
|
||||
> **Terminology note:** Historical text in this archived workplan may use the legacy term "workstream". The fleet term is **workplan** (`canon/standards/workplan-terminology-fleet_v0.1.md`).
|
||||
|
||||
# Ad Hoc Tasks — 2026-07-07
|
||||
|
||||
### T01 — Roll out proxy pipe fix (be3b4a2)
|
||||
|
||||
```task
|
||||
id: WARDEN-WP-ADHOC-2026-07-07-T01
|
||||
status: done
|
||||
priority: high
|
||||
state_hub_task_id: "bf985c95-bea6-5057-94f9-9cfa7e1c9dd8"
|
||||
```
|
||||
|
||||
`warden access` failed on `reuse-surface-hub-write-token` because `shlex.split`
|
||||
treated `kubectl … | base64 -d` as literal argv. Fixed in `be3b4a2`; rollout
|
||||
requires refreshing the installed CLI (cached `0.1.0` wheel does not pick up
|
||||
source changes).
|
||||
|
||||
- [x] Code fix merged and pushed (`be3b4a2`)
|
||||
- [x] Version bumped `0.1.0` → `0.1.1` so `uv tool install` invalidates stale wheels
|
||||
- [x] Workstation rollout: `git pull && make install-all` (after cache clean if needed)
|
||||
- [x] Smoke: `warden access reuse-surface-hub-write-token --no-policy --fetch` — no
|
||||
`unknown shorthand flag: 'd'`; token fetched via shell pipeline
|
||||
|
||||
**Operator upgrade on any machine using `warden access`:**
|
||||
|
||||
```bash
|
||||
cd ~/ops-warden && git pull --ff-only
|
||||
make install-all
|
||||
warden route show reuse-surface-hub-write-token --json
|
||||
```
|
||||
|
||||
If `warden` still lacks `ResolvedFetch` / pipe handling after install:
|
||||
|
||||
```bash
|
||||
uv cache clean ops-warden
|
||||
uv tool install . --with-editable ../phase-memory --reinstall --force
|
||||
```
|
||||
|
|
@ -0,0 +1,11 @@
|
|||
{
|
||||
"status": "ok",
|
||||
"db": "connected",
|
||||
"instance_role": "primary",
|
||||
"instance_label": "railiance01",
|
||||
"schema": {
|
||||
"status": "ok",
|
||||
"applied": "c4d5e6f7a8b9",
|
||||
"expected": "c4d5e6f7a8b9"
|
||||
}
|
||||
}
|
||||
|
|
@ -0,0 +1,151 @@
|
|||
{
|
||||
"repo_slug": "ops-warden",
|
||||
"repo_path": "/home/worsch/ops-warden",
|
||||
"source_revision": "117fec9241e7b985dfb187b992e173d0a5dc3700",
|
||||
"source_revision_reason": null,
|
||||
"issues": [
|
||||
{
|
||||
"severity": "WARN",
|
||||
"check_id": "C-24",
|
||||
"message": "Repo classification advisory: capability_tag 'security' is not a recommended family tag (allowed, check for synonym)",
|
||||
"file_path": "",
|
||||
"db_id": "",
|
||||
"file_value": "",
|
||||
"db_value": "",
|
||||
"fixable": false
|
||||
},
|
||||
{
|
||||
"severity": "WARN",
|
||||
"check_id": "C-42",
|
||||
"message": "Blocked workplan 'warden-wp-0027' has no task in status wait \u2014 nothing states what it waits for; qualify a wait task or re-status the workplan",
|
||||
"file_path": "workplans/WARDEN-WP-0027-credential-governance-lockdown.md",
|
||||
"db_id": "21528e8d-a049-523d-9ae1-da7a27cb8bbf",
|
||||
"file_value": "blocked",
|
||||
"db_value": "",
|
||||
"fixable": false
|
||||
},
|
||||
{
|
||||
"severity": "WARN",
|
||||
"check_id": "C-37",
|
||||
"message": "Residual workplan 'warden-wp-0034' has no origin/origin_ref provenance (not invented)",
|
||||
"file_path": "workplans/WARDEN-WP-0034-layer-model-v07-conformance.md",
|
||||
"db_id": "ae3ff76f-883d-5e2f-b6aa-144d61e8fdef",
|
||||
"file_value": "",
|
||||
"db_value": "",
|
||||
"fixable": false
|
||||
},
|
||||
{
|
||||
"severity": "WARN",
|
||||
"check_id": "C-40",
|
||||
"message": "blocker satisfied, task still wait: 'WARDEN-WP-0037-T03' in workplan 'WARDEN-WP-0037' \u2014 decision 1591daa1-6e85-4dfd-aadd-5a9fe1ef47fa is resolved",
|
||||
"file_path": "workplans/WARDEN-WP-0037-whynot-design-forgejo-npm-lane.md#WARDEN-WP-0037-T03",
|
||||
"db_id": "",
|
||||
"file_value": "1591daa1-6e85-4dfd-aadd-5a9fe1ef47fa",
|
||||
"db_value": "",
|
||||
"fixable": false
|
||||
},
|
||||
{
|
||||
"severity": "WARN",
|
||||
"check_id": "C-11",
|
||||
"message": "Task 'WARDEN-WP-0038-T01' has no state_hub_task_id",
|
||||
"file_path": "workplans/WARDEN-WP-0038-plan-mutation-intent.md#WARDEN-WP-0038-T01",
|
||||
"db_id": "",
|
||||
"file_value": "",
|
||||
"db_value": "",
|
||||
"fixable": true
|
||||
},
|
||||
{
|
||||
"severity": "WARN",
|
||||
"check_id": "C-37",
|
||||
"message": "Residual workplan 'warden-wp-0040' has no origin/origin_ref provenance (not invented)",
|
||||
"file_path": "workplans/WARDEN-WP-0040-unknown-zone-fail-closed-adoption.md",
|
||||
"db_id": "c8ee441e-1be1-5219-910c-e79ff23cc9ec",
|
||||
"file_value": "",
|
||||
"db_value": "",
|
||||
"fixable": false
|
||||
},
|
||||
{
|
||||
"severity": "INFO",
|
||||
"check_id": "C-08",
|
||||
"message": "Retired DB workstream 'adhoc-2026-06-29@retired-20260828' (id=1c0460b7\u2026, status=finished) has no backing workplan file \u2014 projection tombstone, not live work",
|
||||
"file_path": "",
|
||||
"db_id": "1c0460b7-bc8a-48db-96d4-681bce18ac91",
|
||||
"file_value": "",
|
||||
"db_value": "",
|
||||
"fixable": false
|
||||
},
|
||||
{
|
||||
"severity": "INFO",
|
||||
"check_id": "C-08",
|
||||
"message": "Retired DB workstream 'adhoc-2026-08-17@retired-20260827' (id=8376eb89\u2026, status=finished) has no backing workplan file \u2014 projection tombstone, not live work",
|
||||
"file_path": "",
|
||||
"db_id": "8376eb89-36f2-52b0-a59a-2954b2e49349",
|
||||
"file_value": "",
|
||||
"db_value": "",
|
||||
"fixable": false
|
||||
},
|
||||
{
|
||||
"severity": "INFO",
|
||||
"check_id": "C-08",
|
||||
"message": "Retired DB workstream 'adhoc-2026-08-11@retired-20260827' (id=bc6dd3e3\u2026, status=finished) has no backing workplan file \u2014 projection tombstone, not live work",
|
||||
"file_path": "",
|
||||
"db_id": "bc6dd3e3-ab2b-567a-9574-30d2650f20a2",
|
||||
"file_value": "",
|
||||
"db_value": "",
|
||||
"fixable": false
|
||||
},
|
||||
{
|
||||
"severity": "INFO",
|
||||
"check_id": "C-08",
|
||||
"message": "Retired DB workstream 'ops-warden-adhoc-2026-06-27@retired-20260827' (id=142b171b\u2026, status=finished) has no backing workplan file \u2014 projection tombstone, not live work",
|
||||
"file_path": "",
|
||||
"db_id": "142b171b-c34b-4a45-91a5-c77e6d07ec6f",
|
||||
"file_value": "",
|
||||
"db_value": "",
|
||||
"fixable": false
|
||||
},
|
||||
{
|
||||
"severity": "INFO",
|
||||
"check_id": "C-08",
|
||||
"message": "Retired DB workstream 'adhoc-2026-07-07@retired-20260827' (id=2e8bc783\u2026, status=finished) has no backing workplan file \u2014 projection tombstone, not live work",
|
||||
"file_path": "",
|
||||
"db_id": "2e8bc783-2e37-4b86-a691-177b18329783",
|
||||
"file_value": "",
|
||||
"db_value": "",
|
||||
"fixable": false
|
||||
},
|
||||
{
|
||||
"severity": "WARN",
|
||||
"check_id": "C-28",
|
||||
"message": "2 unread inbox message(s) older than 3 day(s): the-custodian:23172cb2, the-custodian:51e9eace",
|
||||
"file_path": "",
|
||||
"db_id": "",
|
||||
"file_value": "",
|
||||
"db_value": "",
|
||||
"fixable": false
|
||||
},
|
||||
{
|
||||
"severity": "WARN",
|
||||
"check_id": "C-28",
|
||||
"message": "3 unread message(s) lack thread_id for supersession tracking: the-custodian:d422aecb, the-custodian:23172cb2, the-custodian:51e9eace",
|
||||
"file_path": "",
|
||||
"db_id": "",
|
||||
"file_value": "",
|
||||
"db_value": "",
|
||||
"fixable": false
|
||||
}
|
||||
],
|
||||
"fixes_applied": [
|
||||
"bindings: synced 51/51",
|
||||
"C-17 cleared: pushed 1 backlogged commit(s)",
|
||||
"C-11 skipped: task 'WARDEN-WP-0038-T01' in finished workstream \u2014 not created",
|
||||
"push: pushed"
|
||||
],
|
||||
"summary": {
|
||||
"fail": 0,
|
||||
"automation_error": 0,
|
||||
"warn": 8,
|
||||
"info": 5
|
||||
},
|
||||
"result": "warn"
|
||||
}
|
||||
|
|
@ -0,0 +1,256 @@
|
|||
{
|
||||
"files": [
|
||||
{
|
||||
"path": "backup/.custodian-brief.md",
|
||||
"sha256": "4ff4bb94315149e07d36b8f4ecbbfc63b61d72e9d81f0f43a9c2f02bc13ada85"
|
||||
},
|
||||
{
|
||||
"path": "backup/WORK-RECORDS.md",
|
||||
"sha256": "b6af9b1cb21e3a64b2ef8a5e732bc35c39cdeaef6af7a18f24824e8ec9fb5a76"
|
||||
},
|
||||
{
|
||||
"path": "backup/workplans/ADHOC-2026-06-27.md",
|
||||
"sha256": "f0a89c1809e23b436767a73b70636c283e79216fb19678f08bef2b9e62e42ddb"
|
||||
},
|
||||
{
|
||||
"path": "backup/workplans/ADHOC-2026-06-29.md",
|
||||
"sha256": "9869f07cdfe79d37314d36db74a434a55b50c0b965ae53f29d76ca9a9a73151f"
|
||||
},
|
||||
{
|
||||
"path": "backup/workplans/ADHOC-2026-08-11.md",
|
||||
"sha256": "6bba4f5dab9fc64f7b65df7c2ab7e4b9d4dbb69ba1c4a41c8440dbd23555aea4"
|
||||
},
|
||||
{
|
||||
"path": "backup/workplans/ADHOC-2026-08-17.md",
|
||||
"sha256": "39ec882551bf5643fabb3ebc9f47300b4e6f6caf6d67a0a26bc100b68d4e313e"
|
||||
},
|
||||
{
|
||||
"path": "backup/workplans/ADHOC-2026-09-08.md",
|
||||
"sha256": "27c64084fdd16b926b138584d96688061a18a58d4d8152d9688b4486b9687c05"
|
||||
},
|
||||
{
|
||||
"path": "backup/workplans/ADHOC-2026-10-03.md",
|
||||
"sha256": "8de5e5ba28ce2cd94c5864e316d54fe32e6cdfdb0e75551fe92ed25b81eeafa6"
|
||||
},
|
||||
{
|
||||
"path": "backup/workplans/WARDEN-WP-0016-ops-bridge-tunnel-cert-pilot.md",
|
||||
"sha256": "ad904837aa2d83d888d46c482fe381eba328c96a4617209ea8a9ae2d7d64c467"
|
||||
},
|
||||
{
|
||||
"path": "backup/workplans/WARDEN-WP-0017-access-front-door-discoverability.md",
|
||||
"sha256": "a35f65a40c98d35e86f352c1430837b8bc9f269bddaddfe4a71c6414f678d85c"
|
||||
},
|
||||
{
|
||||
"path": "backup/workplans/WARDEN-WP-0018-whynot-design-npm-lane-activation.md",
|
||||
"sha256": "6d9145534f7fa80cec9f185751d3796fdaab4a2d88b289a5451ba04e24822855"
|
||||
},
|
||||
{
|
||||
"path": "backup/workplans/WARDEN-WP-0019-route-to-secrets-engine.md",
|
||||
"sha256": "8fa2d79c85a821f7bc51044f37001bad613afb75d143181e2e0a01b213e06df8"
|
||||
},
|
||||
{
|
||||
"path": "backup/workplans/WARDEN-WP-0020-ops-warden-worker.md",
|
||||
"sha256": "d565f65413a2698160caf33ab30d7513a03d06ddcee7d624b198bb8841abdcc3"
|
||||
},
|
||||
{
|
||||
"path": "backup/workplans/WARDEN-WP-0021-enable-scheduled-worker-tick.md",
|
||||
"sha256": "4f7afe5bdd147705e68d31d02f39251543c6c120ce22d893b98af063e303c361"
|
||||
},
|
||||
{
|
||||
"path": "backup/workplans/WARDEN-WP-0022-audit-trail-and-activity.md",
|
||||
"sha256": "f733fb0d7cfcc7b44aba49a730e7f51381d6478a87c394161e77c90577c26505"
|
||||
},
|
||||
{
|
||||
"path": "backup/workplans/WARDEN-WP-0023-intent-scope-alignment-closeout.md",
|
||||
"sha256": "97d25825ba626a3979e8d6217aebd27f58d27fe9f92e8b94eb2f63e2bb843cb9"
|
||||
},
|
||||
{
|
||||
"path": "backup/workplans/WARDEN-WP-0024-experiential-memory-and-agent-sessions.md",
|
||||
"sha256": "22bde2d1398a4260e337768c6cf71cf80cd61d466371b6cfd0c0f0c18fc72378"
|
||||
},
|
||||
{
|
||||
"path": "backup/workplans/WARDEN-WP-0025-forgejo-admin-api-token-lane.md",
|
||||
"sha256": "ded5bdfdbe897f3376c71c7a169caca51a9d75453ba66cf216ec8dfcab91c708"
|
||||
},
|
||||
{
|
||||
"path": "backup/workplans/WARDEN-WP-0026-credential-disclosure-hygiene.md",
|
||||
"sha256": "f65ccdf9c920e9138353018e2ed5a7fbbd590246eb730fc6f57c75b6d2e09eea"
|
||||
},
|
||||
{
|
||||
"path": "backup/workplans/WARDEN-WP-0027-credential-governance-lockdown.md",
|
||||
"sha256": "0d0c08458718ec88883c4b257ea80011123a6d5aa2eea36fe28db331ff6d438f"
|
||||
},
|
||||
{
|
||||
"path": "backup/workplans/WARDEN-WP-0028-tenant-secret-custody.md",
|
||||
"sha256": "92cc0ad8d42209d5d7e45122e8ddd67e1970de1d200df373885ba5fb75e0d22a"
|
||||
},
|
||||
{
|
||||
"path": "backup/workplans/WARDEN-WP-0029-policy-front-door-and-founder-surface.md",
|
||||
"sha256": "2b21f06c062edd96943a1d26fd86c6a27b341b1db4532e528edbaebd4ced7e66"
|
||||
},
|
||||
{
|
||||
"path": "backup/workplans/WARDEN-WP-0030-delegation-register.md",
|
||||
"sha256": "59bf962b355cd9734315108f9868508739ddcb4855591bff53aea3634aed47f7"
|
||||
},
|
||||
{
|
||||
"path": "backup/workplans/WARDEN-WP-0031-policy-caller-identity.md",
|
||||
"sha256": "0fa890ba81833180feb727ba35dcf01ead7d7dedf55a285a49a2585049b4bffb"
|
||||
},
|
||||
{
|
||||
"path": "backup/workplans/WARDEN-WP-0032-security-zones.md",
|
||||
"sha256": "4497947e57fb86e883090d07c8bef031fd5fe4a7f3eb065d530ebe327d97b1cc"
|
||||
},
|
||||
{
|
||||
"path": "backup/workplans/WARDEN-WP-0033-native-lane-handoff.md",
|
||||
"sha256": "74747ebf7c628b1a5336c63aa3924212068a6015f370e647cf9127949c181998"
|
||||
},
|
||||
{
|
||||
"path": "backup/workplans/WARDEN-WP-0034-layer-model-v07-conformance.md",
|
||||
"sha256": "57e10b9efff02d7437231424ebc4d48864a2019939c2cda2fa10629a4ede2a3b"
|
||||
},
|
||||
{
|
||||
"path": "backup/workplans/WARDEN-WP-0035-policy-nexus-forgejo-source-read-route.md",
|
||||
"sha256": "d40987b48a8416de386972d214ce01dba138a9f294cc948de36085c794c76418"
|
||||
},
|
||||
{
|
||||
"path": "backup/workplans/WARDEN-WP-0036-attended-login-openbao-output.md",
|
||||
"sha256": "e0584491b5a6a7d4db0cf61a689f733b4a6597778ca79a3f8f2207fe7ecfb8cc"
|
||||
},
|
||||
{
|
||||
"path": "backup/workplans/WARDEN-WP-0037-whynot-design-forgejo-npm-lane.md",
|
||||
"sha256": "7c64a631eb70d9ff42826ea5966cac571786ff86bac5393f88c328aeb14aa9ba"
|
||||
},
|
||||
{
|
||||
"path": "backup/workplans/WARDEN-WP-0038-plan-mutation-intent.md",
|
||||
"sha256": "09b0ed8c6315255796a2da0d64dfd001b1f6de2e903ac2ea79bc5667b499fb83"
|
||||
},
|
||||
{
|
||||
"path": "backup/workplans/WARDEN-WP-0039-explicit-policy-refusal.md",
|
||||
"sha256": "e8773a7b4196cf77a48ab4ed0804a5f826a0a0b5e7972f968681746ebbc6e3e9"
|
||||
},
|
||||
{
|
||||
"path": "backup/workplans/WARDEN-WP-0040-unknown-zone-fail-closed-adoption.md",
|
||||
"sha256": "a4b8e768eaacd5ab5a90f69a1abcb3bd48ce821fcdea208b0ee75d9326f0d512"
|
||||
},
|
||||
{
|
||||
"path": "backup/workplans/WARDEN-WP-0041-catalog-lane-scaffolding.md",
|
||||
"sha256": "c16993301f29e7f5ea005cccdbe360ac9c4c3949e6988e2b7a1f1e5df6235bc1"
|
||||
},
|
||||
{
|
||||
"path": "backup/workplans/WARDEN-WP-0042-openbao-structure-survey-route.md",
|
||||
"sha256": "1e48399d6ef8a509898e8ea0b334a378c51ec467aaa704b6dbf8485aed29fa8b"
|
||||
},
|
||||
{
|
||||
"path": "backup/workplans/WARDEN-WP-0043-platform-supplier-credentials.md",
|
||||
"sha256": "c059b7f80ad4c0e5faa8ad15532ab6c2577d0c383ba91cde7293534b6e4683e2"
|
||||
},
|
||||
{
|
||||
"path": "backup/workplans/WARDEN-WP-0044-security-case-follow-through.md",
|
||||
"sha256": "721a90b2ed8c896257c34a1451eb642cb8824c8263e37c483fb61b36adc54088"
|
||||
},
|
||||
{
|
||||
"path": "backup/workplans/archived/260515-WARDEN-WP-0001-initial-implementation.md",
|
||||
"sha256": "359456ecd25525d95748ca611e7c6c118eee2b914dae447c84c59442a6520458"
|
||||
},
|
||||
{
|
||||
"path": "backup/workplans/archived/260515-WARDEN-WP-0002-correctness-and-completeness.md",
|
||||
"sha256": "43ba78e9c6e9914360edc88a6f8f5af0f981b3078ef41808a784ce7388559fb7"
|
||||
},
|
||||
{
|
||||
"path": "backup/workplans/archived/260515-WARDEN-WP-0003-test-coverage-and-quality.md",
|
||||
"sha256": "4fb4ac0cb72cf14dd72c6e5f313a068d90ead203460ad3ac68f0d5dd12b6a755"
|
||||
},
|
||||
{
|
||||
"path": "backup/workplans/archived/260617-WARDEN-WP-0004-repo-hygiene-and-hub-sync.md",
|
||||
"sha256": "fbb36a3d9c4ab0ac829bba713160d919b3c12c19f5f5826fb4e8483edeec3ac1"
|
||||
},
|
||||
{
|
||||
"path": "backup/workplans/archived/260617-WARDEN-WP-0005-openbao-doc-alignment.md",
|
||||
"sha256": "3c930a395d518f9b287855632c21fe99a3d5c78a758ece06498fb9e35f5ea8b9"
|
||||
},
|
||||
{
|
||||
"path": "backup/workplans/archived/260617-WARDEN-WP-0006-netkingdom-alignment-and-access-stewardship.md",
|
||||
"sha256": "fbc90ca4c18f8180a7fbcd2b43f21d7f99a44c914eb17c78f823228f8e3cc64f"
|
||||
},
|
||||
{
|
||||
"path": "backup/workplans/archived/260617-WARDEN-WP-0007-policy-gate-and-production-verify.md",
|
||||
"sha256": "613b73c79bad0929f621feb136b3141f9c60e23bf6e23650881a47c762101214"
|
||||
},
|
||||
{
|
||||
"path": "backup/workplans/archived/260618-WARDEN-WP-0008-production-ssh-path-and-stewardship-closeout.md",
|
||||
"sha256": "8362d4cdb933b52c9be968d5410c8548c7554cc4cd44ab0389b913674795a10a"
|
||||
},
|
||||
{
|
||||
"path": "backup/workplans/archived/260623-WARDEN-WP-0009-flex-auth-policy-gate-production.md",
|
||||
"sha256": "fa611c1a2e5c5a214e38f0673ebcda17e3f30e10556b268fb126ded9af2bdbbb"
|
||||
},
|
||||
{
|
||||
"path": "backup/workplans/archived/260624-WARDEN-WP-0010-access-routing-charter.md",
|
||||
"sha256": "62bc994e3efbb124004f98992ded6842ff2748568b2e405c61b335385a35b9d7"
|
||||
},
|
||||
{
|
||||
"path": "backup/workplans/archived/260624-WARDEN-WP-0011-routing-guide-cli.md",
|
||||
"sha256": "767cd3c53cfe64beab93f19475be823d0637a40140877db6dfcc60e2693652ce"
|
||||
},
|
||||
{
|
||||
"path": "backup/workplans/archived/260624-WARDEN-WP-0013-production-integration-and-stewardship-closeout.md",
|
||||
"sha256": "ecc38b4998796e20d734105df81ef6e2eb05c8e830b6d0dbe344d6336b9f668b"
|
||||
},
|
||||
{
|
||||
"path": "backup/workplans/archived/260627-WARDEN-WP-0012-routing-scenario-playbooks.md",
|
||||
"sha256": "7a7a1d25cd1d015c0a28f0d443de0512fc48cb1fda4317760051251988aa96f0"
|
||||
},
|
||||
{
|
||||
"path": "backup/workplans/archived/260627-WARDEN-WP-0014-operator-access-assist.md",
|
||||
"sha256": "c1b84e750b2580fa1deae7dd56fd29abe5d9924a3ccd47ce9fc5f99c26aa4924"
|
||||
},
|
||||
{
|
||||
"path": "backup/workplans/archived/260627-WARDEN-WP-0015-secret-lifecycle-tiering.md",
|
||||
"sha256": "300b8b6cfdd7306fbb81ab30d4f59551976eed1de0012fd655e4b6fc096ccf10"
|
||||
},
|
||||
{
|
||||
"path": "backup/workplans/archived/260707-ADHOC-2026-07-07.md",
|
||||
"sha256": "e169418f6d83f954de1907ae8fa26a5f5cf4fe011be01dba9363e69befa05cfa"
|
||||
},
|
||||
{
|
||||
"path": "health-before.json",
|
||||
"sha256": "f3f03424c7cbebf5d526a7daf1a8aaaa7b22f23e95b975b6cbc4a544ce164941"
|
||||
},
|
||||
{
|
||||
"path": "legacy-consistency.json",
|
||||
"sha256": "5a8f8ef18d778b635194fff676f0a1ea0b79cf2364099990b1e3b3609553b3b0"
|
||||
},
|
||||
{
|
||||
"path": "legacy-consistency.stderr.txt",
|
||||
"sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
|
||||
},
|
||||
{
|
||||
"path": "normal-sync-refusal.json",
|
||||
"sha256": "c8907b0f1d724a6d8e613e41c050c49b59ff750beb7cfa84b2c683918e528137"
|
||||
},
|
||||
{
|
||||
"path": "preimage.json",
|
||||
"sha256": "b1456512a772c306a326e9683fee6d279849adb305dccb9934e709650fceebb5"
|
||||
},
|
||||
{
|
||||
"path": "receiver-receipt.json",
|
||||
"sha256": "c6269bb22c86c0ccddd91e256b0032fe92f7fb47fb5304e1fcca47f05c3a68bf"
|
||||
},
|
||||
{
|
||||
"path": "receiver-request.json",
|
||||
"sha256": "eb65eb418da2b106218b06756a910d5b25983119953c812b588b3653049e0a3a"
|
||||
},
|
||||
{
|
||||
"path": "tasks-after.json",
|
||||
"sha256": "67ee9d1079cceee374e1b957149cbf1f55828af3a4344ba1a04b0fb305e3feb2"
|
||||
},
|
||||
{
|
||||
"path": "tasks-before.json",
|
||||
"sha256": "67ee9d1079cceee374e1b957149cbf1f55828af3a4344ba1a04b0fb305e3feb2"
|
||||
},
|
||||
{
|
||||
"path": "verification.json",
|
||||
"sha256": "0729755f050ca43c1fe4270f59b321b31f4edf377ff7240aec6da0d1959a3b7e"
|
||||
}
|
||||
]
|
||||
}
|
||||
|
|
@ -0,0 +1,24 @@
|
|||
{
|
||||
"status": "refused-before-sync",
|
||||
"reason": "Unrelated UUID assignment requires review; original normal publisher assertion retained",
|
||||
"preview": {
|
||||
"schema": "repo-manager.identifier-assignment.v1",
|
||||
"ok": true,
|
||||
"executed": false,
|
||||
"repo": "ops-warden",
|
||||
"namespace": "helixforge",
|
||||
"assignments": [
|
||||
{
|
||||
"kind": "task",
|
||||
"record_id": "WARDEN-WP-0038-T01",
|
||||
"uuid": "ef28df7c-2c72-56be-ad90-4e079f37639f",
|
||||
"path": "workplans/WARDEN-WP-0038-plan-mutation-intent.md"
|
||||
}
|
||||
],
|
||||
"historical_invalid_identifiers": [],
|
||||
"historical_identity_collisions": [],
|
||||
"files_changed": [
|
||||
"workplans/WARDEN-WP-0038-plan-mutation-intent.md"
|
||||
]
|
||||
}
|
||||
}
|
||||
|
|
@ -0,0 +1,272 @@
|
|||
{
|
||||
"head": "117fec9241e7b985dfb187b992e173d0a5dc3700",
|
||||
"origin_main": "a45cf475bc4dbc929e0eecbc1f806a9229d934e2",
|
||||
"status": "M WORK-RECORDS.md",
|
||||
"files": [
|
||||
{
|
||||
"path": ".custodian-brief.md",
|
||||
"sha256": "4ff4bb94315149e07d36b8f4ecbbfc63b61d72e9d81f0f43a9c2f02bc13ada85",
|
||||
"index": "100644 34573d262327057c11628ce8a7ca78292968545b 0\t.custodian-brief.md"
|
||||
},
|
||||
{
|
||||
"path": "WORK-RECORDS.md",
|
||||
"sha256": "b6af9b1cb21e3a64b2ef8a5e732bc35c39cdeaef6af7a18f24824e8ec9fb5a76",
|
||||
"index": "100644 34cf268862326a5832a7d0be9e84eb296e5601bb 0\tWORK-RECORDS.md"
|
||||
},
|
||||
{
|
||||
"path": "workplans/ADHOC-2026-06-27.md",
|
||||
"sha256": "f0a89c1809e23b436767a73b70636c283e79216fb19678f08bef2b9e62e42ddb",
|
||||
"index": "100644 d75908fb225c1f964b5b697032a6f98c4a13c1db 0\tworkplans/ADHOC-2026-06-27.md"
|
||||
},
|
||||
{
|
||||
"path": "workplans/ADHOC-2026-06-29.md",
|
||||
"sha256": "9869f07cdfe79d37314d36db74a434a55b50c0b965ae53f29d76ca9a9a73151f",
|
||||
"index": "100644 b46be0fd6ee2eeea9ffeff695b887b61aab8a7a2 0\tworkplans/ADHOC-2026-06-29.md"
|
||||
},
|
||||
{
|
||||
"path": "workplans/ADHOC-2026-08-11.md",
|
||||
"sha256": "6bba4f5dab9fc64f7b65df7c2ab7e4b9d4dbb69ba1c4a41c8440dbd23555aea4",
|
||||
"index": "100644 3d858fe808bd7a9d8318cdcd38ee012a8d907ca4 0\tworkplans/ADHOC-2026-08-11.md"
|
||||
},
|
||||
{
|
||||
"path": "workplans/ADHOC-2026-08-17.md",
|
||||
"sha256": "39ec882551bf5643fabb3ebc9f47300b4e6f6caf6d67a0a26bc100b68d4e313e",
|
||||
"index": "100644 65d75959a0fd23dd861e24321b1b46057d6fea5f 0\tworkplans/ADHOC-2026-08-17.md"
|
||||
},
|
||||
{
|
||||
"path": "workplans/ADHOC-2026-09-08.md",
|
||||
"sha256": "27c64084fdd16b926b138584d96688061a18a58d4d8152d9688b4486b9687c05",
|
||||
"index": "100644 c1ae7c3ea0d8e722d7073ae920780a5e56611294 0\tworkplans/ADHOC-2026-09-08.md"
|
||||
},
|
||||
{
|
||||
"path": "workplans/ADHOC-2026-10-03.md",
|
||||
"sha256": "8de5e5ba28ce2cd94c5864e316d54fe32e6cdfdb0e75551fe92ed25b81eeafa6",
|
||||
"index": "100644 e76cd016eab0dfd9eceac7d8033b40f92c9ada32 0\tworkplans/ADHOC-2026-10-03.md"
|
||||
},
|
||||
{
|
||||
"path": "workplans/WARDEN-WP-0016-ops-bridge-tunnel-cert-pilot.md",
|
||||
"sha256": "ad904837aa2d83d888d46c482fe381eba328c96a4617209ea8a9ae2d7d64c467",
|
||||
"index": "100644 a787f1da8347fdd2219ef67a569d21a192563343 0\tworkplans/WARDEN-WP-0016-ops-bridge-tunnel-cert-pilot.md"
|
||||
},
|
||||
{
|
||||
"path": "workplans/WARDEN-WP-0017-access-front-door-discoverability.md",
|
||||
"sha256": "a35f65a40c98d35e86f352c1430837b8bc9f269bddaddfe4a71c6414f678d85c",
|
||||
"index": "100644 fe9c5b15a464aa3ae104576bfc0a04510d944f89 0\tworkplans/WARDEN-WP-0017-access-front-door-discoverability.md"
|
||||
},
|
||||
{
|
||||
"path": "workplans/WARDEN-WP-0018-whynot-design-npm-lane-activation.md",
|
||||
"sha256": "6d9145534f7fa80cec9f185751d3796fdaab4a2d88b289a5451ba04e24822855",
|
||||
"index": "100644 f923be5351582a2bab38afc1aca3b4e5da0fe008 0\tworkplans/WARDEN-WP-0018-whynot-design-npm-lane-activation.md"
|
||||
},
|
||||
{
|
||||
"path": "workplans/WARDEN-WP-0019-route-to-secrets-engine.md",
|
||||
"sha256": "8fa2d79c85a821f7bc51044f37001bad613afb75d143181e2e0a01b213e06df8",
|
||||
"index": "100644 602fad1b4e56fc69de85aa2e0843676f50186340 0\tworkplans/WARDEN-WP-0019-route-to-secrets-engine.md"
|
||||
},
|
||||
{
|
||||
"path": "workplans/WARDEN-WP-0020-ops-warden-worker.md",
|
||||
"sha256": "d565f65413a2698160caf33ab30d7513a03d06ddcee7d624b198bb8841abdcc3",
|
||||
"index": "100644 1230ed3175d3f5f175fc0146e8006ebd8be5a369 0\tworkplans/WARDEN-WP-0020-ops-warden-worker.md"
|
||||
},
|
||||
{
|
||||
"path": "workplans/WARDEN-WP-0021-enable-scheduled-worker-tick.md",
|
||||
"sha256": "4f7afe5bdd147705e68d31d02f39251543c6c120ce22d893b98af063e303c361",
|
||||
"index": "100644 2500d4b346dffbe6d5f9848c5440bfa8d85d5d14 0\tworkplans/WARDEN-WP-0021-enable-scheduled-worker-tick.md"
|
||||
},
|
||||
{
|
||||
"path": "workplans/WARDEN-WP-0022-audit-trail-and-activity.md",
|
||||
"sha256": "f733fb0d7cfcc7b44aba49a730e7f51381d6478a87c394161e77c90577c26505",
|
||||
"index": "100644 63171f58096efb8d4bc07c69db250fff7038f4e1 0\tworkplans/WARDEN-WP-0022-audit-trail-and-activity.md"
|
||||
},
|
||||
{
|
||||
"path": "workplans/WARDEN-WP-0023-intent-scope-alignment-closeout.md",
|
||||
"sha256": "97d25825ba626a3979e8d6217aebd27f58d27fe9f92e8b94eb2f63e2bb843cb9",
|
||||
"index": "100644 99278d609aa5324c625364b2e0ac636ad9219ddf 0\tworkplans/WARDEN-WP-0023-intent-scope-alignment-closeout.md"
|
||||
},
|
||||
{
|
||||
"path": "workplans/WARDEN-WP-0024-experiential-memory-and-agent-sessions.md",
|
||||
"sha256": "22bde2d1398a4260e337768c6cf71cf80cd61d466371b6cfd0c0f0c18fc72378",
|
||||
"index": "100644 3ebac662f6c96f69a5fa6cbb5917999a4e24455a 0\tworkplans/WARDEN-WP-0024-experiential-memory-and-agent-sessions.md"
|
||||
},
|
||||
{
|
||||
"path": "workplans/WARDEN-WP-0025-forgejo-admin-api-token-lane.md",
|
||||
"sha256": "ded5bdfdbe897f3376c71c7a169caca51a9d75453ba66cf216ec8dfcab91c708",
|
||||
"index": "100644 5c4e77249b01fd8cb9300a237c917d95363cf2d7 0\tworkplans/WARDEN-WP-0025-forgejo-admin-api-token-lane.md"
|
||||
},
|
||||
{
|
||||
"path": "workplans/WARDEN-WP-0026-credential-disclosure-hygiene.md",
|
||||
"sha256": "f65ccdf9c920e9138353018e2ed5a7fbbd590246eb730fc6f57c75b6d2e09eea",
|
||||
"index": "100644 309f77187b31c1287b085affefc9d271ea40858c 0\tworkplans/WARDEN-WP-0026-credential-disclosure-hygiene.md"
|
||||
},
|
||||
{
|
||||
"path": "workplans/WARDEN-WP-0027-credential-governance-lockdown.md",
|
||||
"sha256": "0d0c08458718ec88883c4b257ea80011123a6d5aa2eea36fe28db331ff6d438f",
|
||||
"index": "100644 c14e9c303a1f1a096fdf710ee48112f68205435e 0\tworkplans/WARDEN-WP-0027-credential-governance-lockdown.md"
|
||||
},
|
||||
{
|
||||
"path": "workplans/WARDEN-WP-0028-tenant-secret-custody.md",
|
||||
"sha256": "92cc0ad8d42209d5d7e45122e8ddd67e1970de1d200df373885ba5fb75e0d22a",
|
||||
"index": "100644 fe81983444e5127bb8a0fdf94f42c3817758c67e 0\tworkplans/WARDEN-WP-0028-tenant-secret-custody.md"
|
||||
},
|
||||
{
|
||||
"path": "workplans/WARDEN-WP-0029-policy-front-door-and-founder-surface.md",
|
||||
"sha256": "2b21f06c062edd96943a1d26fd86c6a27b341b1db4532e528edbaebd4ced7e66",
|
||||
"index": "100644 4008d825b4c39d3f0e4a80f6d290af9b551fd812 0\tworkplans/WARDEN-WP-0029-policy-front-door-and-founder-surface.md"
|
||||
},
|
||||
{
|
||||
"path": "workplans/WARDEN-WP-0030-delegation-register.md",
|
||||
"sha256": "59bf962b355cd9734315108f9868508739ddcb4855591bff53aea3634aed47f7",
|
||||
"index": "100644 49612d072663af831f7b7314c4b77e4b9596097b 0\tworkplans/WARDEN-WP-0030-delegation-register.md"
|
||||
},
|
||||
{
|
||||
"path": "workplans/WARDEN-WP-0031-policy-caller-identity.md",
|
||||
"sha256": "0fa890ba81833180feb727ba35dcf01ead7d7dedf55a285a49a2585049b4bffb",
|
||||
"index": "100644 c4c600c47a6e4a65951b1adf324cc33f13cb1be6 0\tworkplans/WARDEN-WP-0031-policy-caller-identity.md"
|
||||
},
|
||||
{
|
||||
"path": "workplans/WARDEN-WP-0032-security-zones.md",
|
||||
"sha256": "4497947e57fb86e883090d07c8bef031fd5fe4a7f3eb065d530ebe327d97b1cc",
|
||||
"index": "100644 6c8000ade056b82e019826d01a7e9e8cf0f4de98 0\tworkplans/WARDEN-WP-0032-security-zones.md"
|
||||
},
|
||||
{
|
||||
"path": "workplans/WARDEN-WP-0033-native-lane-handoff.md",
|
||||
"sha256": "74747ebf7c628b1a5336c63aa3924212068a6015f370e647cf9127949c181998",
|
||||
"index": "100644 55cd015061bb610fe43c8f2ee821bb71b092d77c 0\tworkplans/WARDEN-WP-0033-native-lane-handoff.md"
|
||||
},
|
||||
{
|
||||
"path": "workplans/WARDEN-WP-0034-layer-model-v07-conformance.md",
|
||||
"sha256": "57e10b9efff02d7437231424ebc4d48864a2019939c2cda2fa10629a4ede2a3b",
|
||||
"index": "100644 d6ebfdce0e2901b42c98e38e9eaaac0f1d817e79 0\tworkplans/WARDEN-WP-0034-layer-model-v07-conformance.md"
|
||||
},
|
||||
{
|
||||
"path": "workplans/WARDEN-WP-0035-policy-nexus-forgejo-source-read-route.md",
|
||||
"sha256": "d40987b48a8416de386972d214ce01dba138a9f294cc948de36085c794c76418",
|
||||
"index": "100644 1210b158a3836d2b4df934f50fb538c5241b09d5 0\tworkplans/WARDEN-WP-0035-policy-nexus-forgejo-source-read-route.md"
|
||||
},
|
||||
{
|
||||
"path": "workplans/WARDEN-WP-0036-attended-login-openbao-output.md",
|
||||
"sha256": "e0584491b5a6a7d4db0cf61a689f733b4a6597778ca79a3f8f2207fe7ecfb8cc",
|
||||
"index": "100644 452eb41267ea99cc83104fcb2a782c0b244b87d1 0\tworkplans/WARDEN-WP-0036-attended-login-openbao-output.md"
|
||||
},
|
||||
{
|
||||
"path": "workplans/WARDEN-WP-0037-whynot-design-forgejo-npm-lane.md",
|
||||
"sha256": "7c64a631eb70d9ff42826ea5966cac571786ff86bac5393f88c328aeb14aa9ba",
|
||||
"index": "100644 a3eba2dff6517a64b2c5d3d9b9a9c14ca4570ec6 0\tworkplans/WARDEN-WP-0037-whynot-design-forgejo-npm-lane.md"
|
||||
},
|
||||
{
|
||||
"path": "workplans/WARDEN-WP-0038-plan-mutation-intent.md",
|
||||
"sha256": "09b0ed8c6315255796a2da0d64dfd001b1f6de2e903ac2ea79bc5667b499fb83",
|
||||
"index": "100644 8c9c5b6df7d1f48b48f8c2056c2a8186935184ee 0\tworkplans/WARDEN-WP-0038-plan-mutation-intent.md"
|
||||
},
|
||||
{
|
||||
"path": "workplans/WARDEN-WP-0039-explicit-policy-refusal.md",
|
||||
"sha256": "e8773a7b4196cf77a48ab4ed0804a5f826a0a0b5e7972f968681746ebbc6e3e9",
|
||||
"index": "100644 ca0828d2679eda031fb86d66eb886ccb38ee1843 0\tworkplans/WARDEN-WP-0039-explicit-policy-refusal.md"
|
||||
},
|
||||
{
|
||||
"path": "workplans/WARDEN-WP-0040-unknown-zone-fail-closed-adoption.md",
|
||||
"sha256": "a4b8e768eaacd5ab5a90f69a1abcb3bd48ce821fcdea208b0ee75d9326f0d512",
|
||||
"index": "100644 f07fb535d5ad00f5330f16a5a6e927da6960fe52 0\tworkplans/WARDEN-WP-0040-unknown-zone-fail-closed-adoption.md"
|
||||
},
|
||||
{
|
||||
"path": "workplans/WARDEN-WP-0041-catalog-lane-scaffolding.md",
|
||||
"sha256": "c16993301f29e7f5ea005cccdbe360ac9c4c3949e6988e2b7a1f1e5df6235bc1",
|
||||
"index": "100644 8a1ca341e9fcc041dcf99be8706f0db2a39408a6 0\tworkplans/WARDEN-WP-0041-catalog-lane-scaffolding.md"
|
||||
},
|
||||
{
|
||||
"path": "workplans/WARDEN-WP-0042-openbao-structure-survey-route.md",
|
||||
"sha256": "1e48399d6ef8a509898e8ea0b334a378c51ec467aaa704b6dbf8485aed29fa8b",
|
||||
"index": "100644 097d64791e79e782640514c7324e2ff8a5dc435c 0\tworkplans/WARDEN-WP-0042-openbao-structure-survey-route.md"
|
||||
},
|
||||
{
|
||||
"path": "workplans/WARDEN-WP-0043-platform-supplier-credentials.md",
|
||||
"sha256": "c059b7f80ad4c0e5faa8ad15532ab6c2577d0c383ba91cde7293534b6e4683e2",
|
||||
"index": "100644 d359328239b0b897ccffbf037a12b06d1f0d126a 0\tworkplans/WARDEN-WP-0043-platform-supplier-credentials.md"
|
||||
},
|
||||
{
|
||||
"path": "workplans/WARDEN-WP-0044-security-case-follow-through.md",
|
||||
"sha256": "721a90b2ed8c896257c34a1451eb642cb8824c8263e37c483fb61b36adc54088",
|
||||
"index": "100644 f6413241cdc2d8bdc0103bf541032a2b229ce5ee 0\tworkplans/WARDEN-WP-0044-security-case-follow-through.md"
|
||||
},
|
||||
{
|
||||
"path": "workplans/archived/260515-WARDEN-WP-0001-initial-implementation.md",
|
||||
"sha256": "359456ecd25525d95748ca611e7c6c118eee2b914dae447c84c59442a6520458",
|
||||
"index": "100644 5425cbd886ff77afc9be7c8b62b97d03278e0a8e 0\tworkplans/archived/260515-WARDEN-WP-0001-initial-implementation.md"
|
||||
},
|
||||
{
|
||||
"path": "workplans/archived/260515-WARDEN-WP-0002-correctness-and-completeness.md",
|
||||
"sha256": "43ba78e9c6e9914360edc88a6f8f5af0f981b3078ef41808a784ce7388559fb7",
|
||||
"index": "100644 0b6044f99391e81a439f2782ee697434319df05b 0\tworkplans/archived/260515-WARDEN-WP-0002-correctness-and-completeness.md"
|
||||
},
|
||||
{
|
||||
"path": "workplans/archived/260515-WARDEN-WP-0003-test-coverage-and-quality.md",
|
||||
"sha256": "4fb4ac0cb72cf14dd72c6e5f313a068d90ead203460ad3ac68f0d5dd12b6a755",
|
||||
"index": "100644 d544f950037cb705d5f7195ee559f91ca9f6a4f4 0\tworkplans/archived/260515-WARDEN-WP-0003-test-coverage-and-quality.md"
|
||||
},
|
||||
{
|
||||
"path": "workplans/archived/260617-WARDEN-WP-0004-repo-hygiene-and-hub-sync.md",
|
||||
"sha256": "fbb36a3d9c4ab0ac829bba713160d919b3c12c19f5f5826fb4e8483edeec3ac1",
|
||||
"index": "100644 31330938708c5ae9b6412c5715549f2d69192589 0\tworkplans/archived/260617-WARDEN-WP-0004-repo-hygiene-and-hub-sync.md"
|
||||
},
|
||||
{
|
||||
"path": "workplans/archived/260617-WARDEN-WP-0005-openbao-doc-alignment.md",
|
||||
"sha256": "3c930a395d518f9b287855632c21fe99a3d5c78a758ece06498fb9e35f5ea8b9",
|
||||
"index": "100644 9969260deee2960143102edecadb9fd7c9736832 0\tworkplans/archived/260617-WARDEN-WP-0005-openbao-doc-alignment.md"
|
||||
},
|
||||
{
|
||||
"path": "workplans/archived/260617-WARDEN-WP-0006-netkingdom-alignment-and-access-stewardship.md",
|
||||
"sha256": "fbc90ca4c18f8180a7fbcd2b43f21d7f99a44c914eb17c78f823228f8e3cc64f",
|
||||
"index": "100644 8a7cc2f69821ac8cbf0de744073b7a938fa6b51d 0\tworkplans/archived/260617-WARDEN-WP-0006-netkingdom-alignment-and-access-stewardship.md"
|
||||
},
|
||||
{
|
||||
"path": "workplans/archived/260617-WARDEN-WP-0007-policy-gate-and-production-verify.md",
|
||||
"sha256": "613b73c79bad0929f621feb136b3141f9c60e23bf6e23650881a47c762101214",
|
||||
"index": "100644 f49eea27ea7c15f4f3d608669ddd60e3a13803b5 0\tworkplans/archived/260617-WARDEN-WP-0007-policy-gate-and-production-verify.md"
|
||||
},
|
||||
{
|
||||
"path": "workplans/archived/260618-WARDEN-WP-0008-production-ssh-path-and-stewardship-closeout.md",
|
||||
"sha256": "8362d4cdb933b52c9be968d5410c8548c7554cc4cd44ab0389b913674795a10a",
|
||||
"index": "100644 f3827285c4e279f36ac63c14ad166ff90544659a 0\tworkplans/archived/260618-WARDEN-WP-0008-production-ssh-path-and-stewardship-closeout.md"
|
||||
},
|
||||
{
|
||||
"path": "workplans/archived/260623-WARDEN-WP-0009-flex-auth-policy-gate-production.md",
|
||||
"sha256": "fa611c1a2e5c5a214e38f0673ebcda17e3f30e10556b268fb126ded9af2bdbbb",
|
||||
"index": "100644 7f87d0ed26b7f19438f164a10a10a46808824776 0\tworkplans/archived/260623-WARDEN-WP-0009-flex-auth-policy-gate-production.md"
|
||||
},
|
||||
{
|
||||
"path": "workplans/archived/260624-WARDEN-WP-0010-access-routing-charter.md",
|
||||
"sha256": "62bc994e3efbb124004f98992ded6842ff2748568b2e405c61b335385a35b9d7",
|
||||
"index": "100644 12357da7a3d1d5f994e70d0f06dcc80ea1faf848 0\tworkplans/archived/260624-WARDEN-WP-0010-access-routing-charter.md"
|
||||
},
|
||||
{
|
||||
"path": "workplans/archived/260624-WARDEN-WP-0011-routing-guide-cli.md",
|
||||
"sha256": "767cd3c53cfe64beab93f19475be823d0637a40140877db6dfcc60e2693652ce",
|
||||
"index": "100644 3fe363e93d7e7d38db58deeec0ef3023bb35f8fa 0\tworkplans/archived/260624-WARDEN-WP-0011-routing-guide-cli.md"
|
||||
},
|
||||
{
|
||||
"path": "workplans/archived/260624-WARDEN-WP-0013-production-integration-and-stewardship-closeout.md",
|
||||
"sha256": "ecc38b4998796e20d734105df81ef6e2eb05c8e830b6d0dbe344d6336b9f668b",
|
||||
"index": "100644 9812e11e5e3499a22d0d4dde01fccd26b7d0ee03 0\tworkplans/archived/260624-WARDEN-WP-0013-production-integration-and-stewardship-closeout.md"
|
||||
},
|
||||
{
|
||||
"path": "workplans/archived/260627-WARDEN-WP-0012-routing-scenario-playbooks.md",
|
||||
"sha256": "7a7a1d25cd1d015c0a28f0d443de0512fc48cb1fda4317760051251988aa96f0",
|
||||
"index": "100644 acf9cce9f55395827479d4963e2d257be182f507 0\tworkplans/archived/260627-WARDEN-WP-0012-routing-scenario-playbooks.md"
|
||||
},
|
||||
{
|
||||
"path": "workplans/archived/260627-WARDEN-WP-0014-operator-access-assist.md",
|
||||
"sha256": "c1b84e750b2580fa1deae7dd56fd29abe5d9924a3ccd47ce9fc5f99c26aa4924",
|
||||
"index": "100644 01240484d955b0af77443d6dd49948c96f9fb032 0\tworkplans/archived/260627-WARDEN-WP-0014-operator-access-assist.md"
|
||||
},
|
||||
{
|
||||
"path": "workplans/archived/260627-WARDEN-WP-0015-secret-lifecycle-tiering.md",
|
||||
"sha256": "300b8b6cfdd7306fbb81ab30d4f59551976eed1de0012fd655e4b6fc096ccf10",
|
||||
"index": "100644 c59207892dcf723ce7b4ca0908635fb32407176e 0\tworkplans/archived/260627-WARDEN-WP-0015-secret-lifecycle-tiering.md"
|
||||
},
|
||||
{
|
||||
"path": "workplans/archived/260707-ADHOC-2026-07-07.md",
|
||||
"sha256": "e169418f6d83f954de1907ae8fa26a5f5cf4fe011be01dba9363e69befa05cfa",
|
||||
"index": "100644 31e9d27f2aa37f8eac17cb5500873a60b9ee8833 0\tworkplans/archived/260707-ADHOC-2026-07-07.md"
|
||||
}
|
||||
]
|
||||
}
|
||||
|
|
@ -0,0 +1,268 @@
|
|||
{
|
||||
"http_status": 200,
|
||||
"receipt": {
|
||||
"schema": "state-hub.repository-projection-reconcile.v1",
|
||||
"instance_role": "primary",
|
||||
"instance_label": "railiance01",
|
||||
"expected_commit": "117fec9241e7b985dfb187b992e173d0a5dc3700",
|
||||
"derived_commit": "117fec9241e7b985dfb187b992e173d0a5dc3700",
|
||||
"outcome": {
|
||||
"schema": "state-hub.projection-reset.v1",
|
||||
"repo_slug": "ops-warden",
|
||||
"commit": "117fec9241e7b985dfb187b992e173d0a5dc3700",
|
||||
"status": "applied",
|
||||
"counts": {
|
||||
"created": 0,
|
||||
"updated": 51,
|
||||
"retired": 0,
|
||||
"refused": 0,
|
||||
"released": 0,
|
||||
"created_tasks": 1,
|
||||
"updated_tasks": 0,
|
||||
"cancelled_tasks": 0,
|
||||
"created_edges": 0,
|
||||
"removed_edges": 0,
|
||||
"unresolved_edges": 0,
|
||||
"external_edges": 17
|
||||
},
|
||||
"created": [],
|
||||
"updated": [
|
||||
"WARDEN-WP-0001",
|
||||
"WARDEN-WP-0002",
|
||||
"WARDEN-WP-0003",
|
||||
"WARDEN-WP-0004",
|
||||
"WARDEN-WP-0005",
|
||||
"WARDEN-WP-0006",
|
||||
"WARDEN-WP-0007",
|
||||
"WARDEN-WP-0008",
|
||||
"WARDEN-WP-0009",
|
||||
"WARDEN-WP-0010",
|
||||
"WARDEN-WP-0011",
|
||||
"WARDEN-WP-0012",
|
||||
"WARDEN-WP-0013",
|
||||
"WARDEN-WP-0014",
|
||||
"WARDEN-WP-0015",
|
||||
"WARDEN-WP-0016",
|
||||
"WARDEN-WP-0017",
|
||||
"WARDEN-WP-0018",
|
||||
"WARDEN-WP-0019",
|
||||
"WARDEN-WP-0020",
|
||||
"WARDEN-WP-0021",
|
||||
"WARDEN-WP-0022",
|
||||
"WARDEN-WP-0023",
|
||||
"WARDEN-WP-0024",
|
||||
"WARDEN-WP-0025",
|
||||
"WARDEN-WP-0026",
|
||||
"WARDEN-WP-0027",
|
||||
"WARDEN-WP-0028",
|
||||
"WARDEN-WP-0029",
|
||||
"WARDEN-WP-0030",
|
||||
"WARDEN-WP-0031",
|
||||
"WARDEN-WP-0032",
|
||||
"WARDEN-WP-0033",
|
||||
"WARDEN-WP-0034",
|
||||
"WARDEN-WP-0035",
|
||||
"WARDEN-WP-0036",
|
||||
"WARDEN-WP-0037",
|
||||
"WARDEN-WP-0038",
|
||||
"WARDEN-WP-0039",
|
||||
"WARDEN-WP-0040",
|
||||
"WARDEN-WP-0041",
|
||||
"WARDEN-WP-0042",
|
||||
"WARDEN-WP-0043",
|
||||
"WARDEN-WP-0044",
|
||||
"WARDEN-WP-ADHOC-2026-06-27",
|
||||
"WARDEN-WP-ADHOC-2026-06-29",
|
||||
"WARDEN-WP-ADHOC-2026-07-07",
|
||||
"WARDEN-WP-ADHOC-2026-08-11",
|
||||
"WARDEN-WP-ADHOC-2026-08-17",
|
||||
"WARDEN-WP-ADHOC-2026-09-08",
|
||||
"WARDEN-WP-ADHOC-2026-10-03"
|
||||
],
|
||||
"retired": [],
|
||||
"released": [],
|
||||
"created_tasks": [
|
||||
"WARDEN-WP-0038-T01"
|
||||
],
|
||||
"updated_tasks": [],
|
||||
"cancelled_tasks": [],
|
||||
"created_edges": [],
|
||||
"removed_edges": [],
|
||||
"unresolved_edges": [],
|
||||
"external_edges": [
|
||||
{
|
||||
"workplan": "WARDEN-WP-0032",
|
||||
"from": "WARDEN-WP-0032",
|
||||
"target": "WARDEN-WP-0031",
|
||||
"relationship_type": "blocks",
|
||||
"from_workplan_id": "38c6a5f3-fb0d-5230-be85-f9e3ffc850f6",
|
||||
"from_task_id": null,
|
||||
"to_workplan_id": "739bad25-2345-5f4f-aaa3-cc4cd8c71f6c",
|
||||
"to_task_id": null
|
||||
},
|
||||
{
|
||||
"workplan": "WARDEN-WP-0037",
|
||||
"from": "WARDEN-WP-0037-T03",
|
||||
"target": "SECRETS-WP-0006-T06",
|
||||
"relationship_type": "starts_after",
|
||||
"from_workplan_id": "42a097db-1c24-558e-a724-030bb2b4443e",
|
||||
"from_task_id": "a8b1b855-ab34-5835-b9fd-5f48bc0b6817",
|
||||
"to_workplan_id": null,
|
||||
"to_task_id": "1431edae-5791-5892-8c4b-829419b537d2"
|
||||
},
|
||||
{
|
||||
"workplan": "WARDEN-WP-0033",
|
||||
"from": "WARDEN-WP-0033",
|
||||
"target": "WARDEN-WP-0030",
|
||||
"relationship_type": "blocks",
|
||||
"from_workplan_id": "4627d89b-4b00-562a-81e9-76e96f90fa7e",
|
||||
"from_task_id": null,
|
||||
"to_workplan_id": "da3367d5-890c-52c6-aa54-1bdd0f277342",
|
||||
"to_task_id": null
|
||||
},
|
||||
{
|
||||
"workplan": "WARDEN-WP-0013",
|
||||
"from": "WARDEN-WP-0013",
|
||||
"target": "WARDEN-WP-0011",
|
||||
"relationship_type": "blocks",
|
||||
"from_workplan_id": "4678c41a-c1d0-48cd-9988-4ea0380e8258",
|
||||
"from_task_id": null,
|
||||
"to_workplan_id": "0a520f8e-01b4-48f1-9af3-2f3f69fd0672",
|
||||
"to_task_id": null
|
||||
},
|
||||
{
|
||||
"workplan": "WARDEN-WP-0013",
|
||||
"from": "WARDEN-WP-0013",
|
||||
"target": "WARDEN-WP-0009",
|
||||
"relationship_type": "blocks",
|
||||
"from_workplan_id": "4678c41a-c1d0-48cd-9988-4ea0380e8258",
|
||||
"from_task_id": null,
|
||||
"to_workplan_id": "9213b262-e2f5-480e-a5bc-56635d5eb4c9",
|
||||
"to_task_id": null
|
||||
},
|
||||
{
|
||||
"workplan": "WARDEN-WP-0013",
|
||||
"from": "WARDEN-WP-0013",
|
||||
"target": "WARDEN-WP-0008",
|
||||
"relationship_type": "blocks",
|
||||
"from_workplan_id": "4678c41a-c1d0-48cd-9988-4ea0380e8258",
|
||||
"from_task_id": null,
|
||||
"to_workplan_id": "a174963a-4ff1-4565-b19f-896cd4ff14a0",
|
||||
"to_task_id": null
|
||||
},
|
||||
{
|
||||
"workplan": "WARDEN-WP-0013",
|
||||
"from": "WARDEN-WP-0013",
|
||||
"target": "WARDEN-WP-0010",
|
||||
"relationship_type": "blocks",
|
||||
"from_workplan_id": "4678c41a-c1d0-48cd-9988-4ea0380e8258",
|
||||
"from_task_id": null,
|
||||
"to_workplan_id": "e93de9fd-0192-4d02-bb7c-5e859fb76b9b",
|
||||
"to_task_id": null
|
||||
},
|
||||
{
|
||||
"workplan": "WARDEN-WP-0031",
|
||||
"from": "WARDEN-WP-0031",
|
||||
"target": "WARDEN-WP-0007",
|
||||
"relationship_type": "blocks",
|
||||
"from_workplan_id": "739bad25-2345-5f4f-aaa3-cc4cd8c71f6c",
|
||||
"from_task_id": null,
|
||||
"to_workplan_id": "3718ac07-2fa2-47d0-a02a-c9a7b83a5ba9",
|
||||
"to_task_id": null
|
||||
},
|
||||
{
|
||||
"workplan": "WARDEN-WP-0038",
|
||||
"from": "WARDEN-WP-0038",
|
||||
"target": "WARDEN-WP-0029",
|
||||
"relationship_type": "blocks",
|
||||
"from_workplan_id": "751ad530-e44b-52c4-b70e-cb47568a0179",
|
||||
"from_task_id": null,
|
||||
"to_workplan_id": "bbb3d9ec-d88d-5088-b4c0-55bfba0a10cf",
|
||||
"to_task_id": null
|
||||
},
|
||||
{
|
||||
"workplan": "WARDEN-WP-0023",
|
||||
"from": "WARDEN-WP-0023",
|
||||
"target": "WARDEN-WP-0022",
|
||||
"relationship_type": "blocks",
|
||||
"from_workplan_id": "7bad1ec4-a7c2-4980-b8f9-49a7f5408574",
|
||||
"from_task_id": null,
|
||||
"to_workplan_id": "fc8afa28-68a7-4250-a19e-9754829f0cd5",
|
||||
"to_task_id": null
|
||||
},
|
||||
{
|
||||
"workplan": "WARDEN-WP-0034",
|
||||
"from": "WARDEN-WP-0034",
|
||||
"target": "WARDEN-WP-0030",
|
||||
"relationship_type": "blocks",
|
||||
"from_workplan_id": "ae3ff76f-883d-5e2f-b6aa-144d61e8fdef",
|
||||
"from_task_id": null,
|
||||
"to_workplan_id": "da3367d5-890c-52c6-aa54-1bdd0f277342",
|
||||
"to_task_id": null
|
||||
},
|
||||
{
|
||||
"workplan": "WARDEN-WP-0040",
|
||||
"from": "WARDEN-WP-0040",
|
||||
"target": "WARDEN-WP-0032",
|
||||
"relationship_type": "blocks",
|
||||
"from_workplan_id": "c8ee441e-1be1-5219-910c-e79ff23cc9ec",
|
||||
"from_task_id": null,
|
||||
"to_workplan_id": "38c6a5f3-fb0d-5230-be85-f9e3ffc850f6",
|
||||
"to_task_id": null
|
||||
},
|
||||
{
|
||||
"workplan": "WARDEN-WP-0040",
|
||||
"from": "WARDEN-WP-0040",
|
||||
"target": "WARDEN-WP-0034",
|
||||
"relationship_type": "blocks",
|
||||
"from_workplan_id": "c8ee441e-1be1-5219-910c-e79ff23cc9ec",
|
||||
"from_task_id": null,
|
||||
"to_workplan_id": "ae3ff76f-883d-5e2f-b6aa-144d61e8fdef",
|
||||
"to_task_id": null
|
||||
},
|
||||
{
|
||||
"workplan": "WARDEN-WP-0040",
|
||||
"from": "WARDEN-WP-0040-T03",
|
||||
"target": "WARDEN-WP-0040-T01",
|
||||
"relationship_type": "starts_after",
|
||||
"from_workplan_id": "c8ee441e-1be1-5219-910c-e79ff23cc9ec",
|
||||
"from_task_id": "93eaf1f2-daaa-5e22-8804-85ca9433571c",
|
||||
"to_workplan_id": null,
|
||||
"to_task_id": "611f0901-9fb5-5954-8dd0-a860c5f0cbec"
|
||||
},
|
||||
{
|
||||
"workplan": "WARDEN-WP-0044",
|
||||
"from": "WARDEN-WP-0044-T04",
|
||||
"target": "WARDEN-WP-0044-T03",
|
||||
"relationship_type": "starts_after",
|
||||
"from_workplan_id": "f7e81013-6868-5d99-8528-ba75a442eca9",
|
||||
"from_task_id": "4a0fa4a7-5ca9-518a-ab92-a79a5e2cf93e",
|
||||
"to_workplan_id": null,
|
||||
"to_task_id": "bcbf6c91-2c04-5c16-ae8c-5d6c06fd6b89"
|
||||
},
|
||||
{
|
||||
"workplan": "WARDEN-WP-0044",
|
||||
"from": "WARDEN-WP-0044-T03",
|
||||
"target": "MASON-WP-0010-T03",
|
||||
"relationship_type": "starts_after",
|
||||
"from_workplan_id": "f7e81013-6868-5d99-8528-ba75a442eca9",
|
||||
"from_task_id": "bcbf6c91-2c04-5c16-ae8c-5d6c06fd6b89",
|
||||
"to_workplan_id": null,
|
||||
"to_task_id": "56cea6be-c613-586c-80cd-125340b374da"
|
||||
},
|
||||
{
|
||||
"workplan": "WARDEN-WP-0044",
|
||||
"from": "WARDEN-WP-0044-T03",
|
||||
"target": "WARDEN-WP-0044-T02",
|
||||
"relationship_type": "starts_after",
|
||||
"from_workplan_id": "f7e81013-6868-5d99-8528-ba75a442eca9",
|
||||
"from_task_id": "bcbf6c91-2c04-5c16-ae8c-5d6c06fd6b89",
|
||||
"to_workplan_id": null,
|
||||
"to_task_id": "5f68c991-f490-58f8-a121-92f74073d272"
|
||||
}
|
||||
],
|
||||
"refused": [],
|
||||
"notes": []
|
||||
}
|
||||
}
|
||||
}
|
||||
|
|
@ -0,0 +1,24 @@
|
|||
{
|
||||
"path": "/repos/ops-warden/work-record-projection/reconcile",
|
||||
"body": {
|
||||
"expected_commit": "117fec9241e7b985dfb187b992e173d0a5dc3700",
|
||||
"acknowledge_retirements": false
|
||||
},
|
||||
"headers": {
|
||||
"Content-Type": "application/json",
|
||||
"Idempotency-Key": "rmgr-projection:v2:9c183d83370c522a5f9e8622e5e9b203c07ce01753fc033b44d80b36d4c0168f",
|
||||
"X-StateHub-Source-Agent": "repo-manager"
|
||||
},
|
||||
"health": {
|
||||
"status": "ok",
|
||||
"db": "connected",
|
||||
"instance_role": "primary",
|
||||
"instance_label": "railiance01",
|
||||
"schema": {
|
||||
"status": "ok",
|
||||
"applied": "c4d5e6f7a8b9",
|
||||
"expected": "c4d5e6f7a8b9"
|
||||
}
|
||||
},
|
||||
"normal_publication": "legacy-consistency C-17 pushed 1 backlogged commit; remote exact verified"
|
||||
}
|
||||
|
|
@ -0,0 +1,94 @@
|
|||
[
|
||||
{
|
||||
"workplan_id": "f7e81013-6868-5d99-8528-ba75a442eca9",
|
||||
"id": "ef0920fc-418e-52cb-acff-9a5c0c728bf5",
|
||||
"record_id": "WARDEN-WP-0044-T01",
|
||||
"flavor": null,
|
||||
"title": "Tasks",
|
||||
"description": "### T01 \u2014 Define the type's follow-through section\n\nPropose the `follow_through` part of the SecurityCaseType schema together with\nnet-kingdom. For each step it names the owner entry point, `warden_executes`,\nthe auth method and lane, whether an attended human login is unavoidable (with\nthe type's justification), and the verification command. Write it for the first\ntype, `oidc-browser-relying-party`, covering key-cape client registration,\ncustody minting and LLDAP group membership.\n\n2026-10-08: NK-WP-0048-T03/T04 landed with a drafted section. Review is in\n`history/2026-10-08-oidc-rp-follow-through-review.md`. It requires three\nchanges before T02: a per-step `lane`, a narrow `warden_executes`, and\n`value_handling`. It also lists four refinements. This task is done when\nnet-kingdom acknowledges the review (NK-WP-0048-T05).\n\n2026-10-09: R4 was withdrawn in favour of ops-mason's per-case\n`{consuming_service}-keycape-client`, with the entry body templated in the type\n(R4\u2032, see the addendum in the review).\n\n2026-10-09: the revised 1.0 type and canon now carry R1\u2013R3, R4\u2032, R5\u2013R7.\n`warden case check-type <type.yaml>` (`src/warden/case_type.py`, tests in\n`tests/test_case_type.py`) checks a type's follow-through mechanically: the\nlive type is schema-conformant, with one attended session\n(`key-cape-oidc-login`). It is not yet plannable, because two lanes are not\nin the catalog: `identity-provisioner-groups` (net-kingdom) and\n`keycape-client-secret-generate` (railiance-platform). These gate T02, not\nT01. T01 still closes on net-kingdom's acknowledgement (NK-WP-0048-T05).\n\n2026-10-09: ops-warden cannot add `identity-provisioner-groups` as the type\ndeclares it. The provisioner accepts only user-engine's runtime token and\nadmits only user-engine pods, so no caller-identity path exists. R8 (review\naddendum) asks net-kingdom either to move `ensure-groups` into the existing\nattended session (recommended) or to give the provisioner an operator\ncredential. `keycape-client-secret-generate` needs a generate-in-custody entry\npoint from railiance-platform, and the broker does not have one yet. Both were\nsent to their owners.\n\n2026-10-09: done. net-kingdom took R8 option 1, so `ensure-groups` runs attended\nin the `register-client` session and `identity-provisioner-groups` is dropped\n(net-kingdom `0e86f95`). The founder acknowledged the type with memo r4 (hub\ndecision `e418263e`, NK-WP-0048-T05 done).",
|
||||
"status": "done",
|
||||
"priority": "high",
|
||||
"assignee": null,
|
||||
"due_date": null,
|
||||
"blocking_reason": null,
|
||||
"needs_human": false,
|
||||
"intervention_note": null,
|
||||
"decision_id": null,
|
||||
"blocked_on": null,
|
||||
"wait_until": null,
|
||||
"parent_task_id": null,
|
||||
"wait_kind": null,
|
||||
"created_at": "2026-10-08T20:18:57.487362Z",
|
||||
"updated_at": "2026-10-15T02:25:32.031044Z",
|
||||
"workstream_id": "f7e81013-6868-5d99-8528-ba75a442eca9"
|
||||
},
|
||||
{
|
||||
"workplan_id": "f7e81013-6868-5d99-8528-ba75a442eca9",
|
||||
"id": "5f68c991-f490-58f8-a121-92f74073d272",
|
||||
"record_id": "WARDEN-WP-0044-T02",
|
||||
"flavor": null,
|
||||
"title": "T01 \u2014 Define the type's follow-through section",
|
||||
"description": null,
|
||||
"status": "done",
|
||||
"priority": "high",
|
||||
"assignee": null,
|
||||
"due_date": null,
|
||||
"blocking_reason": null,
|
||||
"needs_human": false,
|
||||
"intervention_note": null,
|
||||
"decision_id": null,
|
||||
"blocked_on": null,
|
||||
"wait_until": null,
|
||||
"parent_task_id": null,
|
||||
"wait_kind": null,
|
||||
"created_at": "2026-10-08T20:18:57.597629Z",
|
||||
"updated_at": "2026-10-15T02:25:32.031044Z",
|
||||
"workstream_id": "f7e81013-6868-5d99-8528-ba75a442eca9"
|
||||
},
|
||||
{
|
||||
"workplan_id": "f7e81013-6868-5d99-8528-ba75a442eca9",
|
||||
"id": "bcbf6c91-2c04-5c16-ae8c-5d6c06fd6b89",
|
||||
"record_id": "WARDEN-WP-0044-T03",
|
||||
"flavor": null,
|
||||
"title": "T02 \u2014 Plan a case run",
|
||||
"description": null,
|
||||
"status": "progress",
|
||||
"priority": "high",
|
||||
"assignee": null,
|
||||
"due_date": null,
|
||||
"blocking_reason": "Local durable execution kernel and injected failure harness implemented. Native acceptance still requires authenticated owner machine descriptors/adapters, actual Forgejo materialization receipt, contained session integration, ordered verification and first native run.",
|
||||
"needs_human": false,
|
||||
"intervention_note": null,
|
||||
"decision_id": null,
|
||||
"blocked_on": null,
|
||||
"wait_until": null,
|
||||
"parent_task_id": null,
|
||||
"wait_kind": null,
|
||||
"created_at": "2026-10-08T20:18:57.716842Z",
|
||||
"updated_at": "2026-10-15T02:25:32.031044Z",
|
||||
"workstream_id": "f7e81013-6868-5d99-8528-ba75a442eca9"
|
||||
},
|
||||
{
|
||||
"workplan_id": "f7e81013-6868-5d99-8528-ba75a442eca9",
|
||||
"id": "4a0fa4a7-5ca9-518a-ab92-a79a5e2cf93e",
|
||||
"record_id": "WARDEN-WP-0044-T04",
|
||||
"flavor": null,
|
||||
"title": "T03 \u2014 Run and verify a case",
|
||||
"description": null,
|
||||
"status": "wait",
|
||||
"priority": "medium",
|
||||
"assignee": null,
|
||||
"due_date": null,
|
||||
"blocking_reason": "Catalog integration follows a proven run.",
|
||||
"needs_human": false,
|
||||
"intervention_note": null,
|
||||
"decision_id": null,
|
||||
"blocked_on": null,
|
||||
"wait_until": null,
|
||||
"parent_task_id": null,
|
||||
"wait_kind": "external",
|
||||
"created_at": "2026-10-08T20:18:57.836839Z",
|
||||
"updated_at": "2026-10-15T02:25:32.031044Z",
|
||||
"workstream_id": "f7e81013-6868-5d99-8528-ba75a442eca9"
|
||||
}
|
||||
]
|
||||
|
|
@ -0,0 +1,94 @@
|
|||
[
|
||||
{
|
||||
"workplan_id": "f7e81013-6868-5d99-8528-ba75a442eca9",
|
||||
"id": "ef0920fc-418e-52cb-acff-9a5c0c728bf5",
|
||||
"record_id": "WARDEN-WP-0044-T01",
|
||||
"flavor": null,
|
||||
"title": "Tasks",
|
||||
"description": "### T01 \u2014 Define the type's follow-through section\n\nPropose the `follow_through` part of the SecurityCaseType schema together with\nnet-kingdom. For each step it names the owner entry point, `warden_executes`,\nthe auth method and lane, whether an attended human login is unavoidable (with\nthe type's justification), and the verification command. Write it for the first\ntype, `oidc-browser-relying-party`, covering key-cape client registration,\ncustody minting and LLDAP group membership.\n\n2026-10-08: NK-WP-0048-T03/T04 landed with a drafted section. Review is in\n`history/2026-10-08-oidc-rp-follow-through-review.md`. It requires three\nchanges before T02: a per-step `lane`, a narrow `warden_executes`, and\n`value_handling`. It also lists four refinements. This task is done when\nnet-kingdom acknowledges the review (NK-WP-0048-T05).\n\n2026-10-09: R4 was withdrawn in favour of ops-mason's per-case\n`{consuming_service}-keycape-client`, with the entry body templated in the type\n(R4\u2032, see the addendum in the review).\n\n2026-10-09: the revised 1.0 type and canon now carry R1\u2013R3, R4\u2032, R5\u2013R7.\n`warden case check-type <type.yaml>` (`src/warden/case_type.py`, tests in\n`tests/test_case_type.py`) checks a type's follow-through mechanically: the\nlive type is schema-conformant, with one attended session\n(`key-cape-oidc-login`). It is not yet plannable, because two lanes are not\nin the catalog: `identity-provisioner-groups` (net-kingdom) and\n`keycape-client-secret-generate` (railiance-platform). These gate T02, not\nT01. T01 still closes on net-kingdom's acknowledgement (NK-WP-0048-T05).\n\n2026-10-09: ops-warden cannot add `identity-provisioner-groups` as the type\ndeclares it. The provisioner accepts only user-engine's runtime token and\nadmits only user-engine pods, so no caller-identity path exists. R8 (review\naddendum) asks net-kingdom either to move `ensure-groups` into the existing\nattended session (recommended) or to give the provisioner an operator\ncredential. `keycape-client-secret-generate` needs a generate-in-custody entry\npoint from railiance-platform, and the broker does not have one yet. Both were\nsent to their owners.\n\n2026-10-09: done. net-kingdom took R8 option 1, so `ensure-groups` runs attended\nin the `register-client` session and `identity-provisioner-groups` is dropped\n(net-kingdom `0e86f95`). The founder acknowledged the type with memo r4 (hub\ndecision `e418263e`, NK-WP-0048-T05 done).",
|
||||
"status": "done",
|
||||
"priority": "high",
|
||||
"assignee": null,
|
||||
"due_date": null,
|
||||
"blocking_reason": null,
|
||||
"needs_human": false,
|
||||
"intervention_note": null,
|
||||
"decision_id": null,
|
||||
"blocked_on": null,
|
||||
"wait_until": null,
|
||||
"parent_task_id": null,
|
||||
"wait_kind": null,
|
||||
"created_at": "2026-10-08T20:18:57.487362Z",
|
||||
"updated_at": "2026-10-15T02:25:32.031044Z",
|
||||
"workstream_id": "f7e81013-6868-5d99-8528-ba75a442eca9"
|
||||
},
|
||||
{
|
||||
"workplan_id": "f7e81013-6868-5d99-8528-ba75a442eca9",
|
||||
"id": "5f68c991-f490-58f8-a121-92f74073d272",
|
||||
"record_id": "WARDEN-WP-0044-T02",
|
||||
"flavor": null,
|
||||
"title": "T01 \u2014 Define the type's follow-through section",
|
||||
"description": null,
|
||||
"status": "done",
|
||||
"priority": "high",
|
||||
"assignee": null,
|
||||
"due_date": null,
|
||||
"blocking_reason": null,
|
||||
"needs_human": false,
|
||||
"intervention_note": null,
|
||||
"decision_id": null,
|
||||
"blocked_on": null,
|
||||
"wait_until": null,
|
||||
"parent_task_id": null,
|
||||
"wait_kind": null,
|
||||
"created_at": "2026-10-08T20:18:57.597629Z",
|
||||
"updated_at": "2026-10-15T02:25:32.031044Z",
|
||||
"workstream_id": "f7e81013-6868-5d99-8528-ba75a442eca9"
|
||||
},
|
||||
{
|
||||
"workplan_id": "f7e81013-6868-5d99-8528-ba75a442eca9",
|
||||
"id": "bcbf6c91-2c04-5c16-ae8c-5d6c06fd6b89",
|
||||
"record_id": "WARDEN-WP-0044-T03",
|
||||
"flavor": null,
|
||||
"title": "T02 \u2014 Plan a case run",
|
||||
"description": null,
|
||||
"status": "progress",
|
||||
"priority": "high",
|
||||
"assignee": null,
|
||||
"due_date": null,
|
||||
"blocking_reason": "Local durable execution kernel and injected failure harness implemented. Native acceptance still requires authenticated owner machine descriptors/adapters, actual Forgejo materialization receipt, contained session integration, ordered verification and first native run.",
|
||||
"needs_human": false,
|
||||
"intervention_note": null,
|
||||
"decision_id": null,
|
||||
"blocked_on": null,
|
||||
"wait_until": null,
|
||||
"parent_task_id": null,
|
||||
"wait_kind": null,
|
||||
"created_at": "2026-10-08T20:18:57.716842Z",
|
||||
"updated_at": "2026-10-15T02:25:32.031044Z",
|
||||
"workstream_id": "f7e81013-6868-5d99-8528-ba75a442eca9"
|
||||
},
|
||||
{
|
||||
"workplan_id": "f7e81013-6868-5d99-8528-ba75a442eca9",
|
||||
"id": "4a0fa4a7-5ca9-518a-ab92-a79a5e2cf93e",
|
||||
"record_id": "WARDEN-WP-0044-T04",
|
||||
"flavor": null,
|
||||
"title": "T03 \u2014 Run and verify a case",
|
||||
"description": null,
|
||||
"status": "wait",
|
||||
"priority": "medium",
|
||||
"assignee": null,
|
||||
"due_date": null,
|
||||
"blocking_reason": "Catalog integration follows a proven run.",
|
||||
"needs_human": false,
|
||||
"intervention_note": null,
|
||||
"decision_id": null,
|
||||
"blocked_on": null,
|
||||
"wait_until": null,
|
||||
"parent_task_id": null,
|
||||
"wait_kind": "external",
|
||||
"created_at": "2026-10-08T20:18:57.836839Z",
|
||||
"updated_at": "2026-10-15T02:25:32.031044Z",
|
||||
"workstream_id": "f7e81013-6868-5d99-8528-ba75a442eca9"
|
||||
}
|
||||
]
|
||||
|
|
@ -0,0 +1,47 @@
|
|||
{
|
||||
"status": "published-and-projected",
|
||||
"commit": "117fec9241e7b985dfb187b992e173d0a5dc3700",
|
||||
"instance_role": "primary",
|
||||
"instance_label": "railiance01",
|
||||
"consistency": {
|
||||
"exit_code": 0,
|
||||
"fail": 0,
|
||||
"warn": 8,
|
||||
"no_writeback": true
|
||||
},
|
||||
"unrelated_files_and_index_preserved": 53,
|
||||
"restore_needed": false,
|
||||
"four_original_tasks_preserved": [
|
||||
{
|
||||
"task": "WARDEN-WP-0044-T01",
|
||||
"uuid": "ef0920fc-418e-52cb-acff-9a5c0c728bf5",
|
||||
"status": "done"
|
||||
},
|
||||
{
|
||||
"task": "WARDEN-WP-0044-T02",
|
||||
"uuid": "5f68c991-f490-58f8-a121-92f74073d272",
|
||||
"status": "done"
|
||||
},
|
||||
{
|
||||
"task": "WARDEN-WP-0044-T03",
|
||||
"uuid": "bcbf6c91-2c04-5c16-ae8c-5d6c06fd6b89",
|
||||
"status": "progress"
|
||||
},
|
||||
{
|
||||
"task": "WARDEN-WP-0044-T04",
|
||||
"uuid": "4a0fa4a7-5ca9-518a-ab92-a79a5e2cf93e",
|
||||
"status": "wait"
|
||||
}
|
||||
],
|
||||
"projection_side_effects": {
|
||||
"retired": 0,
|
||||
"cancelled_tasks": 0,
|
||||
"created_tasks": [
|
||||
"WARDEN-WP-0038-T01"
|
||||
],
|
||||
"note": "Canonical forge-derived receiver created existing source WP38-T01 projection deterministically; no source UUID writeback or unrelated source commit."
|
||||
},
|
||||
"native_actions": false,
|
||||
"root_supervision_or_R3_modified": false,
|
||||
"remaining_blocker": "Normal rmgr allocator still proposes unrelated missing source UUID on finished WP38-T01; refusal retained, no manual UUID assignment."
|
||||
}
|
||||
File diff suppressed because it is too large
Load diff
File diff suppressed because it is too large
Load diff
|
|
@ -0,0 +1,46 @@
|
|||
# NK49 actual-SOPS successor and owner publication readback
|
||||
|
||||
`owner-refinement.patch` is an isolated exact-preimage proposal for
|
||||
`NK-WP-0049-bootstrap-secret-free-recovery-handoff.md` at NetKingdom commit
|
||||
`6cb43c0cc55212363a5406b02db046e2384a7c40`. It adds completed T37 for 65 actual
|
||||
SOPS generated-fixture tests: 61 previously skipped cases and four actual
|
||||
sealed-descriptor cases. T34's historical section stays byte-identical. Counts
|
||||
become 25 done, four progress, one todo and seven wait; final closure references
|
||||
T15–T37. Existing native gates remain open.
|
||||
|
||||
T35 records four Railiance Cluster source additions and the unpublished owner
|
||||
handoff. Publication stopped at the historical identifier guard; the read-only
|
||||
preview records 15 bare-label findings and five collisions. The original failed
|
||||
publication stderr was not retained. No Cluster Hub existence, projection,
|
||||
private TLS recovery or native acceptance is claimed. T36 records Secrets
|
||||
WP15 publication at c59bbf568c0be8a72ac593508f48c9b1f61ec4c1 and its remaining
|
||||
consumer/custody/native dependencies. No current assent is inferred.
|
||||
|
||||
`NK-WP-0049.preimage.md`, `NK-WP-0049.proposed.md` and `manifest.json` bind exact
|
||||
bytes. This agent performed no canonical mutations, staging, synchronization or
|
||||
publication, and preserved dirty sources.
|
||||
|
||||
`verify_owner_publications.py` is read only: allowed Hub GET endpoints and Git
|
||||
rev-parse/show/remote-get-url/ls-remote only. It checks primary/railiance01 identity,
|
||||
RepoManager WP21's five and Secrets WP15's four exact source task IDs, UUIDs,
|
||||
statuses and denominators, both Secrets T04 dependency edges and external NK33
|
||||
binding, published commits and remote HEAD/main. Workplan source IDs remain
|
||||
uppercase; API slugs are compared to their exact canonical lowercase form.
|
||||
Ownership UUIDs and statuses are never relaxed. Real index stat identities and
|
||||
the authoritative workplan bytes are checked unchanged; no dirty source is
|
||||
staged/reset/restored or modified. Only the requested fixed-metadata receipt is
|
||||
written. Missing evidence refuses; no GET result grants authority.
|
||||
|
||||
The initial verifier failed `workplan-binding-mismatch` before accepting either
|
||||
owner because it compared uppercase source ID directly with lowercase API slug.
|
||||
Its raw source and receipt are retained in `failed-verifier-r1/`. Independent
|
||||
public snapshot readback confirmed the two exact UUID/lowercase-slug/status
|
||||
bindings and nine uppercase task record IDs. R2 corrects only that distinction;
|
||||
`verifier-r2.patch` records the change. R2 execution/readback remains the
|
||||
coordinator's next step; no remote verification is claimed here yet.
|
||||
|
||||
The knowledge pilot returned version 0.2.6, digest
|
||||
8d1d6a9d4d07fec7b619618de7dfe2be2254c1790f85f4198c7fe19db9751c02,
|
||||
with start guidance withheld for changed sources. Current start/evidence cards
|
||||
and NetKingdom SECURITY-COMPANION source were read for orientation only; the
|
||||
pilot supplies no additional authority.
|
||||
|
|
@ -0,0 +1,13 @@
|
|||
{
|
||||
"status": "unverified",
|
||||
"scope": "two exact published workplans; read-only Git ls-remote and Hub GET snapshots",
|
||||
"writes_to_source_index_refs_or_Hub": false,
|
||||
"rows": [],
|
||||
"hub_instance": {
|
||||
"status": "ok",
|
||||
"instance_role": "primary",
|
||||
"instance_label": "railiance01"
|
||||
},
|
||||
"reason": "workplan-binding-mismatch",
|
||||
"verifier_sha256": "25311d73fbb04fad5fb5a8722b25075c00a0c41fb08dfd075c36a0e70b3351bd"
|
||||
}
|
||||
|
|
@ -0,0 +1,140 @@
|
|||
#!/usr/bin/env python3
|
||||
"""Read-only Git+Hub task binding verifier; never syncs or changes source/index."""
|
||||
import hashlib
|
||||
import json
|
||||
import os
|
||||
from pathlib import Path
|
||||
import re
|
||||
import subprocess
|
||||
import urllib.request
|
||||
|
||||
HERE=Path(__file__).resolve().parent
|
||||
OWNERS=[
|
||||
{'repo':'repo-manager','commit':'9ebde0a9bd60d5c82910494fbe6bd1b891455cee','path':'workplans/RMGR-WP-0021-secret-detection-controls.md','id':'RMGR-WP-0021','tasks':5},
|
||||
{'repo':'secrets-engine','commit':'c59bbf568c0be8a72ac593508f48c9b1f61ec4c1','path':'workplans/SECRETS-WP-0015-original-keycape-recovery-selector.md','id':'SECRETS-WP-0015','tasks':4},
|
||||
]
|
||||
API=os.environ.get('API_BASE','http://127.0.0.1:8000').rstrip('/')
|
||||
EXTERNAL={'NK-WP-0049-T33':'56c8d469-7a10-5d50-a30e-95cbf3cd4756'}
|
||||
|
||||
|
||||
class Refused(Exception):pass
|
||||
|
||||
|
||||
def git(root,*args):
|
||||
result=subprocess.run(['git','--no-optional-locks','-C',str(root),*args],
|
||||
capture_output=True,timeout=30,check=False)
|
||||
if result.returncode:raise Refused('read-only-git-failed')
|
||||
return result.stdout
|
||||
|
||||
|
||||
def field(text,key):
|
||||
values=re.findall(r'^'+re.escape(key)+r':\s*(.*?)\s*$',text,re.M)
|
||||
if len(values)!=1:raise Refused('source-field-ambiguous')
|
||||
return values[0].strip('"\'')
|
||||
|
||||
|
||||
def source(text):
|
||||
header=text.split('---',2)[1]
|
||||
tasks=[]
|
||||
for block in re.findall(r'```task\n(.*?)\n```',text,re.S):
|
||||
deps=re.findall(r'^depends_on:\s*\[(.*?)\]',block,re.M)
|
||||
tasks.append({'record_id':field(block,'id'),'id':field(block,'state_hub_task_id'),
|
||||
'status':field(block,'status'),'dependencies':[x.strip() for x in deps[0].split(',') if x.strip()] if deps else []})
|
||||
return {'id':field(header,'state_hub_workstream_id'),'slug':field(header,'id'),
|
||||
'status':field(header,'status'),'tasks':tasks}
|
||||
|
||||
|
||||
def get(path):
|
||||
class NoRedirect(urllib.request.HTTPRedirectHandler):
|
||||
def redirect_request(self,*args,**kwargs):raise Refused('hub-redirect-refused')
|
||||
opener=urllib.request.build_opener(urllib.request.ProxyHandler({}),NoRedirect)
|
||||
with opener.open(urllib.request.Request(API+path,method='GET'),timeout=20) as response:
|
||||
data=response.read(8*1024**2+1)
|
||||
if len(data)>8*1024**2:raise Refused('hub-read-limit')
|
||||
return json.loads(data)
|
||||
|
||||
|
||||
def index_stat(root):
|
||||
raw=git(root,'rev-parse','--git-path','index').decode().strip();path=Path(raw)
|
||||
if not path.is_absolute():path=root/path
|
||||
try:item=path.lstat()
|
||||
except FileNotFoundError:return None
|
||||
return [item.st_dev,item.st_ino,item.st_size,item.st_mtime_ns,item.st_mode]
|
||||
|
||||
|
||||
def remote(root,expected,repo):
|
||||
if git(root,'remote','get-url','origin').decode().strip()!='forgejo-remote:coulomb/'+repo+'.git':
|
||||
raise Refused('remote-route-drift')
|
||||
lines=git(root,'ls-remote','--symref','origin','HEAD','refs/heads/main').decode().splitlines()
|
||||
if set(lines)!={'ref: refs/heads/main\tHEAD',expected+'\tHEAD',expected+'\trefs/heads/main'}:
|
||||
raise Refused('remote-head-mismatch')
|
||||
return {'HEAD':expected,'refs/heads/main':expected,'symbolic_HEAD':'refs/heads/main'}
|
||||
|
||||
|
||||
def verify():
|
||||
result={'status':'unverified','scope':'two exact published workplans; read-only Git ls-remote and Hub GET snapshots',
|
||||
'writes_to_source_index_refs_or_Hub':False,'rows':[]}
|
||||
try:
|
||||
if API not in {'http://127.0.0.1:8000','http://127.0.0.1:18080','http://10.43.68.154:8000'}:
|
||||
raise Refused('unrecognized-hub-endpoint')
|
||||
health=get('/state/health')
|
||||
result['hub_instance']={key:health.get(key) for key in ('status','instance_role','instance_label')}
|
||||
if result['hub_instance']!={'status':'ok','instance_role':'primary','instance_label':'railiance01'}:
|
||||
raise Refused('hub-identity-mismatch')
|
||||
for owner in OWNERS:
|
||||
root=Path('/home/worsch')/owner['repo'];before_index=index_stat(root)
|
||||
if git(root,'rev-parse','HEAD').decode().strip()!=owner['commit']:
|
||||
raise Refused('local-head-drift')
|
||||
committed=git(root,'show',owner['commit']+':'+owner['path'])
|
||||
local=(root/owner['path']).read_bytes()
|
||||
if local!=committed:raise Refused('published-workplan-local-drift')
|
||||
expected=source(committed.decode())
|
||||
if expected['slug']!=owner['id'] or len(expected['tasks'])!=owner['tasks']:
|
||||
raise Refused('source-task-denominator-mismatch')
|
||||
snapshot=get('/repos/'+owner['repo']+'/work-record-projection/snapshot')
|
||||
plans=[row for row in snapshot['workplans'] if row['id']==expected['id']]
|
||||
if len(plans)!=1 or any(plans[0].get(key)!=expected[key] for key in ('id','slug','status')):
|
||||
raise Refused('workplan-binding-mismatch')
|
||||
projected=[row for row in snapshot['tasks']
|
||||
if row.get('workplan_id',row.get('workstream_id'))==expected['id']]
|
||||
if len(projected)!=len(expected['tasks']):raise Refused('projected-task-denominator-mismatch')
|
||||
byid={row['id']:row for row in projected}
|
||||
if len(byid)!=len(projected):raise Refused('duplicate-projected-uuid')
|
||||
observed=[]
|
||||
for task in expected['tasks']:
|
||||
row=byid.get(task['id'],{})
|
||||
if any(row.get(key)!=task[key] for key in ('id','record_id','status')):
|
||||
raise Refused('task-id-uuid-status-mismatch')
|
||||
observed.append({key:row[key] for key in ('id','record_id','status')})
|
||||
identifiers={task['record_id']:task['id'] for task in expected['tasks']}|EXTERNAL
|
||||
edges={(task['id'],identifiers[dep],'starts_after') for task in expected['tasks'] for dep in task['dependencies']}
|
||||
actual=[edge for edge in snapshot['dependencies'] if edge['from_workplan_id']==expected['id']]
|
||||
projected_edges={(edge.get('from_task_id'),edge.get('to_task_id'),edge['relationship_type']) for edge in actual}
|
||||
if len(actual)!=len(edges) or projected_edges!=edges:
|
||||
raise Refused('dependency-binding-mismatch')
|
||||
if any(edge.get('source_commit') not in (None,owner['commit']) for edge in actual):
|
||||
raise Refused('dependency-source-commit-mismatch')
|
||||
for task in expected['tasks']:
|
||||
for dep in task['dependencies']:
|
||||
if dep in EXTERNAL:
|
||||
target=get('/tasks/'+EXTERNAL[dep])
|
||||
if target.get('id')!=EXTERNAL[dep] or target.get('record_id')!=dep:
|
||||
raise Refused('external-dependency-target-mismatch')
|
||||
remote_readback=remote(root,owner['commit'],owner['repo'])
|
||||
if index_stat(root)!=before_index or (root/owner['path']).read_bytes()!=local:
|
||||
raise Refused('source-or-index-stat-changed')
|
||||
result['rows'].append({'repo':owner['repo'],'published_commit':owner['commit'],
|
||||
'remote':remote_readback,'workplan':{key:plans[0][key] for key in ('id','slug','status')},
|
||||
'tasks':observed,'dependencies':[{'from_task_id':a,'to_task_id':b,'relationship_type':c} for a,b,c in sorted(edges)],
|
||||
'source_file_sha256':hashlib.sha256(local).hexdigest(),'source_file_unchanged':True,
|
||||
'index_stat_unchanged':True})
|
||||
result['status']='verified'
|
||||
except Exception as error:
|
||||
result['reason']=error.args[0] if isinstance(error,Refused) else 'readback-unavailable'
|
||||
result['verifier_sha256']=hashlib.sha256(Path(__file__).read_bytes()).hexdigest()
|
||||
(HERE/'owner-publication-readback.json').write_text(json.dumps(result,indent=2)+'\n')
|
||||
print(json.dumps({'status':result['status'],'owners':len(result['rows'])}))
|
||||
return 0 if result['status']=='verified' else 2
|
||||
|
||||
|
||||
if __name__=='__main__':raise SystemExit(verify())
|
||||
|
|
@ -0,0 +1,31 @@
|
|||
{
|
||||
"state": "prepared for root review; no canonical mutation",
|
||||
"owner_head": "6cb43c0cc55212363a5406b02db046e2384a7c40",
|
||||
"path": "workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md",
|
||||
"preimage_sha256": "fc095a8bebae12a5025e911f8626e0b538e560f64433533665322ada1913dbef",
|
||||
"result_sha256": "95dfb5a264ba179aba4aeddb602039a098af5c33c893a509d31f3631d39b7046",
|
||||
"patch_sha256": "5364b1966334869c71a58ff2d90194db45c7ea6f3e60d57327a231f558437641",
|
||||
"task_counts": {
|
||||
"done": 25,
|
||||
"progress": 4,
|
||||
"wait": 7,
|
||||
"todo": 1
|
||||
},
|
||||
"T34_historical_section_byte_identical": true,
|
||||
"closure": "T15\u2013T37",
|
||||
"T37": "done;65actualSOPSgeneratedtests; no productionruntimeadmission",
|
||||
"knowledge_orientation": {
|
||||
"package": "0.2.6",
|
||||
"digest": "8d1d6a9d4d07fec7b619618de7dfe2be2254c1790f85f4198c7fe19db9751c02",
|
||||
"start_status": "withheld; currentcard+NetKingdomSECURITY-COMPANION+evidencecardread asorientationonly",
|
||||
"authority_granted": false
|
||||
},
|
||||
"verifier_sha256": "ab18c1e934ca66b78d21fc7268b9b989569e2249e434d6688cb9de0083d2fda2",
|
||||
"verifier_R1": {
|
||||
"state": "failed workplan-binding-mismatch; owners0",
|
||||
"retained": "failed-verifier-r1/",
|
||||
"cause": "source uppercase recordID compared literally with canonical lower-case API slug",
|
||||
"UUID_or_status_relaxed": false
|
||||
},
|
||||
"verifier_R2": "source_record_id remains exact uppercase; expectedAPI slug derived lower-case and compared exactly; UUID/status/taskIDs/edges unchanged"
|
||||
}
|
||||
|
|
@ -0,0 +1,100 @@
|
|||
--- a/workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md
|
||||
+++ b/workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md
|
||||
@@ -28,7 +28,7 @@
|
||||
or newly granted authority. The earlier dated narrative remains in Git at
|
||||
`cc2dd01`; its evidence references are carried into the tasks below.
|
||||
|
||||
-**Current position, source refinement 2026-10-17:** 24 tasks done; 4 in
|
||||
+**Current position, source refinement 2026-10-17:** 25 tasks done; 4 in
|
||||
progress; 1 ready to start (`todo`); 7 waiting on explicit prerequisites. These are task counts, not an effort-based
|
||||
completion percentage. Assignees are also written in task descriptions because
|
||||
the current Forge projector does not populate the dedicated Hub assignee field. The outage-retrieval tool and restore-packet draft are now prepared;
|
||||
@@ -1071,6 +1071,19 @@
|
||||
its dependency/unblock condition; a prose-only gap or untested archive is not
|
||||
completion. This delivers preparation/disposition, not actual TLS recovery.
|
||||
|
||||
+2026-10-17 owner handoff progress: the four reviewed Railiance Cluster source
|
||||
+additions are present, including `RCLUSTER-WP-0018` and public-only TLS metadata
|
||||
+preparation. They are not published. The normal publication path stopped at the
|
||||
+existing historical identifier guard (`ensure_missing_work_record_identifiers`,
|
||||
+execute=False): 15 bare task-label findings and five collisions. A separately
|
||||
+retained read-only allocator preview records those findings; the original failed
|
||||
+publication stderr was not retained and is not reconstructed. No Cluster Hub
|
||||
+workplan/task existence or projection, actual certificate/key custody, reissue
|
||||
+assent or native TLS acceptance is claimed. The source record and next owner
|
||||
+publication action remain live; do not bypass the historical identity guard.
|
||||
+Evidence: Custodian October17 `cluster-integration.json`, `coordinator-checkpoint.json`
|
||||
+and October16 `cluster-historical-publication-r1/actual-source-allocator-preview.json`.
|
||||
+
|
||||
## Prepare selected original service registration and private admission bindings
|
||||
|
||||
```task
|
||||
@@ -1103,6 +1116,59 @@
|
||||
registration metadata while T35 proceeds independently; it does not finalize the
|
||||
whole admission, perform actual recovery, redirect a consumer or confer assent.
|
||||
|
||||
+2026-10-17 owner handoff progress: Secrets Engine source workplan
|
||||
+`SECRETS-WP-0015` and bounded public selector/preflight source were published as
|
||||
+`c59bbf568c0be8a72ac593508f48c9b1f61ec4c1`; the central primary/railiance01
|
||||
+reconciliation receipt reports the same expected/derived commit, four owner task
|
||||
+bindings and two T04 dependency edges, with no unresolved edges. T01/T02 source
|
||||
+preparation is done, T03 exact outage-compatible consumer proof/custody planning
|
||||
+is todo, and T04 actual admitted consumer result waits on T03 and NK-WP-0049-T33.
|
||||
+This publishes an owner handoff, not exact archived registration validation,
|
||||
+current native assent, an OpenBao read, a new grant or consumer continuity.
|
||||
+T36 therefore remains progress; T18/T19 and final native gates remain open.
|
||||
+Evidence: Custodian October17 `secrets-engine-projection.json` and October16
|
||||
+`recovery-owner-handoffs-r1` source review; independent ID/UUID/status/remote
|
||||
+readback is recorded separately when performed.
|
||||
+
|
||||
+## Verify actual SOPS compatibility and sealed-descriptor read/write custody
|
||||
+
|
||||
+```task
|
||||
+id: NK-WP-0049-T37
|
||||
+status: done
|
||||
+priority: high
|
||||
+assignee: codex
|
||||
+depends_on: [NK-WP-0049-T34]
|
||||
+```
|
||||
+
|
||||
+**Accountable worker:** NetKingdom codex; independent Custodian fixture review.
|
||||
+Completed 2026-10-17 as generated-fixture compatibility proof. The coordinator
|
||||
+ran the actual reviewed SOPS 3.13.3 binary in a network/host-custody-isolated
|
||||
+namespace: all 65 tests passed in 14.85 seconds, including the 61 real-SOPS cases
|
||||
+previously skipped in T34 and four new actual sealed-FD cases. The latter cover
|
||||
+correct-key descriptor-only decryption, wrong-recipient refusal and descriptor-only
|
||||
+edit/rotation through the real Make entry points. Generated custody key files
|
||||
+were removed before these FD-only invocations; explicit descriptor passing,
|
||||
+private output modes, declared encryption-policy preservation, suppressed synthetic plaintext
|
||||
+and operation cleanup were checked.
|
||||
+
|
||||
+This is a dated successor to T34's historical 94-pass/61-skip record, which stays
|
||||
+unchanged. The prior skip is not rewritten as an earlier pass. Binary digest
|
||||
+`sha256:e5bec3346a873ae91d871550f3e698c1aad962aff462a080e40f25fde17fef6b`
|
||||
+matched the official release asset/checksum; Sigstore signature verification was
|
||||
+not performed. SOPS was not installed systemwide or admitted for production
|
||||
+runtime. Host custody was not mounted, network routes were absent, diagnostics
|
||||
+were suppressed and namespace teardown completed. All material was generated;
|
||||
+no original owner key/archive, private manifest, production credential, native
|
||||
+service continuity or owner assent was exercised.
|
||||
+
|
||||
+Evidence: Custodian
|
||||
+`docs/changes/netkingdom-target-2026-10-17/sops-real-regressions.json`,
|
||||
+`sops-source-tool.json` and `sops-fd-r2/` (exact test patch/manifest). The focused
|
||||
+custody/source checks and frozen R6/R7 native fixture evidence remain separate.
|
||||
+T33 attempt readiness, T18 actual recovery/consumer acceptance, T19 retained MFA,
|
||||
+T35 TLS/trust disposition and T36 original registration/private admission remain
|
||||
+open under their existing owner boundaries.
|
||||
+
|
||||
## Accept remaining recovery and caller evidence and close the G08 handoff
|
||||
|
||||
```task
|
||||
@@ -1122,7 +1188,7 @@
|
||||
G08 receiving the final evidence. The completed archive/job milestones remain
|
||||
accepted independently of this final gate.
|
||||
|
||||
-**Done when:** T02 and T15–T36 have their stated completed or explicitly accepted
|
||||
+**Done when:** T02 and T15–T37 have their stated completed or explicitly accepted
|
||||
handoff outcomes; service authentication/token/audit proof and current/legacy
|
||||
caller dispositions are accepted; the source workplan and projected tasks agree;
|
||||
and G08 has an exact evidence/handoff record. Record actionable residuals as live
|
||||
|
|
@ -0,0 +1,29 @@
|
|||
--- a/verify_owner_publications.py
|
||||
+++ b/verify_owner_publications.py
|
||||
@@ -40,7 +40,8 @@
|
||||
deps=re.findall(r'^depends_on:\s*\[(.*?)\]',block,re.M)
|
||||
tasks.append({'record_id':field(block,'id'),'id':field(block,'state_hub_task_id'),
|
||||
'status':field(block,'status'),'dependencies':[x.strip() for x in deps[0].split(',') if x.strip()] if deps else []})
|
||||
- return {'id':field(header,'state_hub_workstream_id'),'slug':field(header,'id'),
|
||||
+ return {'id':field(header,'state_hub_workstream_id'),'source_record_id':field(header,'id'),
|
||||
+ 'slug':field(header,'id').lower(),
|
||||
'status':field(header,'status'),'tasks':tasks}
|
||||
|
||||
|
||||
@@ -89,7 +90,7 @@
|
||||
local=(root/owner['path']).read_bytes()
|
||||
if local!=committed:raise Refused('published-workplan-local-drift')
|
||||
expected=source(committed.decode())
|
||||
- if expected['slug']!=owner['id'] or len(expected['tasks'])!=owner['tasks']:
|
||||
+ if expected['source_record_id']!=owner['id'] or len(expected['tasks'])!=owner['tasks']:
|
||||
raise Refused('source-task-denominator-mismatch')
|
||||
snapshot=get('/repos/'+owner['repo']+'/work-record-projection/snapshot')
|
||||
plans=[row for row in snapshot['workplans'] if row['id']==expected['id']]
|
||||
@@ -125,6 +126,7 @@
|
||||
raise Refused('source-or-index-stat-changed')
|
||||
result['rows'].append({'repo':owner['repo'],'published_commit':owner['commit'],
|
||||
'remote':remote_readback,'workplan':{key:plans[0][key] for key in ('id','slug','status')},
|
||||
+ 'source_record_id':expected['source_record_id'],
|
||||
'tasks':observed,'dependencies':[{'from_task_id':a,'to_task_id':b,'relationship_type':c} for a,b,c in sorted(edges)],
|
||||
'source_file_sha256':hashlib.sha256(local).hexdigest(),'source_file_unchanged':True,
|
||||
'index_stat_unchanged':True})
|
||||
|
|
@ -0,0 +1,142 @@
|
|||
#!/usr/bin/env python3
|
||||
"""Read-only Git+Hub task binding verifier; never syncs or changes source/index."""
|
||||
import hashlib
|
||||
import json
|
||||
import os
|
||||
from pathlib import Path
|
||||
import re
|
||||
import subprocess
|
||||
import urllib.request
|
||||
|
||||
HERE=Path(__file__).resolve().parent
|
||||
OWNERS=[
|
||||
{'repo':'repo-manager','commit':'9ebde0a9bd60d5c82910494fbe6bd1b891455cee','path':'workplans/RMGR-WP-0021-secret-detection-controls.md','id':'RMGR-WP-0021','tasks':5},
|
||||
{'repo':'secrets-engine','commit':'c59bbf568c0be8a72ac593508f48c9b1f61ec4c1','path':'workplans/SECRETS-WP-0015-original-keycape-recovery-selector.md','id':'SECRETS-WP-0015','tasks':4},
|
||||
]
|
||||
API=os.environ.get('API_BASE','http://127.0.0.1:8000').rstrip('/')
|
||||
EXTERNAL={'NK-WP-0049-T33':'56c8d469-7a10-5d50-a30e-95cbf3cd4756'}
|
||||
|
||||
|
||||
class Refused(Exception):pass
|
||||
|
||||
|
||||
def git(root,*args):
|
||||
result=subprocess.run(['git','--no-optional-locks','-C',str(root),*args],
|
||||
capture_output=True,timeout=30,check=False)
|
||||
if result.returncode:raise Refused('read-only-git-failed')
|
||||
return result.stdout
|
||||
|
||||
|
||||
def field(text,key):
|
||||
values=re.findall(r'^'+re.escape(key)+r':\s*(.*?)\s*$',text,re.M)
|
||||
if len(values)!=1:raise Refused('source-field-ambiguous')
|
||||
return values[0].strip('"\'')
|
||||
|
||||
|
||||
def source(text):
|
||||
header=text.split('---',2)[1]
|
||||
tasks=[]
|
||||
for block in re.findall(r'```task\n(.*?)\n```',text,re.S):
|
||||
deps=re.findall(r'^depends_on:\s*\[(.*?)\]',block,re.M)
|
||||
tasks.append({'record_id':field(block,'id'),'id':field(block,'state_hub_task_id'),
|
||||
'status':field(block,'status'),'dependencies':[x.strip() for x in deps[0].split(',') if x.strip()] if deps else []})
|
||||
return {'id':field(header,'state_hub_workstream_id'),'source_record_id':field(header,'id'),
|
||||
'slug':field(header,'id').lower(),
|
||||
'status':field(header,'status'),'tasks':tasks}
|
||||
|
||||
|
||||
def get(path):
|
||||
class NoRedirect(urllib.request.HTTPRedirectHandler):
|
||||
def redirect_request(self,*args,**kwargs):raise Refused('hub-redirect-refused')
|
||||
opener=urllib.request.build_opener(urllib.request.ProxyHandler({}),NoRedirect)
|
||||
with opener.open(urllib.request.Request(API+path,method='GET'),timeout=20) as response:
|
||||
data=response.read(8*1024**2+1)
|
||||
if len(data)>8*1024**2:raise Refused('hub-read-limit')
|
||||
return json.loads(data)
|
||||
|
||||
|
||||
def index_stat(root):
|
||||
raw=git(root,'rev-parse','--git-path','index').decode().strip();path=Path(raw)
|
||||
if not path.is_absolute():path=root/path
|
||||
try:item=path.lstat()
|
||||
except FileNotFoundError:return None
|
||||
return [item.st_dev,item.st_ino,item.st_size,item.st_mtime_ns,item.st_mode]
|
||||
|
||||
|
||||
def remote(root,expected,repo):
|
||||
if git(root,'remote','get-url','origin').decode().strip()!='forgejo-remote:coulomb/'+repo+'.git':
|
||||
raise Refused('remote-route-drift')
|
||||
lines=git(root,'ls-remote','--symref','origin','HEAD','refs/heads/main').decode().splitlines()
|
||||
if set(lines)!={'ref: refs/heads/main\tHEAD',expected+'\tHEAD',expected+'\trefs/heads/main'}:
|
||||
raise Refused('remote-head-mismatch')
|
||||
return {'HEAD':expected,'refs/heads/main':expected,'symbolic_HEAD':'refs/heads/main'}
|
||||
|
||||
|
||||
def verify():
|
||||
result={'status':'unverified','scope':'two exact published workplans; read-only Git ls-remote and Hub GET snapshots',
|
||||
'writes_to_source_index_refs_or_Hub':False,'rows':[]}
|
||||
try:
|
||||
if API not in {'http://127.0.0.1:8000','http://127.0.0.1:18080','http://10.43.68.154:8000'}:
|
||||
raise Refused('unrecognized-hub-endpoint')
|
||||
health=get('/state/health')
|
||||
result['hub_instance']={key:health.get(key) for key in ('status','instance_role','instance_label')}
|
||||
if result['hub_instance']!={'status':'ok','instance_role':'primary','instance_label':'railiance01'}:
|
||||
raise Refused('hub-identity-mismatch')
|
||||
for owner in OWNERS:
|
||||
root=Path('/home/worsch')/owner['repo'];before_index=index_stat(root)
|
||||
if git(root,'rev-parse','HEAD').decode().strip()!=owner['commit']:
|
||||
raise Refused('local-head-drift')
|
||||
committed=git(root,'show',owner['commit']+':'+owner['path'])
|
||||
local=(root/owner['path']).read_bytes()
|
||||
if local!=committed:raise Refused('published-workplan-local-drift')
|
||||
expected=source(committed.decode())
|
||||
if expected['source_record_id']!=owner['id'] or len(expected['tasks'])!=owner['tasks']:
|
||||
raise Refused('source-task-denominator-mismatch')
|
||||
snapshot=get('/repos/'+owner['repo']+'/work-record-projection/snapshot')
|
||||
plans=[row for row in snapshot['workplans'] if row['id']==expected['id']]
|
||||
if len(plans)!=1 or any(plans[0].get(key)!=expected[key] for key in ('id','slug','status')):
|
||||
raise Refused('workplan-binding-mismatch')
|
||||
projected=[row for row in snapshot['tasks']
|
||||
if row.get('workplan_id',row.get('workstream_id'))==expected['id']]
|
||||
if len(projected)!=len(expected['tasks']):raise Refused('projected-task-denominator-mismatch')
|
||||
byid={row['id']:row for row in projected}
|
||||
if len(byid)!=len(projected):raise Refused('duplicate-projected-uuid')
|
||||
observed=[]
|
||||
for task in expected['tasks']:
|
||||
row=byid.get(task['id'],{})
|
||||
if any(row.get(key)!=task[key] for key in ('id','record_id','status')):
|
||||
raise Refused('task-id-uuid-status-mismatch')
|
||||
observed.append({key:row[key] for key in ('id','record_id','status')})
|
||||
identifiers={task['record_id']:task['id'] for task in expected['tasks']}|EXTERNAL
|
||||
edges={(task['id'],identifiers[dep],'starts_after') for task in expected['tasks'] for dep in task['dependencies']}
|
||||
actual=[edge for edge in snapshot['dependencies'] if edge['from_workplan_id']==expected['id']]
|
||||
projected_edges={(edge.get('from_task_id'),edge.get('to_task_id'),edge['relationship_type']) for edge in actual}
|
||||
if len(actual)!=len(edges) or projected_edges!=edges:
|
||||
raise Refused('dependency-binding-mismatch')
|
||||
if any(edge.get('source_commit') not in (None,owner['commit']) for edge in actual):
|
||||
raise Refused('dependency-source-commit-mismatch')
|
||||
for task in expected['tasks']:
|
||||
for dep in task['dependencies']:
|
||||
if dep in EXTERNAL:
|
||||
target=get('/tasks/'+EXTERNAL[dep])
|
||||
if target.get('id')!=EXTERNAL[dep] or target.get('record_id')!=dep:
|
||||
raise Refused('external-dependency-target-mismatch')
|
||||
remote_readback=remote(root,owner['commit'],owner['repo'])
|
||||
if index_stat(root)!=before_index or (root/owner['path']).read_bytes()!=local:
|
||||
raise Refused('source-or-index-stat-changed')
|
||||
result['rows'].append({'repo':owner['repo'],'published_commit':owner['commit'],
|
||||
'remote':remote_readback,'workplan':{key:plans[0][key] for key in ('id','slug','status')},
|
||||
'source_record_id':expected['source_record_id'],
|
||||
'tasks':observed,'dependencies':[{'from_task_id':a,'to_task_id':b,'relationship_type':c} for a,b,c in sorted(edges)],
|
||||
'source_file_sha256':hashlib.sha256(local).hexdigest(),'source_file_unchanged':True,
|
||||
'index_stat_unchanged':True})
|
||||
result['status']='verified'
|
||||
except Exception as error:
|
||||
result['reason']=error.args[0] if isinstance(error,Refused) else 'readback-unavailable'
|
||||
result['verifier_sha256']=hashlib.sha256(Path(__file__).read_bytes()).hexdigest()
|
||||
(HERE/'owner-publication-readback.json').write_text(json.dumps(result,indent=2)+'\n')
|
||||
print(json.dumps({'status':result['status'],'owners':len(result['rows'])}))
|
||||
return 0 if result['status']=='verified' else 2
|
||||
|
||||
|
||||
if __name__=='__main__':raise SystemExit(verify())
|
||||
Loading…
Add table
Add a link
Reference in a new issue