coulomb/the-custodian
4
0
Fork 0
Code Issues 1 Pull requests Projects Releases Packages Wiki Activity Actions

chore(workplan): record CUST-WP-0067-T09 canon delivery build
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This commit is contained in:
codex 2026-08-24 23:42:23 +02:00
parent 512ea1fb53
commit 3c1e93186f
1 changed files with 23 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

24
workplans/CUST-WP-0067-hub-authority-target-resolution.md
View file

@ -436,7 +436,7 @@ depending on it is the documented registration, which has been repointed.
```task
id: CUST-WP-0067-T09
status: todo
status: progress
priority: high
state_hub_task_id: "45a2ba22-9d50-5ba8-9fa7-6e345ddce395"
```
@ -458,3 +458,25 @@ Once it serves, re-run onboarding across the 33 to project their classification.
Acceptance: a classification PATCH succeeds against central; the 33 records
carry their categories; the allowed-values source in the cluster is traceable
to `the-custodian/canon/standards/repo-classification.allowed.yaml`.
**Progress (2026-08-24):** delivery is built and validated. The chart carries a
generated copy of the canon file, mounted as a ConfigMap at
`/etc/state-hub/classification`, with `REPO_CLASSIFICATION_ALLOWED_PATH` set to
it.
The copy is the risk, so it is owned rather than trusted:
`scripts/sync_classification_allowed.py` regenerates it from canon, and
`--check` fails on drift. `make check-classification-allowed` and
`make railiance-state-hub-render` both exit non-zero when the copy diverges, so
a release cannot ship a stale vocabulary and silently validate against
yesterday's rules — verified by injecting drift.
Rendered ConfigMap parses and matches canon (version 1.0, 6 categories, 14
domains). The `volumeMounts`/`env` blocks were merged rather than appended:
adding a second pair would have produced duplicate YAML keys the moment `sweep`
was re-enabled. Both `sweep` states render correctly; `helm lint` clean.
**Remaining:** the release. Same shape as T08 — merge, let CI build, bump the
tag, `helm upgrade`. Then re-run onboarding across the 33 to project their
classification, and the local cache database finally has nothing unique left
except the 11 dispositioned records.