docs: preserve reviewed NetKingdom session artifacts
This commit is contained in:
codex
parent
423b815782
commit
403e218dec
50 changed files with 12359 additions and 0 deletions
|
|
@ -0,0 +1,112 @@
|
|||
---
|
||||
id: KEY-WP-0035
|
||||
type: workplan
|
||||
title: "Opt-in MFA for demo-company login"
|
||||
domain: infotech
|
||||
repo: key-cape
|
||||
status: finished
|
||||
owner: codex
|
||||
topic_slug: infotech
|
||||
created: "2026-09-13"
|
||||
updated: "2026-09-14"
|
||||
state_hub_workstream_id: "b27601d8-d0a5-5c79-a1ff-c2a4cedafa74"
|
||||
---
|
||||
|
||||
Requested behavior: password-only login before OTP activation; require OTP after
|
||||
activation. Do not lower assurance of unrelated applications.
|
||||
|
||||
## Implement enrollment-dependent browser policy
|
||||
|
||||
```task
|
||||
id: KEY-WP-0035-T01
|
||||
status: done
|
||||
priority: high
|
||||
state_hub_task_id: "c1ed06c2-c689-53d1-afc7-e10d79e9e94f"
|
||||
```
|
||||
|
||||
Add mfaOptional, preserve explicit AAL2 and existing client policy, fail closed on
|
||||
provider lookup errors and malformed/incomplete responses. Preserve the setting
|
||||
in config/runtime/canonical model and flag manual migration requirements.
|
||||
Validation: `go test ./...` and `git diff --check` passed on 2026-09-13. See docs/optional-mfa.md.
|
||||
|
||||
## Restore authoritative factor lookup and enable the reviewed client
|
||||
|
||||
```task
|
||||
id: KEY-WP-0035-T02
|
||||
status: done
|
||||
priority: high
|
||||
state_hub_task_id: "b066a273-f91c-50ee-b497-a39eace03b3a"
|
||||
```
|
||||
|
||||
Factor lookup restored on 2026-09-13 through the new dedicated service lane
|
||||
RPF-WP-0040 / CCR-2026-0023. Native ESO delivery, scoped provider user lookup,
|
||||
renewal and mounted replacement passed. KeyCape now uses adminTokenFile; other
|
||||
configuration and current MFA policy were preserved. Historical NK-WP-0033
|
||||
resolver lanes remain separate. The remaining T02 work is the exact scoped
|
||||
client migration and no-factor/enrolled/error/step-up acceptance before enabling
|
||||
optional policy. See railiance-platform/docs/evidence/2026-09-13-keycape-factor-custody.md.
|
||||
|
||||
## Verify optional enrollment and account management access
|
||||
|
||||
```task
|
||||
id: KEY-WP-0035-T03
|
||||
status: done
|
||||
priority: high
|
||||
state_hub_task_id: "93ce2e97-6c5a-58a7-8f3c-1c4f0eb6f1b5"
|
||||
```
|
||||
|
||||
Verify provider self-service login, possession-confirmed activation, cancellation
|
||||
and removal/recovery. Resolve shared portal assurance scope before surfacing the
|
||||
verified OTP setup link. Actual user login acceptance remains open under
|
||||
KEY-WP-0034 and VERGABE-WP-0019; this work does not finish either workplan.
|
||||
|
||||
## Support bounded provider credential renewal without issuer restart
|
||||
|
||||
```task
|
||||
id: KEY-WP-0035-T04
|
||||
status: done
|
||||
priority: high
|
||||
state_hub_task_id: "494f554d-6542-5797-804f-6df4a05dcadb"
|
||||
```
|
||||
|
||||
Supports platform journey P05 and USER-WP-0030-T03. Add an exclusive mounted adminTokenFile credential source, fresh reads for lookup and validation, no stale fallback, bounded input, sanitized failures and atomic replacement acceptance. Preserve inline configuration compatibility. Require provider success and true validation value before AAL2; bound default request time and reject credential-bearing redirects. Test renewal, rejection, recovery and policy regressions. This implements the consumer delivery contract; owner credential issuance/custody and live P04/P05/P06 acceptance remain T02/T03.
|
||||
|
||||
All Go regression/conformance suites pass, including five new renewal/validation tests with invalid-source subcases. Added exact-commit authentication acceptance CI. Provider-mounted credential delivery and effective optional policy remain gated separately.
|
||||
|
||||
Consumer source 632b1f1 deployed and Ready 1/1; CI, four provider HTTP checks and twelve live browser checks passed. See docs/credential-renewal-release-2026-09-13.md. T02/T03 retain actual credential delivery and live recovery/policy acceptance.
|
||||
|
||||
2026-09-13 custody activation supersedes the earlier owner-handoff gate: the new factor service is live and renewable. T02/T03 now track effective policy/onboarding acceptance, not missing credential ownership.
|
||||
|
||||
## Require confirmed enrollment and actual OTP evidence
|
||||
|
||||
```task
|
||||
id: KEY-WP-0035-T05
|
||||
status: done
|
||||
priority: high
|
||||
state_hub_task_id: "94f579d1-a7af-564c-ab0c-ae76fce343aa"
|
||||
```
|
||||
|
||||
Live provider source inspection found active tokens can remain in verification
|
||||
state; live policy inspection found password passthrough enabled for users without
|
||||
factors. Distinguish pending enrollment from completed enrollment and require
|
||||
TOTP/HOTP serial/type evidence before AAL2. Cover pending/confirmed/cancelled,
|
||||
existing-factor plus pending enrollment, missing/unknown state, incomplete pages,
|
||||
password passthrough and static-password token rejection. All Go suites pass
|
||||
locally; source 113f3a6 was published, CI acceptance/build passed, and the guarded issuer replacement is live. See docs/enrollment-assurance-release-2026-09-13.md.
|
||||
|
||||
Provider recovery testing additionally proved that withdrawing reader policy
|
||||
returns HTTP 200 with an empty list. Added and deployed a same-realm disabled,
|
||||
unassigned visibility probe before no-factor decisions, with missing visibility
|
||||
failing closed. Native scope proof passed. Isolated installed-provider tests
|
||||
passed possession confirmation/cancellation, permission withdrawal/recovery and
|
||||
provider-issued JWT expiry; these are now included in CI. T02/T03 remain the
|
||||
actual optional-client and self-service browser activation gates.
|
||||
|
||||
2026-09-14: T02/T03 completed through USER-WP-0033 P06. Installed-provider
|
||||
native and five browser checks passed, including confirmed activation,
|
||||
cancellation, old-session MFA and denied active-factor replacement. Portal
|
||||
guards, provider restrictions and both scoped optional-client policies are live;
|
||||
PVC readback confirms effective state. Full release evidence and rollback:
|
||||
`../user-engine/docs/evidence/2026-09-13-p06-authentication-policy.md`.
|
||||
Residual actual-user and workload sign-in acceptance remains live under
|
||||
KEY-WP-0034, USER-WP-0028 and VERGABE-WP-0019 before this closure.
|
||||
|
|
@ -0,0 +1,83 @@
|
|||
---
|
||||
id: KEY-WP-0036
|
||||
type: workplan
|
||||
title: "Audited platform administrator lost-factor recovery"
|
||||
domain: infotech
|
||||
repo: key-cape
|
||||
status: finished
|
||||
owner: codex
|
||||
topic_slug: infotech
|
||||
created: "2026-09-13"
|
||||
updated: "2026-09-13"
|
||||
state_hub_workstream_id: "f9ba00a6-5758-5677-9a49-da1e35875f7a"
|
||||
---
|
||||
|
||||
Implements the provider part of P04 under USER-WP-0030-T03. The existing factor
|
||||
read credential is deliberately not elevated to recovery authority. Recovery
|
||||
now has a private signed-OIDC service and platform-only portal browser flow.
|
||||
|
||||
## Implement bounded and audited provider recovery
|
||||
|
||||
```task
|
||||
id: KEY-WP-0036-T01
|
||||
status: done
|
||||
priority: high
|
||||
state_hub_task_id: "f3287544-8412-5b1f-9d16-9f7b9e895ceb"
|
||||
```
|
||||
|
||||
`scripts/factor_recovery.py` previews exact ownership and shared-identity scope,
|
||||
requires an operator verification attestation and matching metadata version,
|
||||
disables one factor with a row lock, requires pre-mutation audit durability,
|
||||
reads back state, records completion and reconciles retries. Reject changed or
|
||||
replaced factors and reference conflicts. Nine isolated unit tests pass, including replacement between disable and readback.
|
||||
The installed-provider Job provider-recovery-contract-02 passed real database
|
||||
and audit persistence, disable/readback and replay assertions in an isolated
|
||||
fixture. Acceptance CI includes both suites. No real user's factor was changed.
|
||||
|
||||
## Validate the attended owner entry point
|
||||
|
||||
```task
|
||||
id: KEY-WP-0036-T02
|
||||
status: cancel
|
||||
priority: high
|
||||
state_hub_task_id: "2d59da13-782e-5aeb-8957-69e41a15ddb1"
|
||||
```
|
||||
|
||||
railiance-platform/scripts/keycape_factor_recovery.py derives actor from an
|
||||
OpenBao platform-admin entity, rejects root/workload substitutes, checks cluster
|
||||
identity, and emits only a private metadata receipt. Runbook:
|
||||
railiance-platform/docs/keycape-factor-recovery.md. Offline owner tests pass.
|
||||
Superseded: routine recovery now independently verifies the platform operator's
|
||||
signed KeyCape session through the private service. The extra OpenBao/Kubernetes
|
||||
operator front door is not part of the supported P04 journey; its native acceptance
|
||||
is cancelled rather than falsely marked passed. No credential handoff is pending.
|
||||
|
||||
## Integrate platform support recovery with the browser journey
|
||||
|
||||
```task
|
||||
id: KEY-WP-0036-T03
|
||||
status: done
|
||||
priority: high
|
||||
state_hub_task_id: "f7248d5e-6f68-5637-ada5-2527436f5f9e"
|
||||
```
|
||||
|
||||
Implement an authenticated bounded recovery service and platform-only portal
|
||||
flow with fresh assurance, server-derived actor, CSRF, ownership-verification
|
||||
process, exact target/scope confirmation, audit/reference readback and safe
|
||||
retry. Never grant Kubernetes access to the portal. Test unauthorized/tenant
|
||||
admin denial, stale confirmation, provider failure, retry and replacement OTP
|
||||
enrollment using disposable identities. Mandatory-AAL2 access is restored only
|
||||
after possession of a replacement factor is proven. Keep P04 incomplete until
|
||||
browser success, failure and recovery paths pass; CLI tests alone do not close it.
|
||||
|
||||
Completion evidence: user-engine/docs/evidence/2026-09-13-p04-recovery.md.
|
||||
KeyCape 63b3070 and portal c298cd9 are released. Fifteen recovery tests, 219 portal
|
||||
regressions with PostgreSQL and 19 Chromium checks pass. Installed-provider
|
||||
provider-p04-contract-03 verifies signature/role/assurance denials, confirmation,
|
||||
multi-owner refusal, ownership locking, audited mutation/retry/reference lookup and replacement OTP possession/login.
|
||||
Production health, anonymous/invalid-token denials, signing-key connectivity,
|
||||
rollout and new-enrollment policy readback pass. Positive mutation used disposable
|
||||
fixtures; no real account was changed. Provider and portal implement the same
|
||||
supported recovery contract; no outstanding P04 implementation remains.
|
||||
Broader policy/self-service and notification operations remain live under
|
||||
USER-WP-0030-T03 and KEY-WP-0035, not residuals of this bounded recovery plan.
|
||||
|
|
@ -0,0 +1,135 @@
|
|||
---
|
||||
id: KEY-WP-0037
|
||||
type: workplan
|
||||
title: "Secrets Engine OpenBao live registration and protected custody"
|
||||
domain: infotech
|
||||
repo: key-cape
|
||||
status: finished
|
||||
owner: codex
|
||||
topic_slug: netkingdom
|
||||
created: "2026-10-04"
|
||||
updated: "2026-10-07"
|
||||
state_hub_workstream_id: "62800ecf-064b-5546-a1e4-4521b5932973"
|
||||
---
|
||||
|
||||
KeyCape's accepted provider contract (KEY-WP-0009) does not establish actual
|
||||
registration or custody. This plan names those missing owner gates for
|
||||
RPF-WP-0035-T02. The founder authorized workers to attend the review requests,
|
||||
not live registration, credential generation, rotation, fetching or deployment.
|
||||
|
||||
## Establish the exact registration and deployment authority
|
||||
|
||||
```task
|
||||
id: KEY-WP-0037-T01
|
||||
status: done
|
||||
priority: high
|
||||
state_hub_task_id: "0409f656-65fb-5ee2-a934-a687a3e139f1"
|
||||
```
|
||||
|
||||
Reviewed KeyCape base 672e1faf4b3401ff7bf68bb0b29f8dc50ca51ac6:
|
||||
`config/service-clients.example.yaml`, `docs/openbao-service-auth-contract.md`,
|
||||
`src/internal/config/config.go`, `src/cmd/keycape/clients_test.go`.
|
||||
The exact service registration remains accepted: secrets-engine-openbao,
|
||||
service:secrets-engine, tenant:platform, role secrets-engine, only openbao:login,
|
||||
client_credentials, confidential, tokenLifetime 15m and issuer
|
||||
https://kc.coulomb.social. Audience defaults to clientId, with no resource
|
||||
audience override. See the owner packet for concrete deployment/custody proposals.
|
||||
NetKingdom owns the live sso/keycape deployment and config, not this example.
|
||||
Existing approved approval-client rollout demonstrates the owner procedure;
|
||||
it does not approve or provision this different service client.
|
||||
|
||||
## Agree and prepare the separately approved protected custody operation
|
||||
|
||||
```task
|
||||
id: KEY-WP-0037-T02
|
||||
status: done
|
||||
priority: high
|
||||
state_hub_task_id: "ac798fb4-ed77-5e45-83ab-f56eea92be34"
|
||||
```
|
||||
|
||||
Platform owns the authoritative OpenBao client-secret custody and least-privilege
|
||||
issuer-side delivery; secrets-engine owns its explicitly selected mode-0600
|
||||
client-side file outside every worktree. The proposal in
|
||||
`docs/secrets-engine-openbao-owner-packet.md` provides candidate coordinates,
|
||||
not a live custody claim or allocated CCR. Complete the platform CCR(s), delivery
|
||||
policy/roles, two target bindings, exact attended child and rollback before
|
||||
seeking the founder's separate concrete approval. Values stay out of Hub/Git/chat,
|
||||
argv and logs. Existing verifier/requester values must not be reused.
|
||||
|
||||
**Done 2026-10-05.** The founder resolved `632a8893-0d6a-4591-a50b-40bbdb798f32`.
|
||||
The custody boundary is approved: platform owns OpenBao client-secret custody
|
||||
and issuer-side delivery, and secrets-engine owns the mode-0600 file outside
|
||||
every worktree. The owner packet is still coordinates. This approval does not
|
||||
register the client, generate a secret, or deploy.
|
||||
|
||||
## Prepare and approve the deployment-owned registration operation
|
||||
|
||||
```task
|
||||
id: KEY-WP-0037-T03
|
||||
status: done
|
||||
priority: high
|
||||
needs_human: true
|
||||
decision_id: caafe4be-4f68-47b4-9567-316d47b94992
|
||||
blocking_reason: "Custody boundary 632a8893 is approved. Registration merge and rollout still need an exact reviewed revision and a separate live go. Opening caafe4be does not deploy."
|
||||
state_hub_task_id: "52f03e39-d05b-5da5-85df-e28c059430e4"
|
||||
```
|
||||
|
||||
Coordinate source registration merge and the single new env secretKeyRef with
|
||||
NetKingdom's `sso-mfa/k8s/keycape/deployment.yaml` and owner rollout implementation.
|
||||
An exact reviewed source revision, image digest, config preservation test,
|
||||
synthetic issuance/denial verification and founder live go are required.
|
||||
Use an idempotent exact-match merge: absence permits adding only this client;
|
||||
matching client permits noop; duplicates or drift fail closed. Preserve signing
|
||||
key, unrelated clients, existing policy and confidential config bytes.
|
||||
No deployment changes are authorized by this source plan.
|
||||
|
||||
**Done 2026-10-07 under live go `caafe4be`.**
|
||||
- Custody (decision `2ab717e1`): KV v1 written with cas=0.
|
||||
- ESO amendment `1fdd993b`; the sso Secret is synced.
|
||||
- NK-WP-0046 (`1fbb8db`): env binding, then the exact-match config add
|
||||
(rv 71471711 to 71655453, unrelated bytes preserved), then a restart on image
|
||||
6f79a2af.
|
||||
|
||||
**Prepared 2026-10-06 (source only).** NetKingdom NK-WP-0046 (`a1e7302`) holds
|
||||
the exact-match single-client merge helper, its rollback and the proposed env
|
||||
patch. secrets-engine SECRETS-WP-0012 (`a3897c2`) names the consumer file.
|
||||
Platform CCR-2026-0033 (`df24a77`, still proposed) holds the KV path
|
||||
`platform/workloads/keycape/secrets-engine-openbao`, the sso-only ESO and the
|
||||
attended custody script; its approval is RPF-WP-0035-T09. The live order is
|
||||
custody run, then issuer Secret, env patch, this merge and a restart. Nothing
|
||||
is live. The founder keeps the deployed image (NK-WP-0046-T02, 2026-10-06).
|
||||
Revised the same day: the value lives only in OpenBao (ops-mason MASON-WP-0009)
|
||||
and has no consumer file. The custody approvals A1-A3 are decision
|
||||
`2ab717e1-7881-491e-aed4-28946550c289`.
|
||||
|
||||
## Verify actual issuance and publish non-secret owner receipt
|
||||
|
||||
```task
|
||||
id: KEY-WP-0037-T04
|
||||
status: done
|
||||
priority: high
|
||||
depends_on:
|
||||
- KEY-WP-0037-T03
|
||||
blocking_reason: "Live issuance proof waits on the registration operation (T03)."
|
||||
state_hub_task_id: "40b80bcd-243d-5bf8-ba18-b992e3c5f8f7"
|
||||
```
|
||||
|
||||
After authorized registration and custody, verify issuer/JWKS signature, subject,
|
||||
audience, principal_type, tenant, roles, scope and 900-second lifetime; refuse
|
||||
wrong credential/excess scope and preserve existing human login. Record only
|
||||
booleans and identities, immutable image/source coordinates and custody binding
|
||||
metadata. Hand off to RPF-WP-0035-T02 for isolated OpenBao metadata provisioning,
|
||||
claim/expiry/use-limit denial and self-revocation proof. Never report an example
|
||||
registration, discovery metadata or source test as live acceptance.
|
||||
|
||||
**Done 2026-10-07.** `keycape verify-client` passed all 10 checks:
|
||||
- issuer, JWKS signature and claims (`service:secrets-engine`, tenant:platform,
|
||||
role secrets-engine);
|
||||
- no excess scope;
|
||||
- `openbao:admin` and a wrong secret refused.
|
||||
|
||||
The founder's KeyCape login after the restart also proved the CCR-2026-0034
|
||||
operator reader (net-kingdom-admins, aal2). Receipt:
|
||||
`docs/evidence/2026-10-07-secrets-engine-openbao-issuance.json`. The 900s lifetime
|
||||
was not measured. Handed to RPF-WP-0035-T02 for the OpenBao JWT role and login
|
||||
proof.
|
||||
|
|
@ -0,0 +1,212 @@
|
|||
---
|
||||
id: KEY-WP-0038
|
||||
type: workplan
|
||||
title: "Forgejo as a NetKingdom OIDC client, so the forge can close"
|
||||
domain: infotech
|
||||
repo: key-cape
|
||||
status: active
|
||||
flavor: implementation
|
||||
owner: claude-code
|
||||
topic_slug: railiance
|
||||
created: "2026-10-08"
|
||||
updated: "2026-10-16"
|
||||
depends_on: []
|
||||
related_repos:
|
||||
- prj-forgejo-org-refactor
|
||||
- railiance-apps
|
||||
- railiance-platform
|
||||
state_hub_workstream_id: "098e3e2c-a138-560e-b2d3-3a15eb49d8a9"
|
||||
---
|
||||
|
||||
# KEY-WP-0038 - Forgejo as a NetKingdom OIDC client, so the forge can close
|
||||
|
||||
## Why
|
||||
|
||||
`forgejo.coulomb.social` is closing: private by default, no anonymous access
|
||||
(prj-forgejo-org-refactor ORGREF-WP-0002, decision
|
||||
`decisions/forge-visibility-policy.md`). The founder's condition is that Forgejo
|
||||
sign-in runs through NetKingdom **before** anything closes, so that every human,
|
||||
agent and service reader has a governed identity rather than an ad-hoc local
|
||||
account. This plan is ORGREF-WP-0002-T04. Its Forgejo-side counterpart is
|
||||
railiance-apps `RAPPS-WP-0016` (ORGREF-WP-0002-T05), which owns the Forgejo
|
||||
Helm release.
|
||||
|
||||
## Boundaries
|
||||
|
||||
- Registration follows the existing human browser-client pattern
|
||||
(`docs/approval-engine-provisioning-request.yaml`, `human_registration`) and the
|
||||
client fields validated in KEY-WP-0028. Redirect URIs are exact, never
|
||||
wildcards.
|
||||
- The client secret goes to OpenBao through railiance-platform custody. No secret
|
||||
value in git, State Hub, logs or chat.
|
||||
- Founder guardrail for the whole closure: tighten gradually, never lock anyone
|
||||
out, never risk assets. Nothing in this plan changes who can read the forge
|
||||
today. It only makes the NetKingdom path available.
|
||||
|
||||
## T01 — Define what Forgejo receives
|
||||
|
||||
```task
|
||||
id: KEY-WP-0038-T01
|
||||
status: done
|
||||
priority: high
|
||||
state_hub_task_id: "5f019d13-1fa3-5b88-a27a-75a3339ca96e"
|
||||
```
|
||||
|
||||
Write the claim contract Forgejo consumes, as a non-secret request packet under
|
||||
`docs/`:
|
||||
|
||||
- issuer `https://kc.coulomb.social`; confidential client `forgejo`; authorization
|
||||
code with PKCE; scopes `openid profile email groups`
|
||||
- redirect URI
|
||||
`https://forgejo.coulomb.social/user/oauth2/netkingdom/callback`. The
|
||||
authentication-source name `netkingdom` must match railiance-apps'
|
||||
configuration exactly.
|
||||
- subject and username: canonical directory subject, plus a stable
|
||||
`preferred_username` that Forgejo can match to the existing local accounts
|
||||
(founder and agent accounts) for linking
|
||||
- `groups` naming the Forgejo organisations and teams to map to (for example
|
||||
`forge:coulomb:owners`, `forge:coulomb:readers`), and `principal_type` so that
|
||||
human and service principals stay distinguishable
|
||||
- MFA: forge administrators and owners require assurance with a fresh second
|
||||
factor; plain readers follow the client-aware MFA policy (KEY-WP-0008)
|
||||
|
||||
Acceptance: the founder accepts the packet. The group names are agreed with
|
||||
railiance-apps.
|
||||
|
||||
2026-10-08: packet drafted at `docs/forgejo-oidc-client-request.yaml`. It covers a
|
||||
confidential client `forgejo` with PKCE and `mfaRequired: true`, the exact
|
||||
callback, scopes, a custody path, the claims as emitted at this revision, new
|
||||
LLDAP groups `forge-admins`, `forge-coulomb-owners` and `forge-coulomb-readers`
|
||||
with a required-claim gate, no automatic account creation, and linking of local
|
||||
accounts. It also proposes that agents and services use scoped tokens bound to
|
||||
service identities, not browser sign-in.
|
||||
|
||||
2026-10-08: accepted by the founder (in session). railiance-apps' RAPPS-WP-0016
|
||||
uses the same authentication-source name `netkingdom` and the same group names,
|
||||
so the agreement condition holds. Before T02, the LLDAP groups `forge-admins`,
|
||||
`forge-coulomb-owners` and `forge-coulomb-readers` must exist, with the founder
|
||||
in the first two.
|
||||
|
||||
## T02 — Register the client and hand over its secret
|
||||
|
||||
```task
|
||||
id: KEY-WP-0038-T02
|
||||
status: wait
|
||||
depends_on: [KEY-WP-0038-T01, NK-WP-0048-T06]
|
||||
blocking_reason: "Registration runs as the first KnownSecurityCase of type oidc-browser-relying-party (NK-WP-0048-T06), not as a hand-built rollout."
|
||||
priority: high
|
||||
state_hub_task_id: "ddcfb482-8f33-5c81-9ce8-84be8fa5dc30"
|
||||
```
|
||||
|
||||
**Changed 2026-10-08 (founder direction):** no case-specific helper script.
|
||||
Registration is the first case of the SecurityCaseType `oidc-browser-relying-party`
|
||||
(net-kingdom NK-WP-0048, canon `security-case-types_v0.1`). The parameters
|
||||
accepted in T01 become the case; ops-mason materializes it (MASON-WP-0010) and
|
||||
ops-warden follows through (WARDEN-WP-0044). The registration capability is
|
||||
net-kingdom's (`net-kingdom.keycape-client-registration`); key-cape's part is its
|
||||
field rules and reviewing the type's composition.
|
||||
|
||||
The original intent below still describes what must result.
|
||||
|
||||
Register `forgejo` from the packet. Mint the client secret straight into custody
|
||||
(OpenBao path `platform/workloads/keycape/forgejo`, field `CLIENT_SECRET`, derived
|
||||
by the case type since net-kingdom 074b3a0; custody owner railiance-platform,
|
||||
consumers KeyCape via ESO and Forgejo). Record a receipt with no
|
||||
secret value.
|
||||
|
||||
Acceptance: discovery metadata lists the client's redirect URI. The secret is
|
||||
readable by Forgejo's custody path only.
|
||||
|
||||
2026-10-10: key-cape reviewed the type's composition
|
||||
(`docs/oidc-browser-relying-party-type-review.md`). net-kingdom fixed the findings
|
||||
in `61ab6bc`, a 1.0 patch: redirects with `?` or `#` refused, the groups scope
|
||||
required, and descriptions corrected. A new 1.1 (`e2174ce`, founder go) adds the
|
||||
`consumer-enforces-groups` verification. For Forgejo, that is the required-claim
|
||||
setting railiance-apps configures. `security-cases/forgejo-netkingdom-oidc.yaml`
|
||||
is re-pinned to @1.1, with parameters unchanged. KeyCape added `keycape
|
||||
check-config` (`c528daa`), which register-client runs before the restart. T02 still
|
||||
waits on NK-WP-0048-T06, which needs both executors' light paths (MASON-WP-0010-T03,
|
||||
WARDEN-WP-0044-T03).
|
||||
|
||||
### Exact offline checker owner review — 2026-10-16
|
||||
|
||||
KeyCape owner review under KEY-WP-0038-T02 endorses only the offline config
|
||||
validation behavior of source `3c71226a1a7b8a2bdb710e9c497e1a1f7f8a3987`,
|
||||
`src` tree `f0010b9cab17dbc3a787628a29657d98b900320f`, compiled artifact
|
||||
`sha256:be37738fe1c08259fb4f9ca0daf0f9301bfffc237e5bb38435525dfbf11ccff5`.
|
||||
The exact source/archive, 108 source files, 9876 cached Go 1.23.0 toolchain
|
||||
files and all ten selected module trees matched the candidate closure. Fourteen
|
||||
actual artifact checks and the cmd/config/policy Go tests passed using only
|
||||
synthetic inputs. The check dispatches before private-key loading, upstream
|
||||
adapter construction or server startup and uses placeholder client secrets.
|
||||
|
||||
[Owner review](../docs/offline-checker-owner-review-2026-10-16.md) records the
|
||||
exact evidence and limits: non-secret portal/logout URL environment overlays,
|
||||
optional/nonempty env-name assertion and policy-store assertion, permissive YAML
|
||||
loading, and no key/custody/readiness or authentication proof. It does not endorse
|
||||
the caller's inherited environment, executable storage/custody, the NetKingdom
|
||||
descriptor/type, Warden admission or any browser/native identity. Parent review
|
||||
identified caller environment inheritance; NetKingdom owns its correction and
|
||||
regression checks. T02 remains `wait`; T03 and all live acceptance gates remain
|
||||
unchanged. No live config, credentials, cluster objects or paid calls were used.
|
||||
|
||||
## T03 — Prove the claims for each kind of identity
|
||||
|
||||
```task
|
||||
id: KEY-WP-0038-T03
|
||||
status: wait
|
||||
depends_on: [KEY-WP-0038-T02]
|
||||
blocking_reason: "Claims are verified against the registered client."
|
||||
priority: high
|
||||
state_hub_task_id: "40ddaa29-7245-508c-ad48-ddc063e25115"
|
||||
```
|
||||
|
||||
Before Forgejo uses the client, verify the issued ID token and UserInfo for one
|
||||
human (the founder, with MFA), one agent identity and one service identity:
|
||||
subject, `preferred_username`, `groups`, `principal_type`, assurance. Record the
|
||||
claims, minus tokens, as evidence.
|
||||
|
||||
Decide with railiance-apps whether agents and services sign in to Forgejo at
|
||||
all, or receive scoped Forgejo tokens bound to a NetKingdom service identity
|
||||
(ORGREF-WP-0002-T06). Record the decision.
|
||||
|
||||
Acceptance: evidence for all three principals; the agent and service decision is
|
||||
recorded. Then hand over to RAPPS-WP-0016.
|
||||
|
||||
## T04 — Implement the `keycape-client` entry point
|
||||
|
||||
```task
|
||||
id: KEY-WP-0038-T04
|
||||
status: cancel
|
||||
priority: high
|
||||
state_hub_task_id: "583cf1f1-16dc-515f-83bc-1efc45024a89"
|
||||
```
|
||||
|
||||
**Cancelled 2026-10-08: moved to net-kingdom NK-WP-0048-T09 (done).** The live
|
||||
registration machinery (contained kubectl, cluster and issuer pins) already lives
|
||||
in net-kingdom `sso-mfa/k8s/keycape/`, where KeyCape is deployed; a copy here
|
||||
would drift. The entry point is `net-kingdom/sso-mfa/k8s/keycape/keycape-client.py`
|
||||
and the declaration is `net-kingdom.keycape-client-registration`; key-cape's draft
|
||||
declaration is removed. key-cape still owns the client field rules (canonical
|
||||
model) and their enforcement at authorization time.
|
||||
|
||||
`capabilities/playbooks/key-cape.oidc-client-registration.yaml` (contract PASS,
|
||||
`maturity: planned`) declares client registration as a playbook capability, so
|
||||
that the SecurityCaseType `oidc-browser-relying-party` (net-kingdom NK-WP-0048)
|
||||
can compose it. Implement the entry point it names, `tools/keycape-client/`:
|
||||
|
||||
- `keycape-client register --client-file <rendered-client.yaml>` with modes
|
||||
`inspect`, `dry-run`, `apply` and `remove`; adds, updates or removes exactly one
|
||||
client in the live registry; idempotent; never prints or writes secret values;
|
||||
a confidential client's secret is read from its custody reference
|
||||
- one implementation replacing the per-client helpers in net-kingdom
|
||||
`sso-mfa/k8s/keycape/` (register-coulomb-social, portal-client-rollout,
|
||||
vergabe-client-rollout, secrets-engine-openbao-client-rollout), keeping their
|
||||
safeguards (byte-preserving merge, compare-and-swap, cluster pin, safe receipts)
|
||||
and their tests as regression cases
|
||||
- client field validation by the KEY-WP-0028 rules
|
||||
- then set the declaration's `maturity` to `implemented`
|
||||
|
||||
Longer term, loading clients from a non-secret registry with secrets referenced
|
||||
from custody would remove the type's only attended step (see the type README,
|
||||
"Attended steps").
|
||||
|
|
@ -0,0 +1,368 @@
|
|||
---
|
||||
id: KEY-WP-0039
|
||||
type: workplan
|
||||
title: "Negative-check tokens for the secrets-engine OpenBao JWT role"
|
||||
domain: infotech
|
||||
repo: key-cape
|
||||
status: active
|
||||
flavor: implementation
|
||||
owner: claude-code
|
||||
topic_slug: netkingdom
|
||||
created: "2026-10-10"
|
||||
updated: "2026-10-17"
|
||||
depends_on: []
|
||||
related_repos:
|
||||
- railiance-platform
|
||||
- secrets-engine
|
||||
state_hub_workstream_id: "09c3bddf-6058-5603-8488-cccdb7be4f86"
|
||||
---
|
||||
|
||||
# KEY-WP-0039 - Negative-check tokens for the secrets-engine OpenBao JWT role
|
||||
|
||||
## Why
|
||||
|
||||
CCR-2026-0038 (railiance-platform RPF-WP-0035-T02) requires the OpenBao role
|
||||
`secrets-engine-openbao` on `auth/keycape-services` to refuse JWTs with a wrong
|
||||
`aud`, `sub`, `tenant`, `principal_type`, `roles` or `scope`, a coding-agent JWT
|
||||
and an expired JWT. The positive login proof passed on 2026-10-10 (secrets-engine
|
||||
`docs/evidence/2026-10-10-keycape-openbao-probe.json`). railiance-platform asked
|
||||
whether KeyCape can issue the negative tokens without touching the
|
||||
`secrets-engine` registration.
|
||||
|
||||
KeyCape signs only what a registration declares. It has no way to mint a token
|
||||
with arbitrary claims, and adding one would create a forging path in the issuer.
|
||||
So the negative tokens must come from real, separate registrations that differ
|
||||
from `secrets-engine` in exactly one property each.
|
||||
|
||||
## Boundaries
|
||||
|
||||
- The `secrets-engine` registration is not changed.
|
||||
- Probe clients are confidential `client_credentials` clients with the minimum
|
||||
60-second lifetime, scopes that grant nothing, and secrets minted into custody
|
||||
like any other client. They are removed after the proof.
|
||||
- The probe script prints only accept or refuse booleans per case, never tokens or
|
||||
secrets. It runs attended.
|
||||
|
||||
## T01 — Define the probe registrations
|
||||
|
||||
```task
|
||||
id: KEY-WP-0039-T01
|
||||
status: done
|
||||
priority: medium
|
||||
state_hub_task_id: "4d06b059-3768-53bb-83a4-a9a71c0850b8"
|
||||
```
|
||||
|
||||
Write a non-secret request packet under `docs/` with one probe client per claim
|
||||
mismatch, each identical to `secrets-engine` except for:
|
||||
|
||||
- `aud`: a different access-token resource audience
|
||||
- `sub`: a different service subject
|
||||
- `tenant`: a tenant other than `platform`
|
||||
- `roles`: a role other than `secrets-engine`
|
||||
- `scope`: a scope outside the role's bound scope
|
||||
|
||||
Two cases need no probe client. A service token always carries
|
||||
`principal_type: service` (`src/internal/server/oidc/token.go`), so the wrong
|
||||
`principal_type` case uses a human access token from an attended login. The
|
||||
coding-agent case uses the existing `codex-railiance-platform` registration (role
|
||||
`coding-agent`, `docs/openbao-service-auth-contract.md`) if it is registered live;
|
||||
T01 confirms that.
|
||||
|
||||
The expired-JWT case reuses any probe client: request a token, wait past its
|
||||
60-second lifetime, then present it.
|
||||
|
||||
Acceptance: railiance-platform agrees the packet covers every refusal that
|
||||
CCR-2026-0038 names.
|
||||
|
||||
2026-10-10: railiance-platform agreed that the case list covers every
|
||||
CCR-2026-0038 claim negative. The remaining CCR checks (capabilities-self deny, no
|
||||
provider fallback) are theirs and secrets-engine's. Packet written at
|
||||
`docs/openbao-negative-probe-clients.yaml`. It departs from the agreed list in two
|
||||
ways, both sent back for re-agreement:
|
||||
|
||||
- **Expired case.** A token from another probe already fails a claim, so its
|
||||
refusal does not show that expiry was checked. It needs a sixth client,
|
||||
`openbao-probe-expiry`, identical to `secrets-engine-openbao` in every claim. That
|
||||
makes it a second credential able to log in as secrets-engine for the session.
|
||||
OpenBao's `expiration_leeway` (150s by default) also extends the wait.
|
||||
- **Audience pin.** A service token's `aud` is its `clientId` unless `audience` is
|
||||
set. Every probe except the aud probe therefore pins
|
||||
`audience: secrets-engine-openbao`, so it fails only on its own claim.
|
||||
|
||||
Condition (a), no OpenBao custody, holds. The values still have to reach KeyCape's
|
||||
environment, because KeyCape resolves `secretRef` at startup. The packet uses a
|
||||
transient Kubernetes Secret that is deleted in the same session.
|
||||
|
||||
## T02 — Register the probe clients, run the attended probe, then remove them
|
||||
|
||||
```task
|
||||
id: KEY-WP-0039-T02
|
||||
status: wait
|
||||
depends_on: [KEY-WP-0039-T01, KEY-WP-0038-T02, KEY-WP-0038-T03]
|
||||
blocking_reason: "Ordered identity gate: Forgejo first SecurityCase registration/claims proof, then NetKingdom registry session and attended human/coding-agent custody; registration authorization already resolved."
|
||||
priority: medium
|
||||
state_hub_task_id: "03da4c38-1dac-53b1-8b0b-e697df48e9d3"
|
||||
```
|
||||
|
||||
2026-10-11: requalified — live registration go caafe4be was already resolved; owner authorization present. See the-custodian docs/decisions/2026-10-11-security-unblock-decisions.md.
|
||||
|
||||
Write the attended script, which prints booleans only.
|
||||
|
||||
2026-10-10: script written at `scripts/openbao_negative_probe.py`, with tests in
|
||||
`scripts/test_openbao_negative_probe.py`. It meets condition (b): one refused
|
||||
boolean per case plus the refusal class (`claim_mismatch`, `expired`,
|
||||
`not_service_principal`), and no token, secret, claim value or OpenBao error text.
|
||||
A transport failure or an unexpected response is reported as `inconclusive`, never
|
||||
as a refusal. A token that OpenBao accepts is revoked at once and fails the run.
|
||||
Still waiting: railiance-platform's re-agreement on the two departures above, and
|
||||
an attended registry session with net-kingdom. Register the clients
|
||||
through the normal registration path, hand the run to railiance-platform, record
|
||||
a value-free receipt in `docs/evidence/`, and deregister the clients afterwards.
|
||||
|
||||
Acceptance: every case is refused, the receipt is committed, and the probe clients
|
||||
are gone.
|
||||
|
||||
|
||||
2026-10-11 source preparation: T01 remains progress because the exact expiry
|
||||
client and audience-pin amendments require platform-owner re-agreement; the
|
||||
prior agreement covered the earlier case list, not this revised packet. The
|
||||
prepared runner revision adds a valid expiry positive control and immediate
|
||||
revoke, exact decoded claim-isolation preflight (not signature evidence),
|
||||
semantic refusal classes, bounded expiry TTL and redirect refusal. Seventeen
|
||||
local tests pass; original-source semantic regressions demonstrate two false
|
||||
successes. See `docs/openbao-negative-probe-session-proposal.md` for exact owner
|
||||
returns, live authority, effective leeway, custody boundaries and cleanup. No
|
||||
live token, registry or OpenBao action occurred. T02 continues to wait for owner
|
||||
re-agreement plus separate attended live authorization. MASON-WP-0009-T05
|
||||
operator/ESO capability and nonmember checks remain independent acceptance.
|
||||
|
||||
2026-10-11: Platform independently re-agreed the final amended design (session proposal SHA25623f13d2a5a4204f749f35c5d44ef39d213838cd2fce1c36fb4775254ef1c7f09). Original conditional review and narrow confirmation are retained in railiance-platform/docs/reviews/2026-10-11-keycape-openbao-negative-session-owner-review*. Source acceptance T01 is complete; actual registry/leeway/readiness, founder live go, negative/cleanup and separate capability/no-fallback obligations remain T02 and owner plans.
|
||||
|
||||
|
||||
2026-10-17 Custodian coordinator finalization review (not a KeyCape formal owner
|
||||
acknowledgment): the [infrastructure assessment](../../the-custodian/docs/changes/netkingdom-target-2026-10-17/key39-infra-finalization-r1/ASSESSMENT.md)
|
||||
confirms all 14 executable/test/producer-decision pins and three Platform source
|
||||
pins still match. Source reviews remain complete: T01/T03 done, T02 wait. Existing
|
||||
source acceptance remains valid. Resolved registration go caafe4be covers only
|
||||
the original secrets-engine-openbao client (KEY-WP-0037-T03, deployed 6f79a2af,
|
||||
NK-WP-0046 exact-match helper); it does not authorize new probe clients or
|
||||
coding-client custody, and no renewed original-client approval is requested.
|
||||
The standing attended rule remains separate, for reviewed commands within
|
||||
existing scope; no new protocol or blanket approval request is introduced. The
|
||||
remaining sequence is KEY-WP-0038-T02/T03 first-case registration/claims proof,
|
||||
admission of the existing coding-client proposal with sanitized owner readiness
|
||||
returns, then one attended negative/revoke/cleanup receipt committed with probe
|
||||
clients removed. No native acceptance or credential/registration action is
|
||||
inferred from this coordinator review.
|
||||
|
||||
|
||||
## KeyCape issuer-source compatibility inspection for lifecycle v2
|
||||
|
||||
```task
|
||||
id: KEY-WP-0039-T03
|
||||
status: done
|
||||
priority: medium
|
||||
state_hub_task_id: "54d37ad8-2352-51c2-bb2e-af6070dbbd73"
|
||||
```
|
||||
|
||||
2026-10-11: Completed KeyCape's own issuer-source inspection for
|
||||
KEY-WP-0039-T02/attended-lifecycle-v2, exact manifest SHA256
|
||||
6fc0fe47f99a97c11c6e7538f5ea02054335df7d46055d3f84bed4e194aeaaed.
|
||||
Read AGENTS.md, governing INTENT.md, current client-credentials claim source,
|
||||
registration fragments, native caller-authentication commands and frozen v2
|
||||
issuer transport/probe wiring. Seventeen unchanged runner tests pass locally.
|
||||
This task completes only issuer-source inspection; the resulting narrow
|
||||
source acknowledgment is in docs/reviews/2026-10-11-key39-lifecycle-v2-keycape-source-ack.json (retained frozen prior acknowledgment).
|
||||
T01 stays done and T02 stays open for actual native registration, token input,
|
||||
refusal and cleanup proof. No Secret, token, credential or native environment was accessed; no owner
|
||||
checkout was changed during this source inspection. Owner source files were
|
||||
read for the bounded issuer compatibility check.
|
||||
|
||||
Current token.go:306-309 returns HTTP 401 invalid_profile_usage with
|
||||
feature=client_id for a removed confidential client; wrong-secret
|
||||
feature=Authorization cannot count as removed-registration evidence. The
|
||||
proposal and packet comments are narrowly corrected against that current
|
||||
issuer contract. Prior T01/source re-agreement history is preserved; this source
|
||||
acknowledgment supplies no NetKingdom runtime-owner review or founder live go.
|
||||
|
||||
The private token-producer handoff remains a real execution gap under T02.
|
||||
Existing keycape login/service-token commands require a new private output
|
||||
file; login also needs a concrete admitted public PKCE client/callback and
|
||||
attended browser/MFA. The lifecycle expects an in-memory private stdin object
|
||||
containing human_token and coding_agent_token, but no reviewed file-to-process
|
||||
or process-to-process producer, admitted human client/callback, custody-injected
|
||||
coding-agent source, native placement or producer cleanup receipt has been
|
||||
provided. No unattended token producer or admitted secret route is invented.
|
||||
Resolve those exact owner contracts before founder native approval; existing
|
||||
static registration is not live token custody or producer admission.
|
||||
|
||||
|
||||
2026-10-11 same T03 source-inspection refinement for lifecycle V4: completed
|
||||
KeyCape issuer-facing inspection before the new formal acknowledgment in
|
||||
docs/reviews/2026-10-11-key39-lifecycle-v4-keycape-source-ack.json. Exact V4
|
||||
manifest SHA256 d079f85c47d5c2635e1ee633ea4d1346b1737ce2be9ca273f22a38e620f418d8,
|
||||
executor b4687c2d07819c43b45d0cddcad0488b62eb49175b2a06a43f7806a0838d3a4d.
|
||||
NetKingdom's independent V4 source review is approved, receipt SHA256
|
||||
4f4498203a31bd46dbc3715c0df1cbb9eee63bed5b2c1baf430ff3c4a37c13cb.
|
||||
The V2/V3 unsuccessful reviews and earlier KeyCape acknowledgment remain
|
||||
retained as one correction trial; they are not extra scored successes.
|
||||
|
||||
V4 retains the unchanged issuer runner and six-client claim design, and fixes
|
||||
finite/nonboolean windows, true total request deadlines, late-known OpenBao
|
||||
session private revoke/refusal and guarded bounded final Secret deletion.
|
||||
The issuer-facing acknowledgement covers only stopping late token exchanges,
|
||||
claim source/shape and preserving token cleanup failure/unknown outcomes; it
|
||||
does not replace NetKingdom runtime or Platform backend acceptance. Tests: 41
|
||||
supplied lifecycle, 17 unchanged runner and 17 independent owner checks pass
|
||||
locally. No native tokens, credentials, issuer mutations or live cleanup were
|
||||
performed. T01 stays done; T02 stays open and the genuine private token-producer
|
||||
handoff remains its next source prerequisite before actual founder native go.
|
||||
|
||||
|
||||
2026-10-11 same T03 source-inspection refinement for lifecycle V5: completed
|
||||
KeyCape's own current issuer-source/claim/cleanup-contract inspection before
|
||||
any new formal acknowledgment. Current token.go:306-309 still distinguishes
|
||||
removed-client invalid_profile_usage feature=client_id from wrong-secret
|
||||
feature=Authorization. The six-client design, audience source and expiry
|
||||
positive control remain unchanged, and the original runner's 17 tests pass.
|
||||
Exact V5 manifest SHA256
|
||||
d1f997624db46693a7126a6eb6435f6b3a353d5bd67dcc8a539683e4b7147285;
|
||||
executor 3bcceebc845b17492040c76223d77088257c547a2b890198e7b5c2b04a0cd360.
|
||||
V5 has 46 passing supplied lifecycle checks. It adds a single exceptional
|
||||
response-close abort under a fixed20ms cap clipped to nonresettable aggregate
|
||||
cleanup, and to positive original request time remaining, with expired aggregate
|
||||
zero calls, fixed private errors and truthful known-session revoke/unknown
|
||||
outcomes. This inspection covers issuer-facing token lifetime and claim
|
||||
interfaces only; NetKingdom and Platform independently own their runtime and
|
||||
backend review decisions. Previous V2/V3 Net source refusals and Platform V4
|
||||
exceptional-close refusal remain retained; KeyCape's V2/V4 acknowledgments are
|
||||
historical narrow source inspections, never aggregate native approval.
|
||||
T01 remains done, T02 open. No native actions or credentials occurred. The real
|
||||
private token-producer/client/callback/coding-agent custody/cleanup handoff gap
|
||||
stays the next prerequisite; no unattended admission is inferred.
|
||||
|
||||
Exact independent V5 source decisions were then verified: NetKingdom approved
|
||||
receipt SHA256 32a62bd1ca1bd7311965d016d4d6a6e4d9177f3423c63add436d9d309865eacc
|
||||
(46 supplied +17 runner +21 independent checks); Platform approved receipt
|
||||
SHA256 ba872dc53061b1dcca9dea1e8897597c394c1f9365e0fc49ee6f2095f57f11e0
|
||||
(46 supplied +5 independent +17 previously verified runner checks). Those are
|
||||
foreign owners' own source decisions, not KeyCape runtime/backend reviews or
|
||||
founder native authority. Formal KeyCape bounded issuer acknowledgment follows
|
||||
in docs/reviews/2026-10-11-key39-lifecycle-v5-keycape-source-ack.json.
|
||||
|
||||
|
||||
2026-10-11 T02 continuing source preparation: private producer decision packet
|
||||
`KEY-WP-0039-T02/private-producer-handoff-v1` stages supported existing CLI
|
||||
flows, selected existing netkingdom-bootstrap-console literal-loopback human
|
||||
client subject to owner purpose/MFA/listener admission, and the existing
|
||||
codex-railiance-platform source identity subject to actual live/custody/consumer
|
||||
admission. No existing coding-agent delivery receipt was found; AppRole tokens
|
||||
do not substitute for issuer JWTs. A bounded pipe-only adapter for the current
|
||||
CLI's two caller-owned private files has 18 passing synthetic checks, with
|
||||
identity-guarded explicit file consumption and fixed value-free failure output.
|
||||
Decoded claim shape does not prove signatures or authenticated admission.
|
||||
See docs/openbao-negative-token-producer-decision.md and .json for exact owner
|
||||
choices and missing receipts. The exact trusted workstation-to-node launcher,
|
||||
private-file allowance and railiance01 Bao route/public-health guard still need
|
||||
source review and founder disposition before any token/temporary credential/
|
||||
mutation/restart. No registration, custody, login, native action or credential
|
||||
request occurred. V5 and failed review histories retained; T01 stays done and
|
||||
T02 open. No new work record or native acceptance is inferred.
|
||||
|
||||
|
||||
2026-10-11 same T02 source-preparation correction for
|
||||
KEY-WP-0039-T02/private-producer-handoff-v2: NetKingdom's exact V1 consumer
|
||||
refusal remains recorded (no child-ready gate, stdio alias, non-atomic unlink).
|
||||
V2 has source-pinned private launch/ready handshake compatible with exact
|
||||
Net V9 manifest84542ddc: fresh nonce/source/envelope/health/window marker before
|
||||
ANY caller-token file load/consume/write; separate local data/control pipes
|
||||
reject kernel identity aliases of stdin/stdout/stderr. Adapter read/write budget
|
||||
only clips downward after readiness. 31 distinct producer/launcher synthetic
|
||||
checks and 74 compatible consumer supplied checks pass. No SSH/native/login or
|
||||
credential access was performed. Stat/unlink remains non-atomic and requires
|
||||
continuously exclusive sameUID custody; the retained race test is a custody
|
||||
violation counterexample, not a claim of repaired filesystem atomicity. Receipt
|
||||
keeps atomic delete/copy cleanup unverified and possible copies true. Exact
|
||||
trusted launcher/directSSH profile/private tmpfs allowance, selected human
|
||||
client/MFA purpose reuse and coding-agent registration/custody/delivery remain
|
||||
unadmitted owner choices. Native node route, role/leeway/window/founder decision
|
||||
and actual negative/cleanup acceptance remain pending. T01done and T02open; no
|
||||
new task or plan, and V1/V5-V8/current failure histories are not overwritten.
|
||||
|
||||
|
||||
2026-10-11 same T02 producer-preparation correction V3: Platform V2 pair
|
||||
source refusal RPF-KEY39-PAIR-V2-F01 is retained. Private write uncertainty
|
||||
now propagates into sticky remote consumer uncertainty before launcher early
|
||||
return; local SSH termination never proves remote no-effects/recovery. Actual
|
||||
full-payload then interrupted confirmation and4096-byte partialpipe failures
|
||||
are retained regressions. 33 distinct source checks pass. Exact Net V9 source
|
||||
bytes unchanged; new source reviews required, not implicit repin. Native
|
||||
client/MFA/coding-agent custody/transport/tmpfsfile and actualroute/session
|
||||
authority remain unadmitted. T01done/T02open; no new task/plan or native action.
|
||||
|
||||
|
||||
2026-10-11 same T02 producer-preparation V4: exact V3 Net consumer refusal
|
||||
NET-PRODUCER-V3-F01 retained. Actual CLI contract acquisition now bounded
|
||||
nofollow/nonblocking regular stable reads and one ORIGINAL5-second preparation
|
||||
budget across contract/source/envelope/SSHspawn/ready/file/delivery phases, not
|
||||
a renewed launcher allowance. 40 own source tests plus9 retained paired
|
||||
wrapper/child handshake regressions pass with synthetic/no native transport.
|
||||
V3stickyremoteunknown/full+partialdelivery regressions retained; Net V9 exact
|
||||
bytes unchanged. Prior issuer/custody/transport/file/route/readiness-Argo/role/
|
||||
maintenanceexception/founder choices remain unadmitted. No SSH/network/Secrets/
|
||||
credentials/native/owner checkout changes; no task/plan duplication. T01done
|
||||
and T02open; source correction is not native acceptance.
|
||||
|
||||
|
||||
2026-10-11 T02 source-design disposition checkpoint: founder accepted exact
|
||||
source memo `infd-20261011-key39-source-design-r1`, review
|
||||
`review-62626f54-0212-4684-9b45-0a7222d61957` version1 at `2026-10-11T17:19:01Z`.
|
||||
Disposition `disp-870f9c1b-0444-4216-ae7f-f5463d590e36`, approval
|
||||
`ca118afc-d746-4454-a5b9-9b387b120cd9`; authenticated person subject
|
||||
`uid=platform-root,ou=people,dc=netkingdom,dc=local`. Exact canonical public review URL:
|
||||
`https://decisions.coulomb.social/review?memo_id=review-62626f54-0212-4684-9b45-0a7222d61957`.
|
||||
Root's authenticated confirmed readback is
|
||||
`the-custodian/docs/evidence/2026-10-10-security-consolidation/key39-source-design-publication/founder-source-disposition-readback-r1.json`,
|
||||
SHA256 `453213194d605336e9c424976f1ac27691def39e225026f0a99628d1cfc97d1d`; observed
|
||||
`2026-10-11T17:30:47.080081+00:00`. Source commands SHA256
|
||||
`36e20813596f3ddbb86e01fd0b838867ece2f4916c5880305cf12cd61b567f89` and source inventory SHA256
|
||||
`aea196db9e513900d5e7165455d6e9c3dc68749a606dc219ec340ac595642cc0` bind the accepted source direction.
|
||||
|
||||
Acceptance covers recommended source preparation for existing bootstrap-console
|
||||
human-client purpose reuse, returning existing coding-agent custody admission or
|
||||
preparing a narrow owner proposal, proposed founder directSSH source profile,
|
||||
and conditional exclusive-owner tmpfs files. It does not establish actual
|
||||
registration/MFA/listener, coding-agent custody/delivery, transport/file admission,
|
||||
node-local Bao route, issuer/OpenBao role/leeway/maintenance readiness or fresh
|
||||
attended native go. The published choice documents remain historical exact
|
||||
pending proposals; this appended receipt records their later source disposition.
|
||||
T02 remains wait on external owner custody/admission and separate attended
|
||||
execution authorization. Source acceptance permits further source preparation;
|
||||
actual registry, token exchange, negative probe, revoke and cleanup remain pending. T01 and T03
|
||||
remain done. No native or credential action is authorized by this source receipt.
|
||||
See docs/proposals/2026-10-11-key39-next-execution-prerequisites.json for exact
|
||||
owner returns and safe metadata evidence needed before preparing a runnable
|
||||
attended execution proposal.
|
||||
|
||||
2026-10-11 ordered-goal qualification (T02 only): the final source runner already
|
||||
exists and its 17 local semantic tests pass. No new helper or source protocol is
|
||||
needed to repeat accepted preparation. Native execution follows the first
|
||||
Forgejo SecurityCase registration and claims proof (KEY-WP-0038-T02/T03);
|
||||
only those task metadata were checked, not wait-task bodies. NetKingdom owns the
|
||||
registry/env/restart session, KeyCape owns issuance/isolation, and Platform owns
|
||||
leeway/refusal/capability/no-fallback/cleanup proof. The live registration go is
|
||||
already recorded resolved; do not ask again. Attended human authentication and
|
||||
owner-held existing coding-agent custody go on the single attended checklist.
|
||||
No credentials, live registry/API changes or KEY-WP-0040 recovery work occurred.
|
||||
|
||||
2026-10-17 Platform owner returns (source-prepared, not admitted):
|
||||
railiance-platform `docs/proposals/2026-10-17-key39-t02-owner-returns.md`
|
||||
(commit `0a9617a`). The coding client `codex-railiance-platform` has no
|
||||
admission, custody or delivery record. The existing narrow proposal
|
||||
`docs/proposals/2026-10-11-key39-coding-client-custody-proposal.json` (`9460f6f`)
|
||||
remains the one to admit, so the coding-agent case stays unrunnable until owners
|
||||
admit it. The role source (`openbao/auth/secrets-engine-jwt-role.json`) matches
|
||||
the packet's claim design. It declares no `expiration_leeway`, so the expiry
|
||||
probe must assume OpenBao's 150s default until an attended sanitized read
|
||||
confirms the live value. The node-local Bao origin is not declared in source and
|
||||
also needs that attended read. T02 stays wait.
|
||||
|
|
@ -0,0 +1,162 @@
|
|||
---
|
||||
id: KEY-WP-0040
|
||||
type: workplan
|
||||
title: "Fix findings from the first attended MFA run (factor recovery preview, OTP prompt help)"
|
||||
domain: infotech
|
||||
repo: key-cape
|
||||
status: finished
|
||||
owner: claude-code
|
||||
topic_slug: netkingdom
|
||||
created: "2026-10-11"
|
||||
updated: "2026-10-17"
|
||||
flavor: implementation
|
||||
depends_on: []
|
||||
state_hub_workstream_id: "a67f9d60-9b8f-5111-9fe5-9f64e631b1c3"
|
||||
---
|
||||
|
||||
From the attended run of 2026-10-11 (user-engine `docs/evidence/2026-10-11-mfa-attended-u05-u08.md`).
|
||||
U05–U07 passed. U08 is blocked by T01.
|
||||
|
||||
## Recovery preview rejects valid input (F6)
|
||||
|
||||
```task
|
||||
id: KEY-WP-0040-T01
|
||||
status: done
|
||||
priority: high
|
||||
state_hub_task_id: "b385602d-714a-5fdb-b40b-bd870420f28e"
|
||||
```
|
||||
|
||||
Operator `platform-root` (holds platform-operator, fresh AAL2) previewed login `tegwick`,
|
||||
reference `U08-2026-10-11` at `/platform/factor-recovery`. Every attempt returned `invalid_request`
|
||||
("Enter a valid login and support reference."). Both inputs match `[A-Za-z0-9_.@:/-]{1,150}`.
|
||||
The `factor-recovery` container in `mfa/privacyidea` logged nothing.
|
||||
|
||||
Candidate causes in `scripts/recovery_service.py` / `scripts/factor_recovery.py`:
|
||||
- the actor `sub` (KeyCape `user.ID`) failing `_recover`'s character rule;
|
||||
- a privacyIDEA serial failing it;
|
||||
- the request body differing from what is validated, e.g. form encoding through the portal.
|
||||
|
||||
Done when:
|
||||
- the failing check is identified and fixed with a regression test;
|
||||
- the sidecar logs the failing check (field name and error code, never values);
|
||||
- a preview for `tegwick` lists the active TOTP (serial suffix …E1D) without applying anything.
|
||||
|
||||
Then hand back to user-engine, which re-runs U08 (USER-WP-0028-T03). The fix and roll-out
|
||||
of the sidecar are blue lane under the build-mode change rule.
|
||||
|
||||
2026-10-12 source repair: LLDAP adapter returns entry.DN as user.ID and the token
|
||||
issuer emits that exact value as sub. Recovery incorrectly applied the login
|
||||
regex to actor, rejecting comma/equal characters. Two DN-shaped subject tests
|
||||
reproduce invalid_request against the old source. The repair validates the
|
||||
bounded printable ASCII actor separately, preserves exact ticket/audit binding,
|
||||
and keeps target/serial/realm/reference validation strict. Validation diagnostics
|
||||
emit only closed field names and error codes to stderr; provider logging stays
|
||||
disabled. Twenty recovery tests pass, including identity switching, malformed
|
||||
input, provider field failures, replay and mutation/audit guards. Go OIDC and
|
||||
LLDAP suites pass. No live factor was read or changed. T01 stays progress until
|
||||
the deployed authenticated preview succeeds and user-engine can rerun U08.
|
||||
|
||||
## Link the OTP prompt to lost-authenticator help (F3)
|
||||
|
||||
```task
|
||||
id: KEY-WP-0040-T02
|
||||
status: done
|
||||
priority: medium
|
||||
state_hub_task_id: "3ad155dd-15ef-5522-bdf9-c78832728553"
|
||||
```
|
||||
|
||||
The OTP input offers no way out for a user whose code is rejected or whose device is lost. Add
|
||||
"Code rejected or lost your authenticator?" linking to
|
||||
`https://users.coulomb.social/security` (the lost-authenticator section). The same link serves users
|
||||
who have no factor yet (the dead end noted in `mfa-attended-run.md`).
|
||||
|
||||
2026-10-12: source link added to the MFA challenge with noreferrer, preserving
|
||||
challenge state and requiring no query/token in the destination. Go OIDC tests
|
||||
pass. Runtime publication and attended journey verification remain open; T02
|
||||
is not represented as deployed.
|
||||
|
||||
2026-10-12 blue-lane runtime repair completed: immutable ConfigMap
|
||||
factor-recovery-01119187d90d7b76 replaced only the recovery-code volume through
|
||||
UID/resourceVersion CAS. Server dry-run proved no other pod-template change.
|
||||
privacyIDEA generation 11 is Ready; recovery health returns 200 and anonymous
|
||||
recovery is denied (403). All Go tests pass in the actual checkout. An early
|
||||
ready=false observation was retained while the rollout completed; no apply was
|
||||
replayed. Abort owner: key-cape; rollback restores prior immutable ConfigMap
|
||||
factor-recovery-79e2964c112f3688 with the same CAS helper. Receipt and exact
|
||||
proposal: the-custodian/docs/evidence/2026-10-12-netkingdom-security/.
|
||||
T01 remains progress for the founder's authenticated tegwick preview and U08.
|
||||
T02 is a local source edit only; its source/image publication remains pending.
|
||||
|
||||
2026-10-14: the MFA challenge render test now requires the lost-authenticator
|
||||
link after the OTP form, with rel="noreferrer" and no request state in the URL.
|
||||
T02 stays progress until that page is published and an attended journey sees it.
|
||||
|
||||
## Current publication and attended acceptance — 2026-10-16
|
||||
|
||||
The source-only publication statements above describe the October 12–14 state.
|
||||
They are superseded for T02: the October 15 founder-run publication recorded in
|
||||
`docs/operations.md` (Current image) and KEY-WP-0041-T02 delivered image
|
||||
`sha256:cdec9dd7c515f7e0a6169fc3fa560ee2cc47bf40d899755dec808c362f5ce010`
|
||||
from source `8c6c071`. That source includes the OTP help link commit `205a1c0`.
|
||||
The founder verified the image-only diff, server dry-run, Recreate rollout,
|
||||
Ready pod with zero restarts and discovery HTTP200. No additional image rollout
|
||||
is needed to make the existing T02 link available. This reconciliation makes
|
||||
no new live observation and does not infer attended acceptance from publication.
|
||||
|
||||
T01 still needs the actual authenticated preview; T02 still needs the actual
|
||||
OTP-page observation. Both remain progress. Resume the existing owner procedure
|
||||
`user-engine/docs/mfa-attended-run.md`, corrected by its October 11 evidence
|
||||
`user-engine/docs/evidence/2026-10-11-mfa-attended-u05-u08.md`:
|
||||
|
||||
1. In the real user-engine-portal OTP challenge, observe **Code rejected or lost
|
||||
your authenticator?**, follow it to `https://users.coulomb.social/security`,
|
||||
and confirm the rejected-code/lost-device guidance is reachable. Preserve no
|
||||
challenge URL, request state, cookie or OTP value in evidence. Record time,
|
||||
client, link text/destination and outcome. This supplies T02 acceptance.
|
||||
2. With platform-root's own fresh AAL2 browser session, open the existing
|
||||
`/platform/factor-recovery` form. Preview `tegwick` using the existing support
|
||||
reference `U08-2026-10-11`; inspect any existing reference before changing it.
|
||||
Confirm the current factor metadata and shared-identity warning. The October
|
||||
11 suffix was …E1D; a changed factor is a reason to reconcile current state,
|
||||
never to force the old selection. Record only time, preview outcome and serial
|
||||
suffix. This preview alone makes no factor change and supplies the remaining
|
||||
T01 preview evidence.
|
||||
3. Only in the separately attended recovery window, after the operator verifies
|
||||
the person and exact current scope, continue the existing U08 confirmation,
|
||||
audited disable, reference readback, replacement enrollment and fresh login
|
||||
procedure. Preserve the original reference and safe recovery record id.
|
||||
Neither the published bug fix nor a passing preview closes U08. Stop on
|
||||
stale metadata, replaced factor or failed audit/readback; do not reset or
|
||||
re-enroll merely to make an acceptance check pass.
|
||||
|
||||
No authenticated preview, real-factor mutation or attended page observation was
|
||||
performed during this source reconciliation. No passwords, codes, token values,
|
||||
provider keys or production Secret objects were requested or read.
|
||||
|
||||
## T02 attended acceptance — 2026-10-17
|
||||
|
||||
The founder reported in session that the real user-engine-portal OTP challenge
|
||||
shows **Code rejected or lost your authenticator?**, that it leads to
|
||||
`https://users.coulomb.social/security`, and that the lost-device guidance is
|
||||
reachable there ("T02 is fine"). This is the founder's own observation, on the
|
||||
deployed image `cdec9dd7` from source `8c6c071`. No exact time or client was
|
||||
recorded, and no challenge URL, request state, cookie or OTP value was preserved.
|
||||
T02 is done. T01 still waits for the authenticated preview (step 2 above).
|
||||
|
||||
## T01 attended preview acceptance — 2026-10-17
|
||||
|
||||
The founder, signed in as platform-root with its own fresh OTP (AAL2), opened
|
||||
`/platform/factor-recovery` and previewed login `tegwick` with the existing
|
||||
reference `U08-2026-10-11`. The founder reported that the preview listed
|
||||
tegwick's TOTP. The `invalid_request` failure from October 11 (F6) did not recur.
|
||||
No confirm or disable action was taken, and no factor was changed. When asked
|
||||
afterwards, the founder confirmed that the listed TOTP's serial suffix is …E1D,
|
||||
the same active factor as on October 11. The exact time was not recorded.
|
||||
|
||||
All three Done-when conditions now hold: the DN-shaped actor defect was fixed
|
||||
with regression tests (2026-10-12); the sidecar logs only closed field names and
|
||||
error codes; and the deployed preview for tegwick lists the active TOTP …E1D
|
||||
without applying anything. That third condition was met only after the suffix
|
||||
was confirmed, not before. T01 and the workplan are done. U08 itself, meaning
|
||||
the attended disable, re-enrolment and fresh login, belongs to user-engine
|
||||
(USER-WP-0028-T03) and is handed back to it. This workplan does not close U08.
|
||||
|
|
@ -0,0 +1,63 @@
|
|||
---
|
||||
id: KEY-WP-0041
|
||||
type: workplan
|
||||
title: "Sign-in diagnosis page and auth log uid (NK-WP-0051-T02)"
|
||||
domain: infotech
|
||||
repo: key-cape
|
||||
status: finished
|
||||
owner: claude-code
|
||||
topic_slug: netkingdom
|
||||
created: "2026-10-14"
|
||||
updated: "2026-10-15"
|
||||
flavor: implementation
|
||||
depends_on: []
|
||||
state_hub_workstream_id: "092c7590-3700-524d-bbe0-a934e063be6b"
|
||||
---
|
||||
|
||||
Demand: NetKingdom `NK-WP-0051-T02`. The field names (`uid`, `groups`,
|
||||
`assurance`, `client_id`) and the never-show/never-log list come only from
|
||||
`net-kingdom/docs/sign-in-diagnosis.md`; this workplan does not restate them.
|
||||
|
||||
## Opt-in pre-redirect page and auth log fields
|
||||
|
||||
```task
|
||||
id: KEY-WP-0041-T01
|
||||
status: done
|
||||
priority: high
|
||||
state_hub_task_id: "5947be07-bc84-5672-b807-608070a39d10"
|
||||
```
|
||||
|
||||
- Client registration flag `signInDiagnosis` (default false) in the YAML
|
||||
config, `domain.Client` and `spec/canonical-model.yaml`.
|
||||
- With the flag on, `/authorize/callback` renders a page before the redirect
|
||||
with `uid`, sorted `groups`, `assurance` and `client_id`, one continue link
|
||||
to the unchanged redirect (code + state), and a sign-out hint. html/template
|
||||
escaping, `no-store`, `Referrer-Policy: no-referrer`, restrictive CSP.
|
||||
- `assurance` is `aal2` only when this request verified a one-time code; a
|
||||
reused aal2 session is `aal1` (contract wording, stricter than the session
|
||||
satisfied `MFAVerified`).
|
||||
- The `auth_success` log line gains `uid` and `assurance` beside `client_id`.
|
||||
- Enabled for `openbao-admin` in `config/dev-config.yaml`; the live flag is set
|
||||
in `sso/keycape-config` (see `docs/operations.md`).
|
||||
- Tests: `src/internal/server/oidc/signin_diagnosis_test.go`.
|
||||
|
||||
## Deploy the image and record its digest
|
||||
|
||||
```task
|
||||
id: KEY-WP-0041-T02
|
||||
status: done
|
||||
priority: high
|
||||
state_hub_task_id: "bd5db26c-b71c-5291-bdc3-7c0f718651db"
|
||||
```
|
||||
|
||||
Build and push with `make push IMAGE_TAG=<sha>`, set `signInDiagnosis: true`
|
||||
on the OpenBao browser client in `sso/keycape-config`, roll the issuer under
|
||||
the usual live-change approval, and send the digest to net-kingdom for the
|
||||
evidence table in `docs/sign-in-diagnosis.md`. Not done by the implementing
|
||||
session: deployment needs operator approval.
|
||||
|
||||
2026-10-15: image `sha256:cdec9dd7c515f7e0a6169fc3fa560ee2cc47bf40d899755dec808c362f5ce010`
|
||||
(source `8c6c071`) is live; see `docs/operations.md`. 2026-10-15: `signInDiagnosis: true` set on `openbao-admin` with
|
||||
net-kingdom `openbao-signin-diagnosis-rollout.py` (rv 71655453 → 75372162,
|
||||
unrelated bytes preserved) and the issuer restarted; pod ready, discovery 200.
|
||||
Accepted 2026-10-15: an attended OpenBao login showed the page and completed.
|
||||
|
|
@ -0,0 +1 @@
|
|||
WARN: git commit failed for writeback: Generated-only commits rejected: staged
|
||||
|
|
@ -0,0 +1,123 @@
|
|||
{
|
||||
"repo_slug": "key-cape",
|
||||
"repo_path": "/home/worsch/key-cape",
|
||||
"source_revision": "26ec9bb9b195ad377448570d6b161fd682311a0b",
|
||||
"source_revision_reason": null,
|
||||
"issues": [
|
||||
{
|
||||
"severity": "WARN",
|
||||
"check_id": "C-24",
|
||||
"message": "Repo classification advisory: capability_tag 'security' is not a recommended family tag (allowed, check for synonym)",
|
||||
"file_path": "",
|
||||
"db_id": "",
|
||||
"file_value": "",
|
||||
"db_value": "",
|
||||
"fixable": false
|
||||
},
|
||||
{
|
||||
"severity": "WARN",
|
||||
"check_id": "C-11",
|
||||
"message": "Task 'ADHOC-2026-09-27-T02' has no state_hub_task_id",
|
||||
"file_path": "workplans/ADHOC-2026-09-27.md#ADHOC-2026-09-27-T02",
|
||||
"db_id": "",
|
||||
"file_value": "",
|
||||
"db_value": "",
|
||||
"fixable": true
|
||||
},
|
||||
{
|
||||
"severity": "WARN",
|
||||
"check_id": "C-20",
|
||||
"message": "Workplan dependency target 'USER-WP-0020' is not linked to State Hub",
|
||||
"file_path": "workplans/KEY-WP-0007-user-engine-portal-oidc-client.md",
|
||||
"db_id": "",
|
||||
"file_value": "USER-WP-0020",
|
||||
"db_value": "",
|
||||
"fixable": false
|
||||
},
|
||||
{
|
||||
"severity": "WARN",
|
||||
"check_id": "C-20",
|
||||
"message": "Workplan dependency target 'NK-WP-0025' is not linked to State Hub",
|
||||
"file_path": "workplans/KEY-WP-0008-registration-handoff-and-client-mfa-policy.md",
|
||||
"db_id": "",
|
||||
"file_value": "NK-WP-0025",
|
||||
"db_value": "",
|
||||
"fixable": false
|
||||
},
|
||||
{
|
||||
"severity": "WARN",
|
||||
"check_id": "C-20",
|
||||
"message": "Workplan dependency target 'NK-WP-0030' is not linked to State Hub",
|
||||
"file_path": "workplans/KEY-WP-0009-provider-capabilities-and-service-identities.md",
|
||||
"db_id": "",
|
||||
"file_value": "NK-WP-0030",
|
||||
"db_value": "",
|
||||
"fixable": false
|
||||
},
|
||||
{
|
||||
"severity": "WARN",
|
||||
"check_id": "C-20",
|
||||
"message": "Workplan dependency target 'RAILIANCE-WP-0027' is not linked to State Hub",
|
||||
"file_path": "workplans/KEY-WP-0010-openbao-operator-loopback-callback.md",
|
||||
"db_id": "",
|
||||
"file_value": "RAILIANCE-WP-0027",
|
||||
"db_value": "",
|
||||
"fixable": false
|
||||
},
|
||||
{
|
||||
"severity": "WARN",
|
||||
"check_id": "C-22",
|
||||
"message": "Task description drift 'KEY-WP-0039-T02': file content differs from DB (file wins)",
|
||||
"file_path": "workplans/KEY-WP-0039-openbao-negative-probe-tokens.md#KEY-WP-0039-T02",
|
||||
"db_id": "03da4c38-1dac-53b1-8b0b-e697df48e9d3",
|
||||
"file_value": "2026-10-11: requalified \u2014 live registration go caafe4be was already resolved; owner authorization present. See the-custo",
|
||||
"db_value": "2026-10-11: requalified \u2014 live registration go caafe4be was already resolved; owner authorization present. See the-custo",
|
||||
"fixable": true
|
||||
},
|
||||
{
|
||||
"severity": "INFO",
|
||||
"check_id": "C-08",
|
||||
"message": "Retired DB workstream 'keycape-implementation@retired-20260826' (id=2c9caad8\u2026, status=archived) has no backing workplan file \u2014 projection tombstone, not live work",
|
||||
"file_path": "",
|
||||
"db_id": "2c9caad8-2ced-492d-9d63-376387b4b9b0",
|
||||
"file_value": "",
|
||||
"db_value": "",
|
||||
"fixable": false
|
||||
},
|
||||
{
|
||||
"severity": "WARN",
|
||||
"check_id": "C-28",
|
||||
"message": "2 unread inbox message(s) older than 3 day(s): the-custodian:23172cb2, the-custodian:51e9eace",
|
||||
"file_path": "",
|
||||
"db_id": "",
|
||||
"file_value": "",
|
||||
"db_value": "",
|
||||
"fixable": false
|
||||
},
|
||||
{
|
||||
"severity": "WARN",
|
||||
"check_id": "C-28",
|
||||
"message": "2 unread message(s) lack thread_id for supersession tracking: the-custodian:23172cb2, the-custodian:51e9eace",
|
||||
"file_path": "",
|
||||
"db_id": "",
|
||||
"file_value": "",
|
||||
"db_value": "",
|
||||
"fixable": false
|
||||
}
|
||||
],
|
||||
"fixes_applied": [
|
||||
"bindings: synced 44/44",
|
||||
"C-17 cleared: pushed 1 backlogged commit(s)",
|
||||
"C-11 skipped: task 'ADHOC-2026-09-27-T02' in finished workstream \u2014 not created",
|
||||
"C-22 fixed: task 03da4c38\u2026 description updated",
|
||||
"brief: .custodian-brief.md updated",
|
||||
"push: pushed"
|
||||
],
|
||||
"summary": {
|
||||
"fail": 0,
|
||||
"automation_error": 0,
|
||||
"warn": 9,
|
||||
"info": 1
|
||||
},
|
||||
"result": "warn"
|
||||
}
|
||||
|
|
@ -0,0 +1,46 @@
|
|||
{
|
||||
"commit": "26ec9bb9b195ad377448570d6b161fd682311a0b",
|
||||
"receiver_status": "applied",
|
||||
"acknowledge_retirements": false,
|
||||
"instance_role": "primary",
|
||||
"instance_label": "railiance01",
|
||||
"workplan": {
|
||||
"id": "09c3bddf-6058-5603-8488-cccdb7be4f86",
|
||||
"status": "active",
|
||||
"record_id": "KEY-WP-0039"
|
||||
},
|
||||
"task_bindings": [
|
||||
{
|
||||
"record_id": "KEY-WP-0039-T01",
|
||||
"state_hub_task_id": "4d06b059-3768-53bb-83a4-a9a71c0850b8",
|
||||
"status": "done",
|
||||
"workplan_id": "09c3bddf-6058-5603-8488-cccdb7be4f86",
|
||||
"depends_on_source": []
|
||||
},
|
||||
{
|
||||
"record_id": "KEY-WP-0039-T02",
|
||||
"state_hub_task_id": "03da4c38-1dac-53b1-8b0b-e697df48e9d3",
|
||||
"status": "wait",
|
||||
"workplan_id": "09c3bddf-6058-5603-8488-cccdb7be4f86",
|
||||
"depends_on_source": [
|
||||
"KEY-WP-0039-T01",
|
||||
"KEY-WP-0038-T02",
|
||||
"KEY-WP-0038-T03"
|
||||
]
|
||||
},
|
||||
{
|
||||
"record_id": "KEY-WP-0039-T03",
|
||||
"state_hub_task_id": "54d37ad8-2352-51c2-bb2e-af6070dbbd73",
|
||||
"status": "done",
|
||||
"workplan_id": "09c3bddf-6058-5603-8488-cccdb7be4f86",
|
||||
"depends_on_source": []
|
||||
}
|
||||
],
|
||||
"all_three_source_blocks_unchanged": true,
|
||||
"frontmatter_unchanged": true,
|
||||
"only_committed_path": "workplans/KEY-WP-0039-openbao-negative-probe-tokens.md",
|
||||
"remote_forge_matches": true,
|
||||
"owner_worktree_and_index_clean": true,
|
||||
"normal_sync_refusal": "unrelated grandfathered ADHOC-2026-09-27-T02 UUID; not modified",
|
||||
"native_acceptance_inferred": false
|
||||
}
|
||||
|
|
@ -0,0 +1,68 @@
|
|||
{
|
||||
"scope": "current narrative clarification only; original client approval retained without widening; no native action",
|
||||
"commit": "26ec9bb9b195ad377448570d6b161fd682311a0b",
|
||||
"files": {
|
||||
"KEY39.preimage.md": "sha256:c576db4b97ea5de0a50e17f251f8d5c57a744ded557bede963e48608bf3a6ca2",
|
||||
"KEY39.proposed.md": "sha256:618600946f6dd4128206db7ab23da9cc96e22cb84e0fd301b1b2eacd5c9bdba4",
|
||||
"apply.py": "sha256:23677d8f888c4422694f5dfa0eb8e58ae7fc07a5880c02d46af966815eff83a3",
|
||||
"baseline.json": "sha256:c6fb71899fc2d00c3de87242597100347f9d7783a74f77b49b3de89b25d1b820",
|
||||
"canonical-receiver.json": "sha256:21e9a4a3b4cac23f5932855e88c403a932d07198b79dc446e4b9e14dacf0c354",
|
||||
"canonical-reconcile.py": "sha256:67f56fb4ec5feccf322db8e7d0e3b1fc6bbbf2312a3981c4a39c10dbdde9aaff",
|
||||
"commit.json": "sha256:00f1176cc7d1234446a52cf1ba998fc3548b27523c242768e7d81cbb9826d123",
|
||||
"consistency-backup/.custodian-brief.md": "sha256:96d84539b3a92786bff37fcc70161adec4648b9547287e52e6b817bc080a080a",
|
||||
"consistency-backup/WORK-RECORDS.md": "sha256:431842547bd82750f284f8c1c9f519892f1bb1c1a684b9b1e38adc6fdfdc299d",
|
||||
"consistency-backup/originals.json": "sha256:9d0619163f2cd6046c31a4bca52e02fdb63ddc05e2581a146daac2d93c8e0f35",
|
||||
"consistency-backup/workplans/ADHOC-2026-09-05.md": "sha256:76123d22d0c1efc51212f8914e386f078b3c6d908959af6978ae73874e492b04",
|
||||
"consistency-backup/workplans/ADHOC-2026-09-07.md": "sha256:c335ebfe91dad291277e8f17034ac8f785b3bc767f281f205c446c08f03d7978",
|
||||
"consistency-backup/workplans/ADHOC-2026-09-27.md": "sha256:2794d1940fc3c5e4a2df57de9d4b742fa6aa8602b67f1d3177c0d96bc5aaf314",
|
||||
"consistency-backup/workplans/KEY-WP-0001-keycape-implementation.md": "sha256:29a2bf4892b7185e28e9126a3d8311d0fed34a876f416a3e75c605915fde0969",
|
||||
"consistency-backup/workplans/KEY-WP-0002-container-image-gitea.md": "sha256:76fee187185b30219bc257ccc9b587661df4489574a2bb57703a365a5d803cec",
|
||||
"consistency-backup/workplans/KEY-WP-0003-bootstrap-console-oidc-mfa-login.md": "sha256:5e949c696e587540d305b682eb1f8390ec544bbec6a566be8d04e73fb1b254ca",
|
||||
"consistency-backup/workplans/KEY-WP-0004-binky-hedgehog-tenant-onboarding.md": "sha256:260ba7d3116db3bc5a72e5cd8b9984137e7e372c8128d21073614dbd948c10c2",
|
||||
"consistency-backup/workplans/KEY-WP-0005-iam-profile-core-claims.md": "sha256:c6702b644cdd046c0d3bba8ba8837050826e4dc3d855bd73327ae94218ba5b57",
|
||||
"consistency-backup/workplans/KEY-WP-0006-client-credentials-service-tokens.md": "sha256:b3227849978c95cad89e02afb74bf2217b6188ae65c5b0af6a21703d65477701",
|
||||
"consistency-backup/workplans/KEY-WP-0007-user-engine-portal-oidc-client.md": "sha256:5408ff6dfeb58a8a7756b48fe4f54f7c7b98d7940cb9aaa5c7864f1247e58150",
|
||||
"consistency-backup/workplans/KEY-WP-0008-registration-handoff-and-client-mfa-policy.md": "sha256:bfc9b2118f0712e92a86bbb0f14a2857fafc3a42a3c14c0e2535002aaa57a2f5",
|
||||
"consistency-backup/workplans/KEY-WP-0009-provider-capabilities-and-service-identities.md": "sha256:d1daac9815930104a392ea96c14922e34f947720a31d1b0ac45a770997e0f476",
|
||||
"consistency-backup/workplans/KEY-WP-0010-openbao-operator-loopback-callback.md": "sha256:41d28a16bef9313b776c5c6305316a9e7d4f5528b7fb7427b8384a0ed0ad35c4",
|
||||
"consistency-backup/workplans/KEY-WP-0011-live-secret-exposure-recovery.md": "sha256:3c5458180fe81a04e357f8db737e4287f79640b5ab02682bcadc595b73f846cd",
|
||||
"consistency-backup/workplans/KEY-WP-0012-userinfo-canonical-subject-resolution.md": "sha256:68d34d75c914e7d2d8177000e800d6372cccda2b850c03ab85da42b90a66b91c",
|
||||
"consistency-backup/workplans/KEY-WP-0013-approval-engine-resource-audience.md": "sha256:55c88bf4ed9a456db59b319bbaf960dfe6f4147437e339f950e0583d7582057a",
|
||||
"consistency-backup/workplans/KEY-WP-0014-native-credential-lane-handoff.md": "sha256:22aac43ae5039aebd11f9f0aa57a882ad009ad6ed119ec08eb85b32a5af48cd7",
|
||||
"consistency-backup/workplans/KEY-WP-0015-scope-intent-assessment.md": "sha256:60b9f2265eff880d916c3ee8dba36aec9984ec310804de776cebf89cc98fdb95",
|
||||
"consistency-backup/workplans/KEY-WP-0016-authorization-code-protocol-hardening.md": "sha256:ed48128a1cb51cbe3d154727bafd5a5ffb3b5b618c20649b2a0e7db154cf3a0c",
|
||||
"consistency-backup/workplans/KEY-WP-0017-canonical-model-and-discovery-conformance.md": "sha256:8700e0e5aa07dcd7f651e792cca12a0330b7ee9d2f6064b4cc3fcf4c7d509340",
|
||||
"consistency-backup/workplans/KEY-WP-0018-export-completeness-evidence.md": "sha256:15026b708d116f803b0b2fa43f30a4dbced76e4d8137b5fcb5b4275e593d7c7b",
|
||||
"consistency-backup/workplans/KEY-WP-0019-upstream-provider-token-verification.md": "sha256:0d2d8b5bda1e0d333935812d8d3749cb7b0c5523a3987d1b26185f9f6d0f0fa2",
|
||||
"consistency-backup/workplans/KEY-WP-0020-migration-contract-preservation.md": "sha256:cc842d15bf42ddc4d0f4056bc19b3176cab2c5f3c1a2fe6d648e5dbd077be8b3",
|
||||
"consistency-backup/workplans/KEY-WP-0021-snapshot-attribute-validation.md": "sha256:b603248693073a9b9b25b4d0a4147d8d88c16a07dc9936e48fa1f3c76fe8bab6",
|
||||
"consistency-backup/workplans/KEY-WP-0022-replacement-harness-and-external-conformance.md": "sha256:8c135e84be81de31b4949f52ac28dccd404f2e4c3eaa576d733bd50160427a53",
|
||||
"consistency-backup/workplans/KEY-WP-0023-live-migration-proof.md": "sha256:e581cd11f3905805b5e8ba8e2ede85092577c7d086e1761f2a2d033fdead4e47",
|
||||
"consistency-backup/workplans/KEY-WP-0024-tenant-roles-opt-in-wiring.md": "sha256:af7842fa97263bfd46a4b5ae84c5c1ecddb06ab9623586e0292dcc93099fea35",
|
||||
"consistency-backup/workplans/KEY-WP-0025-runtime-lifecycle-and-readiness.md": "sha256:0addb34e6d85e376c6a5db7afba597b6f268afa98b86c8c60add9be174dd1b26",
|
||||
"consistency-backup/workplans/KEY-WP-0026-packaging-bootstrap-and-credential-handling.md": "sha256:c1bc0de47511ae49102009a172c84d9d5d64e829a18c8d40564fe817935563b3",
|
||||
"consistency-backup/workplans/KEY-WP-0027-rollout-readiness-and-live-state.md": "sha256:f559eae61d433d451f80ea575254bb14a47f2485267b412e42d524b434bb1b59",
|
||||
"consistency-backup/workplans/KEY-WP-0028-browser-client-field-validation.md": "sha256:fbd51422fa5e6449000e4520e6639f6135c7393165a5ae02b1e92892edba0480",
|
||||
"consistency-backup/workplans/KEY-WP-0029-scope-reassessment.md": "sha256:3241f3b94db9cad5e3770cf1fedc5c211288357e4f69b5ba9da57065094bdf0e",
|
||||
"consistency-backup/workplans/KEY-WP-0030-tenant-precondition-guard.md": "sha256:c94c3afc7fb4270dfc18f3fe8a32946c524e4a6ba2d02a3d8fda69c9b8441af0",
|
||||
"consistency-backup/workplans/KEY-WP-0031-gate-house-tenant-ruling.md": "sha256:0abb135367f0366aa071769c4bd76fdeb321d810ec75ad3b58d718734f78382b",
|
||||
"consistency-backup/workplans/KEY-WP-0032-principal-type-provenance-guard.md": "sha256:6a5cd483a40b9477227b02156c42b3469094dac145b33727b336118898aa782a",
|
||||
"consistency-backup/workplans/KEY-WP-0033-vergabe-fresh-login.md": "sha256:c01bb51cf2dcad06ea846040dddef09845041fa7271cd7015e5a34a49e60bb8f",
|
||||
"consistency-backup/workplans/KEY-WP-0034-account-recovery.md": "sha256:7db9adcd418ccabfbce672aec283249a6e374212492f0349e8c47a568f130eda",
|
||||
"consistency-backup/workplans/KEY-WP-0035-optional-mfa.md": "sha256:c60ea8d0c195686c0d2317f657aad2de27c9b9432d311627c0e1d06124cabb49",
|
||||
"consistency-backup/workplans/KEY-WP-0036-platform-factor-recovery.md": "sha256:5ceb08fe5789b4f02550bb04fcaf8eeb25a43ac3f506dfc62d60a513bcd0013f",
|
||||
"consistency-backup/workplans/KEY-WP-0037-secrets-engine-openbao-registration-custody.md": "sha256:3a90a0c460fc439570820b96d1ddc3b7f8646c557ca3a8aa27c6d546bb1a845a",
|
||||
"consistency-backup/workplans/KEY-WP-0038-forgejo-oidc-client.md": "sha256:dc8d88d462799e7e6e44da759a973d52e44102a271969a5daaa9d30ec015b064",
|
||||
"consistency-backup/workplans/KEY-WP-0039-openbao-negative-probe-tokens.md": "sha256:618600946f6dd4128206db7ab23da9cc96e22cb84e0fd301b1b2eacd5c9bdba4",
|
||||
"consistency-backup/workplans/KEY-WP-0040-mfa-attended-run-findings.md": "sha256:98b23d8810bff047067169232213cb313ecc14ff79751224842723afe808fbd2",
|
||||
"consistency-backup/workplans/KEY-WP-0041-sign-in-diagnosis-page.md": "sha256:7e44f46acd6b3942c1852b49e0d64b205dfd7d9bb378aed5241b1bf22d7ce88a",
|
||||
"consistency.stderr.txt": "sha256:f4a6aa1609a13600a0b97cbb08bbc03b3e247b619ff37912d37f7e109ce798ba",
|
||||
"consistency.stdout.json": "sha256:c044d7bdd52113e6cbaee29182c2e124ec1c73b8402fd3acb56501692dfc67f5",
|
||||
"final-verification.json": "sha256:0a9368287e824033ec09440dcf607bb2fcbfb0d8103ed7077937dd7219e9546b",
|
||||
"normal-publication.json": "sha256:66fddbf0809771fe291f504d1760b53bbebcc4dbd0986bf4f8f6e517194f15b4",
|
||||
"normal-sync.stderr.txt": "sha256:832bd22063c46072d0d91381f7d1356be933b4d09ded52fa19282da13c2855b1",
|
||||
"normal-sync.stdout.json": "sha256:e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
|
||||
"one-path.patch": "sha256:81b33bbc70efa48f1838d40ef090fb0d9dd78ebd471368fbd002d8b0031e208e",
|
||||
"sync.py": "sha256:28caf710aff711e12957dc1b453edfe795187f7e470e8c5fd30088d8de74501c"
|
||||
}
|
||||
}
|
||||
|
|
@ -0,0 +1,34 @@
|
|||
{
|
||||
"published_candidate_commit": "26ec9bb9b195ad377448570d6b161fd682311a0b",
|
||||
"normal_commands": [
|
||||
{
|
||||
"command": [
|
||||
"statehub",
|
||||
"fix-consistency",
|
||||
"--repo",
|
||||
"key-cape",
|
||||
"--json"
|
||||
],
|
||||
"exit_code": 0,
|
||||
"label": "consistency"
|
||||
},
|
||||
{
|
||||
"command": [
|
||||
"/home/worsch/repo-manager/.venv/bin/rmgr",
|
||||
"sync",
|
||||
"--path",
|
||||
"/home/worsch/key-cape",
|
||||
"--push"
|
||||
],
|
||||
"exit_code": 1,
|
||||
"label": "normal-sync"
|
||||
}
|
||||
],
|
||||
"unrelated_writeback_restored": [
|
||||
".custodian-brief.md"
|
||||
],
|
||||
"all_original_index_worktree_fields_preserved": true,
|
||||
"one_path_commit": true,
|
||||
"normal_hooks": "changed-staged-blobs scanner8.30.1 clean",
|
||||
"native_or_credential_actions": 0
|
||||
}
|
||||
|
|
@ -0,0 +1,13 @@
|
|||
Traceback (most recent call last):
|
||||
File "/home/worsch/repo-manager/.venv/bin/rmgr", line 8, in <module>
|
||||
sys.exit(main())
|
||||
^^^^^^
|
||||
File "/home/worsch/repo-manager/src/repo_manager/cli.py", line 853, in main
|
||||
result = sync_repository_projection(
|
||||
^^^^^^^^^^^^^^^^^^^^^^^^^^^
|
||||
File "/home/worsch/repo-manager/src/repo_manager/projection_sync.py", line 98, in sync_repository_projection
|
||||
assignments = ensure_missing_work_record_identifiers(repo_root)
|
||||
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
|
||||
File "/home/worsch/repo-manager/src/repo_manager/identifiers.py", line 962, in ensure_missing_work_record_identifiers
|
||||
raise ValueError(
|
||||
ValueError: missing UUIDs on grandfathered or noncanonical records require an explicit identity decision: [{'kind': 'task', 'record_id': 'ADHOC-2026-09-27-T02', 'path': 'workplans/ADHOC-2026-09-27.md'}]
|
||||
|
|
@ -0,0 +1,19 @@
|
|||
diff --git a/workplans/KEY-WP-0039-openbao-negative-probe-tokens.md b/workplans/KEY-WP-0039-openbao-negative-probe-tokens.md
|
||||
index fd0fc46..b22aa6a 100644
|
||||
--- a/workplans/KEY-WP-0039-openbao-negative-probe-tokens.md
|
||||
+++ b/workplans/KEY-WP-0039-openbao-negative-probe-tokens.md
|
||||
@@ -143,8 +143,12 @@ operator/ESO capability and nonmember checks remain independent acceptance.
|
||||
acknowledgment): the [infrastructure assessment](../../the-custodian/docs/changes/netkingdom-target-2026-10-17/key39-infra-finalization-r1/ASSESSMENT.md)
|
||||
confirms all 14 executable/test/producer-decision pins and three Platform source
|
||||
pins still match. Source reviews remain complete: T01/T03 done, T02 wait. Existing
|
||||
-source acceptance, resolved registration go caafe4be and the standing attended
|
||||
-rule remain valid; no new protocol or blanket approval request is needed. The
|
||||
+source acceptance remains valid. Resolved registration go caafe4be covers only
|
||||
+the original secrets-engine-openbao client (KEY-WP-0037-T03, deployed 6f79a2af,
|
||||
+NK-WP-0046 exact-match helper); it does not authorize new probe clients or
|
||||
+coding-client custody, and no renewed original-client approval is requested.
|
||||
+The standing attended rule remains separate, for reviewed commands within
|
||||
+existing scope; no new protocol or blanket approval request is introduced. The
|
||||
remaining sequence is KEY-WP-0038-T02/T03 first-case registration/claims proof,
|
||||
admission of the existing coding-client proposal with sanitized owner readiness
|
||||
returns, then one attended negative/revoke/cleanup receipt committed with probe
|
||||
|
|
@ -0,0 +1,36 @@
|
|||
from pathlib import Path
|
||||
import subprocess,json,hashlib,stat
|
||||
root=Path('/home/worsch/key-cape');out=Path('/home/worsch/the-custodian/docs/changes/netkingdom-target-2026-10-17/key39-finalization-scope-clarification-r1');backup=out/'consistency-backup';backup.mkdir()
|
||||
def git(*args):return subprocess.check_output(['git','-C',str(root),*args]).decode()
|
||||
head=git('rev-parse','HEAD').strip();assert head==json.loads((out/'commit.json').read_text())['commit']
|
||||
assert git('diff-tree','--no-commit-id','--name-only','-r',head).splitlines()==['workplans/KEY-WP-0039-openbao-negative-probe-tokens.md']
|
||||
assert not git('status','--porcelain=v1')
|
||||
paths=sorted({p.relative_to(root).as_posix() for p in (root/'workplans').rglob('*.md')}|{n for n in ('.custodian-brief.md','WORK-RECORDS.md') if (root/n).exists()})
|
||||
original={}
|
||||
for rel in paths:
|
||||
p=root/rel;assert p.is_file() and not p.is_symlink()
|
||||
dest=backup/rel;dest.parent.mkdir(parents=True,exist_ok=True);dest.write_bytes(p.read_bytes())
|
||||
original[rel]={'sha256':hashlib.sha256(p.read_bytes()).hexdigest(),'mode':stat.S_IMODE(p.stat().st_mode),'index':git('ls-files','--stage','--',rel)}
|
||||
(backup/'originals.json').write_text(json.dumps(original,indent=2)+'\n')
|
||||
results=[];changed=[]
|
||||
try:
|
||||
for label,argv in [('consistency',['statehub','fix-consistency','--repo','key-cape','--json']),('normal-sync',['/home/worsch/repo-manager/.venv/bin/rmgr','sync','--path',str(root),'--push'])]:
|
||||
cp=subprocess.run(argv,cwd=root,stdout=subprocess.PIPE,stderr=subprocess.PIPE,timeout=240)
|
||||
(out/(label+'.stdout.json')).write_bytes(cp.stdout);(out/(label+'.stderr.txt')).write_bytes(cp.stderr)
|
||||
results.append({'command':argv,'exit_code':cp.returncode,'label':label})
|
||||
finally:
|
||||
assert git('rev-parse','HEAD').strip()==head,'unexpected commit; stop for review'
|
||||
for rel,b in original.items():
|
||||
p=root/rel
|
||||
if not p.exists() or hashlib.sha256(p.read_bytes()).hexdigest()!=b['sha256']:
|
||||
changed.append(rel);p.write_bytes((backup/rel).read_bytes());p.chmod(b['mode'])
|
||||
current=git('ls-files','--stage','--',rel)
|
||||
if current!=b['index']:
|
||||
assert b['index'];mode,oid,stage,path=b['index'].split();assert stage=='0'
|
||||
git('update-index','--cacheinfo',mode,oid,path)
|
||||
assert git('ls-files','--stage','--',rel)==b['index']
|
||||
assert hashlib.sha256(p.read_bytes()).hexdigest()==b['sha256']
|
||||
assert not git('status','--porcelain=v1'),git('status','--porcelain=v1')
|
||||
receipt={'published_candidate_commit':head,'normal_commands':results,'unrelated_writeback_restored':changed,'all_original_index_worktree_fields_preserved':True,'one_path_commit':True,'normal_hooks':'changed-staged-blobs scanner8.30.1 clean','native_or_credential_actions':0}
|
||||
(out/'normal-publication.json').write_text(json.dumps(receipt,indent=2)+'\n')
|
||||
print(json.dumps(receipt))
|
||||
|
|
@ -0,0 +1,96 @@
|
|||
"""Retain the reviewed commit with a normal, tree-identical admission merge."""
|
||||
from pathlib import Path
|
||||
import hashlib
|
||||
import json
|
||||
import shutil
|
||||
import subprocess
|
||||
|
||||
ROOT = Path('/home/worsch/the-custodian')
|
||||
BASE = Path(__file__).resolve().parent
|
||||
WORK = Path('/tmp/custodian-rollout-admission-5596185e')
|
||||
SOURCE = '5596185e71db4bff092b75af4d647e7501d47ff9'
|
||||
PRIOR = 'f8c7dfa2a9c7919879b62c77eb39582b3e23654e'
|
||||
TIP = 'a4e90c68604253b9284ba4f67c3f3cad5d80970a'
|
||||
REF = 'refs/heads/evidence/receiver-guard-5596185e'
|
||||
SCANNER = '/home/worsch/repo-manager/src/repo_manager/secret_scan.py'
|
||||
BINARY = '/home/worsch/.local/lib/repo-manager/gitleaks/8.30.1/gitleaks'
|
||||
|
||||
def call(path, *args, timeout=30):
|
||||
return subprocess.run(list(args), cwd=path, capture_output=True, timeout=timeout)
|
||||
|
||||
def git(path, *args):
|
||||
r = call(path, 'git', *args)
|
||||
assert r.returncode == 0, args[0] + '-refused'
|
||||
return r.stdout
|
||||
|
||||
def remote(ref):
|
||||
return git(ROOT, 'ls-remote', 'origin', ref).decode().split()[0]
|
||||
|
||||
def pin():
|
||||
assert hashlib.sha256(Path(SCANNER).read_bytes()).hexdigest() == 'e709c658f779534fcab093207b0a78e49d54fc584c515fdf7ac535ce75f6c400'
|
||||
assert hashlib.sha256((ROOT / '.git/hooks/pre-commit').read_bytes()).hexdigest() == ledger['original_hook_sha256']
|
||||
assert git(ROOT, 'ls-files', '--stage', '-z') == original_index
|
||||
assert remote('refs/heads/main') == PRIOR
|
||||
assert git(ROOT, 'rev-parse', 'HEAD').decode().strip() == SOURCE
|
||||
|
||||
ledger = json.loads((BASE / 'rollout-bounded-admission.json').read_text())
|
||||
assert len(ledger['batches']) == 10 and all(b['status'] == 'admitted' for b in ledger['batches'])
|
||||
shutil.copy2(BASE / 'rollout-bounded-admission.json', BASE / 'r1-rollout-bounded-admission.json')
|
||||
assert git(WORK, 'rev-parse', 'HEAD').decode().strip() == remote(REF) == TIP
|
||||
original_index = git(ROOT, 'ls-files', '--stage', '-z')
|
||||
pin()
|
||||
failed = git(ROOT, 'rev-list', '--objects', '--no-object-names', SOURCE, '^' + PRIOR, '^' + TIP).decode().splitlines()
|
||||
assert len(failed) == 237
|
||||
(BASE / 'rollout-default-walk-proof-FAILED.json').write_text(json.dumps({
|
||||
'status': 'disproven-assumption', 'original_source_commit': SOURCE,
|
||||
'evidence_tip': TIP, 'tree_identical': True, 'default_rev_list_objects': len(failed),
|
||||
'original_commit_only_claim_false': True, 'main_push_not_attempted': True,
|
||||
'all_ten_prior_receiver_results_retained': True}, indent=2) + '\n')
|
||||
merge = call(WORK, 'git', 'merge', '--no-ff', '--no-commit', SOURCE)
|
||||
assert merge.returncode == 0
|
||||
assert git(WORK, 'rev-parse', 'MERGE_HEAD').decode().strip() == SOURCE
|
||||
assert git(WORK, 'write-tree').decode().strip() == ledger['source_tree']
|
||||
before = git(WORK, 'ls-files', '--stage', '-z')
|
||||
scan = call(WORK, 'python3', SCANNER, '--path', str(WORK), '--binary', BINARY, timeout=135)
|
||||
report = json.loads(scan.stdout)
|
||||
assert scan.returncode == 0 and report['status'] == 'clean'
|
||||
assert git(WORK, 'ls-files', '--stage', '-z') == before
|
||||
pin()
|
||||
commit = call(WORK, 'git', 'commit', '-m', 'Preserve reviewed receiver rollout after bounded object admission', timeout=140)
|
||||
assert commit.returncode == 0
|
||||
head = git(WORK, 'rev-parse', 'HEAD').decode().strip()
|
||||
assert git(WORK, 'rev-parse', head + '^{tree}').decode().strip() == ledger['source_tree']
|
||||
assert git(WORK, 'rev-list', '--parents', '-n', '1', head).decode().split() == [head, TIP, SOURCE]
|
||||
introduced = git(WORK, 'rev-list', '--objects', '--no-object-names', head, '^' + PRIOR, '^' + TIP).decode().splitlines()
|
||||
result = {'status': 'merge-prepared-not-pushed', 'merge_commit': head, 'parents': [TIP, SOURCE],
|
||||
'tree': ledger['source_tree'], 'tree_equals_original_review': True,
|
||||
'original_review_commit_retained': True, 'local_scan': report,
|
||||
'default_rev_list_objects': introduced, 'remote_gate_or_hooks_changed': False}
|
||||
out = BASE / 'rollout-admission-merge.json'
|
||||
out.write_text(json.dumps(result, indent=2) + '\n')
|
||||
assert set(introduced) == {head, SOURCE}
|
||||
assert remote(REF) == TIP
|
||||
pin()
|
||||
push = call(WORK, 'git', 'push', 'origin', 'HEAD:' + REF, timeout=115)
|
||||
reports = []
|
||||
for line in (push.stdout + b'\n' + push.stderr).decode(errors='replace').splitlines():
|
||||
if '{' in line:
|
||||
try:
|
||||
value = json.loads(line[line.index('{'):line.rindex('}')+1])
|
||||
except ValueError:
|
||||
continue
|
||||
if value.get('scope') == 'introduced-reachable-git-objects-and-updated-ref-names':
|
||||
reports.append(value)
|
||||
result.update(push_exit_code=push.returncode, remote_reports=reports, remote_observed=remote(REF))
|
||||
result['status'] = 'admitted' if push.returncode == 0 and result['remote_observed'] == head else 'refused-or-unverified'
|
||||
out.write_text(json.dumps(result, indent=2) + '\n')
|
||||
assert result['status'] == 'admitted' and len(reports) == 1
|
||||
assert reports[0]['status'] == 'clean' and reports[0]['scanned_objects'] == 2 and reports[0]['scanned_refs'] == 1
|
||||
pin()
|
||||
final_objects = git(ROOT, 'rev-list', '--objects', '--no-object-names', head, '^' + PRIOR, '^' + head)
|
||||
assert not final_objects
|
||||
result.update(main_unchanged=True, final_main_new_objects=0, canonical_index_preserved=True,
|
||||
evidence_branch_retained=True)
|
||||
out.write_text(json.dumps(result, indent=2) + '\n')
|
||||
print(json.dumps({'status': 'admitted', 'merge_commit': head, 'remote_objects_scanned': 2,
|
||||
'final_main_new_objects': 0, 'original_commit_retained': True}))
|
||||
|
|
@ -0,0 +1,7 @@
|
|||
{
|
||||
"binary_sha256": "sha256:e318903862396f96de3df57264e0158682b952fd3fb53ac23d876413e7b30f71",
|
||||
"exit_code": 0,
|
||||
"stdout_empty": true,
|
||||
"namespace_capability": true,
|
||||
"fixed_diagnostic": ""
|
||||
}
|
||||
|
|
@ -0,0 +1,21 @@
|
|||
{
|
||||
"workplan_id": "dfadb19b-445e-59c6-bcd6-48e87b912c52",
|
||||
"id": "674f8932-9721-444a-a7dd-5961fbc2b626",
|
||||
"topic_id": null,
|
||||
"task_id": null,
|
||||
"decision_id": null,
|
||||
"event_type": "note",
|
||||
"summary": "Final checked checkpoint: Custodian16ab1bb490336fb2f954612b85e91f15bc5e7eff published/requiredconsistency/canonicalprimaryprojection verified;63earlierfrozenpublictrial/reviewfiles plus11completion/scopefiles publishedthroughnormalgates with8originaluserdirtyworktree/indexentriespreserved. R3exactapprovednativeofflineverificationcompletedonce/all3launcherszero/f599unchanged/durablecheckpointandstageremovalindependentlyverified; R2failedhistoryretained, no unchanged-successcredit/promotion/model/profile/queuechange. Warden117fec9241e7b985dfb187b992e173d0a5dc3700 validation published; Rein0b7a9cfdc801d9eccef316852b53fd51ba8daef1 originalHARNESSidentity restored withoutrekey/retire; GLASc8751c97986011284ea4173c9adacc31e1fd9dfc andSANDc7c310266aba96ab7dd03cd8bfcaa65f22a3b66e driverrefs converged; NK3236d5000e52e0643f33906a26a7825aa0b67465 T15currentnarrative converged. User-directedKEY39/infrastructurefinalizationreviewrecorded/published d803e9282a47b49daf930fb905312fa5104c0ace: sourceT01/T03done,T02wait, no nativeclaims/expiry/cleanupreceipt; KEY38/codingcustody/ownerreadiness remain. Correctedsourceandprimaryblocking_reason distinguish originalKEY37registrationcaafe4be from newprobe/codingcustody; no oldapprovalreasked or newgrantinferred. Finalstrictreadonlyaudit:30workplans/211taskbindings,zeroissues,18ownerHEADs=remote, allcheckedIDs/UUID/status/parent/explicitneeds_humanmatchprimary. Elevenlegitimateadditionsvsoriginal200baseline preserved. Earlierrefusalsretained. All16nativetargetgatesremainopen; CUST0080stillactive, no unpromotedresidualimplemented.",
|
||||
"detail": {
|
||||
"goal_status": "active",
|
||||
"final_audit_ref": "docs/changes/netkingdom-target-2026-10-17/native-gates-r2/final-audit-r2/owner-bindings.json",
|
||||
"final_audit_sha256": "sha256:ef812abf65823dc81355c12963cfd55cee2b871a334927b6315c9c65f207d814",
|
||||
"key39_final_task_wording": "docs/changes/netkingdom-target-2026-10-17/key39-finalization-blocking-reason-r1/final-verification.json",
|
||||
"r3_verified_native_result": "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-review-r3/verified-native-result.json",
|
||||
"backup_guide_publication_location": "Backup/railiance-backups/net-kingdom-identity/net-kingdom-recovery-57d1940947aa25ff-START-HERE.md; historical16Octreadback, currentvisibilitynotverified"
|
||||
},
|
||||
"author": "codex",
|
||||
"session_id": null,
|
||||
"created_at": "2026-10-17T11:45:11.533108Z",
|
||||
"workstream_id": "dfadb19b-445e-59c6-bcd6-48e87b912c52"
|
||||
}
|
||||
|
|
@ -0,0 +1,353 @@
|
|||
{
|
||||
"schema": "state-hub.repository-projection-reconcile.v1",
|
||||
"instance_role": "primary",
|
||||
"instance_label": "railiance01",
|
||||
"expected_commit": "d328a2601095686f74376d87791bff01e2a3a2a3",
|
||||
"derived_commit": "d328a2601095686f74376d87791bff01e2a3a2a3",
|
||||
"outcome": {
|
||||
"schema": "state-hub.projection-reset.v1",
|
||||
"repo_slug": "access-engine",
|
||||
"commit": "d328a2601095686f74376d87791bff01e2a3a2a3",
|
||||
"status": "applied",
|
||||
"counts": {
|
||||
"created": 0,
|
||||
"updated": 38,
|
||||
"retired": 0,
|
||||
"refused": 0,
|
||||
"released": 0,
|
||||
"created_tasks": 0,
|
||||
"updated_tasks": 2,
|
||||
"cancelled_tasks": 0,
|
||||
"created_edges": 0,
|
||||
"removed_edges": 0,
|
||||
"unresolved_edges": 0,
|
||||
"external_edges": 27
|
||||
},
|
||||
"created": [],
|
||||
"updated": [
|
||||
"FLEX-WP-0001",
|
||||
"FLEX-WP-0002",
|
||||
"FLEX-WP-0003",
|
||||
"FLEX-WP-0004",
|
||||
"FLEX-WP-0005",
|
||||
"FLEX-WP-0006",
|
||||
"FLEX-WP-0007",
|
||||
"FLEX-WP-0008",
|
||||
"FLEX-WP-0009",
|
||||
"FLEX-WP-0010",
|
||||
"FLEX-WP-0011",
|
||||
"FLEX-WP-0012",
|
||||
"FLEX-WP-0013",
|
||||
"FLEX-WP-0014",
|
||||
"FLEX-WP-0015",
|
||||
"FLEX-WP-0016",
|
||||
"FLEX-WP-0017",
|
||||
"FLEX-WP-0018",
|
||||
"FLEX-WP-0019",
|
||||
"FLEX-WP-0020",
|
||||
"FLEX-WP-0021",
|
||||
"FLEX-WP-0022",
|
||||
"FLEX-WP-0023",
|
||||
"FLEX-WP-0024",
|
||||
"FLEX-WP-0025",
|
||||
"FLEX-WP-0026",
|
||||
"FLEX-WP-0027",
|
||||
"FLEX-WP-0028",
|
||||
"FLEX-WP-0029",
|
||||
"FLEX-WP-0030",
|
||||
"FLEX-WP-0031",
|
||||
"FLEX-WP-0032",
|
||||
"FLEX-WP-0033",
|
||||
"FLEX-WP-0034",
|
||||
"FLEX-WP-0035",
|
||||
"FLEX-WP-0036",
|
||||
"FLEX-WP-ADHOC-2026-10-03",
|
||||
"FLEX-WP-ADHOC-2026-10-11"
|
||||
],
|
||||
"retired": [],
|
||||
"released": [],
|
||||
"created_tasks": [],
|
||||
"updated_tasks": [
|
||||
"FLEX-WP-0024-T05",
|
||||
"FLEX-WP-0024-T06"
|
||||
],
|
||||
"cancelled_tasks": [],
|
||||
"created_edges": [],
|
||||
"removed_edges": [],
|
||||
"unresolved_edges": [],
|
||||
"external_edges": [
|
||||
{
|
||||
"workplan": "FLEX-WP-0008",
|
||||
"from": "FLEX-WP-0008",
|
||||
"target": "FLEX-WP-0007",
|
||||
"relationship_type": "blocks",
|
||||
"from_workplan_id": "1358db95-967c-5a03-8b8c-4816dc106594",
|
||||
"from_task_id": null,
|
||||
"to_workplan_id": "358ce697-2611-4fe9-89ab-63e86ceb00fa",
|
||||
"to_task_id": null
|
||||
},
|
||||
{
|
||||
"workplan": "FLEX-WP-0007",
|
||||
"from": "FLEX-WP-0007",
|
||||
"target": "FLEX-WP-0006",
|
||||
"relationship_type": "blocks",
|
||||
"from_workplan_id": "358ce697-2611-4fe9-89ab-63e86ceb00fa",
|
||||
"from_task_id": null,
|
||||
"to_workplan_id": "bbea4049-8acc-4d7c-8cf5-3106c6b93f7f",
|
||||
"to_task_id": null
|
||||
},
|
||||
{
|
||||
"workplan": "FLEX-WP-0013",
|
||||
"from": "FLEX-WP-0013",
|
||||
"target": "FLEX-WP-0011",
|
||||
"relationship_type": "blocks",
|
||||
"from_workplan_id": "6f22ded6-a69c-531b-bfa6-2f8d5c886979",
|
||||
"from_task_id": null,
|
||||
"to_workplan_id": "deda35b4-f41d-559e-954e-a75f29237f68",
|
||||
"to_task_id": null
|
||||
},
|
||||
{
|
||||
"workplan": "FLEX-WP-0013",
|
||||
"from": "FLEX-WP-0013",
|
||||
"target": "FLEX-WP-0010",
|
||||
"relationship_type": "blocks",
|
||||
"from_workplan_id": "6f22ded6-a69c-531b-bfa6-2f8d5c886979",
|
||||
"from_task_id": null,
|
||||
"to_workplan_id": "fdabae84-dc9e-5ccd-81df-8ae7e66b90b8",
|
||||
"to_task_id": null
|
||||
},
|
||||
{
|
||||
"workplan": "FLEX-WP-0014",
|
||||
"from": "FLEX-WP-0014",
|
||||
"target": "FLEX-WP-0013",
|
||||
"relationship_type": "blocks",
|
||||
"from_workplan_id": "7de17bd2-5e7c-5355-ba1d-40a051a67746",
|
||||
"from_task_id": null,
|
||||
"to_workplan_id": "6f22ded6-a69c-531b-bfa6-2f8d5c886979",
|
||||
"to_task_id": null
|
||||
},
|
||||
{
|
||||
"workplan": "FLEX-WP-0014",
|
||||
"from": "FLEX-WP-0014",
|
||||
"target": "FLEX-WP-0010",
|
||||
"relationship_type": "blocks",
|
||||
"from_workplan_id": "7de17bd2-5e7c-5355-ba1d-40a051a67746",
|
||||
"from_task_id": null,
|
||||
"to_workplan_id": "fdabae84-dc9e-5ccd-81df-8ae7e66b90b8",
|
||||
"to_task_id": null
|
||||
},
|
||||
{
|
||||
"workplan": "FLEX-WP-0022",
|
||||
"from": "FLEX-WP-0022",
|
||||
"target": "FLEX-WP-0021",
|
||||
"relationship_type": "blocks",
|
||||
"from_workplan_id": "804c588c-f47a-50c4-bdd7-51b24bbf9539",
|
||||
"from_task_id": null,
|
||||
"to_workplan_id": "b01f655e-f71a-50ae-b110-178557f07c63",
|
||||
"to_task_id": null
|
||||
},
|
||||
{
|
||||
"workplan": "FLEX-WP-0031",
|
||||
"from": "FLEX-WP-0031-T04",
|
||||
"target": "FLEX-WP-0031-T06",
|
||||
"relationship_type": "starts_after",
|
||||
"from_workplan_id": "84f5d9fe-b4c9-584a-b964-efe3e48af095",
|
||||
"from_task_id": "423b3090-1b72-58fd-9353-5c907c7683bb",
|
||||
"to_workplan_id": null,
|
||||
"to_task_id": "bf92a951-3b69-59dd-8907-f6748c91a264"
|
||||
},
|
||||
{
|
||||
"workplan": "FLEX-WP-0031",
|
||||
"from": "FLEX-WP-0031-T06",
|
||||
"target": "FLEX-WP-0031-T02",
|
||||
"relationship_type": "starts_after",
|
||||
"from_workplan_id": "84f5d9fe-b4c9-584a-b964-efe3e48af095",
|
||||
"from_task_id": "bf92a951-3b69-59dd-8907-f6748c91a264",
|
||||
"to_workplan_id": null,
|
||||
"to_task_id": "89661908-ca9a-5e4a-a0a5-62d1a9e02568"
|
||||
},
|
||||
{
|
||||
"workplan": "FLEX-WP-0024",
|
||||
"from": "FLEX-WP-0024",
|
||||
"target": "FLEX-WP-0021",
|
||||
"relationship_type": "blocks",
|
||||
"from_workplan_id": "90577acd-6910-548d-a13e-1dbfdfb8ed27",
|
||||
"from_task_id": null,
|
||||
"to_workplan_id": "b01f655e-f71a-50ae-b110-178557f07c63",
|
||||
"to_task_id": null
|
||||
},
|
||||
{
|
||||
"workplan": "FLEX-WP-0004",
|
||||
"from": "FLEX-WP-0004",
|
||||
"target": "FLEX-WP-0002",
|
||||
"relationship_type": "blocks",
|
||||
"from_workplan_id": "99a82976-d376-42b0-89cc-c44e01c0bec6",
|
||||
"from_task_id": null,
|
||||
"to_workplan_id": "aa60e183-9a87-4e03-99b0-15786bfa11ae",
|
||||
"to_task_id": null
|
||||
},
|
||||
{
|
||||
"workplan": "FLEX-WP-0002",
|
||||
"from": "FLEX-WP-0002",
|
||||
"target": "FLEX-WP-0001",
|
||||
"relationship_type": "blocks",
|
||||
"from_workplan_id": "aa60e183-9a87-4e03-99b0-15786bfa11ae",
|
||||
"from_task_id": null,
|
||||
"to_workplan_id": "4dbefd19-bb7d-405c-9a50-e7dbd11cf4d9",
|
||||
"to_task_id": null
|
||||
},
|
||||
{
|
||||
"workplan": "FLEX-WP-0002",
|
||||
"from": "FLEX-WP-0002",
|
||||
"target": "FLEX-WP-0005",
|
||||
"relationship_type": "blocks",
|
||||
"from_workplan_id": "aa60e183-9a87-4e03-99b0-15786bfa11ae",
|
||||
"from_task_id": null,
|
||||
"to_workplan_id": "e37d42a9-0018-4a67-a672-ff4e9716b338",
|
||||
"to_task_id": null
|
||||
},
|
||||
{
|
||||
"workplan": "FLEX-WP-0023",
|
||||
"from": "FLEX-WP-0023",
|
||||
"target": "FLEX-WP-0021",
|
||||
"relationship_type": "blocks",
|
||||
"from_workplan_id": "ad011f92-786c-51ad-b3f6-c06ad77e7af7",
|
||||
"from_task_id": null,
|
||||
"to_workplan_id": "b01f655e-f71a-50ae-b110-178557f07c63",
|
||||
"to_task_id": null
|
||||
},
|
||||
{
|
||||
"workplan": "FLEX-WP-0036",
|
||||
"from": "FLEX-WP-0036-T03",
|
||||
"target": "RPF-WP-0044-T07",
|
||||
"relationship_type": "starts_after",
|
||||
"from_workplan_id": "af0f8d77-af04-569b-8e79-6c47eb8f1087",
|
||||
"from_task_id": "487525e5-c89e-586e-8e9b-54ac6da0804e",
|
||||
"to_workplan_id": null,
|
||||
"to_task_id": "844ff115-def2-55ca-ab01-413ba7e6857d"
|
||||
},
|
||||
{
|
||||
"workplan": "FLEX-WP-0036",
|
||||
"from": "FLEX-WP-0036-T03",
|
||||
"target": "FLEX-WP-0036-T04",
|
||||
"relationship_type": "starts_after",
|
||||
"from_workplan_id": "af0f8d77-af04-569b-8e79-6c47eb8f1087",
|
||||
"from_task_id": "487525e5-c89e-586e-8e9b-54ac6da0804e",
|
||||
"to_workplan_id": null,
|
||||
"to_task_id": "ff7fd369-326f-5044-aaa4-96c5f45c80e9"
|
||||
},
|
||||
{
|
||||
"workplan": "FLEX-WP-0021",
|
||||
"from": "FLEX-WP-0021",
|
||||
"target": "FLEX-WP-0012",
|
||||
"relationship_type": "blocks",
|
||||
"from_workplan_id": "b01f655e-f71a-50ae-b110-178557f07c63",
|
||||
"from_task_id": null,
|
||||
"to_workplan_id": "2a6b5764-1831-5305-b46e-0991d02675df",
|
||||
"to_task_id": null
|
||||
},
|
||||
{
|
||||
"workplan": "FLEX-WP-0021",
|
||||
"from": "FLEX-WP-0021",
|
||||
"target": "FLEX-WP-0016",
|
||||
"relationship_type": "blocks",
|
||||
"from_workplan_id": "b01f655e-f71a-50ae-b110-178557f07c63",
|
||||
"from_task_id": null,
|
||||
"to_workplan_id": "f29f159c-c79e-5c78-b1e8-569a5b63d231",
|
||||
"to_task_id": null
|
||||
},
|
||||
{
|
||||
"workplan": "FLEX-WP-0006",
|
||||
"from": "FLEX-WP-0006",
|
||||
"target": "FLEX-WP-0002",
|
||||
"relationship_type": "blocks",
|
||||
"from_workplan_id": "bbea4049-8acc-4d7c-8cf5-3106c6b93f7f",
|
||||
"from_task_id": null,
|
||||
"to_workplan_id": "aa60e183-9a87-4e03-99b0-15786bfa11ae",
|
||||
"to_task_id": null
|
||||
},
|
||||
{
|
||||
"workplan": "FLEX-WP-0006",
|
||||
"from": "FLEX-WP-0006",
|
||||
"target": "FLEX-WP-0005",
|
||||
"relationship_type": "blocks",
|
||||
"from_workplan_id": "bbea4049-8acc-4d7c-8cf5-3106c6b93f7f",
|
||||
"from_task_id": null,
|
||||
"to_workplan_id": "e37d42a9-0018-4a67-a672-ff4e9716b338",
|
||||
"to_task_id": null
|
||||
},
|
||||
{
|
||||
"workplan": "FLEX-WP-0003",
|
||||
"from": "FLEX-WP-0003",
|
||||
"target": "FLEX-WP-0002",
|
||||
"relationship_type": "blocks",
|
||||
"from_workplan_id": "c0a6c9f6-bb6b-416d-b537-f30504c63d75",
|
||||
"from_task_id": null,
|
||||
"to_workplan_id": "aa60e183-9a87-4e03-99b0-15786bfa11ae",
|
||||
"to_task_id": null
|
||||
},
|
||||
{
|
||||
"workplan": "FLEX-WP-0011",
|
||||
"from": "FLEX-WP-0011",
|
||||
"target": "FLEX-WP-0009",
|
||||
"relationship_type": "blocks",
|
||||
"from_workplan_id": "deda35b4-f41d-559e-954e-a75f29237f68",
|
||||
"from_task_id": null,
|
||||
"to_workplan_id": "390da58d-3c58-5102-bd3c-7133956c810e",
|
||||
"to_task_id": null
|
||||
},
|
||||
{
|
||||
"workplan": "FLEX-WP-0005",
|
||||
"from": "FLEX-WP-0005",
|
||||
"target": "FLEX-WP-0001",
|
||||
"relationship_type": "blocks",
|
||||
"from_workplan_id": "e37d42a9-0018-4a67-a672-ff4e9716b338",
|
||||
"from_task_id": null,
|
||||
"to_workplan_id": "4dbefd19-bb7d-405c-9a50-e7dbd11cf4d9",
|
||||
"to_task_id": null
|
||||
},
|
||||
{
|
||||
"workplan": "FLEX-WP-0016",
|
||||
"from": "FLEX-WP-0016",
|
||||
"target": "FLEX-WP-0007",
|
||||
"relationship_type": "blocks",
|
||||
"from_workplan_id": "f29f159c-c79e-5c78-b1e8-569a5b63d231",
|
||||
"from_task_id": null,
|
||||
"to_workplan_id": "358ce697-2611-4fe9-89ab-63e86ceb00fa",
|
||||
"to_task_id": null
|
||||
},
|
||||
{
|
||||
"workplan": "FLEX-WP-0016",
|
||||
"from": "FLEX-WP-0016",
|
||||
"target": "FLEX-WP-0015",
|
||||
"relationship_type": "blocks",
|
||||
"from_workplan_id": "f29f159c-c79e-5c78-b1e8-569a5b63d231",
|
||||
"from_task_id": null,
|
||||
"to_workplan_id": "43fe348c-02b9-5d5d-af37-a2d80cfc6e1d",
|
||||
"to_task_id": null
|
||||
},
|
||||
{
|
||||
"workplan": "FLEX-WP-0025",
|
||||
"from": "FLEX-WP-0025",
|
||||
"target": "FLEX-WP-0021",
|
||||
"relationship_type": "blocks",
|
||||
"from_workplan_id": "f9a657ce-67b4-5d25-9933-e0fcb2c20b1c",
|
||||
"from_task_id": null,
|
||||
"to_workplan_id": "b01f655e-f71a-50ae-b110-178557f07c63",
|
||||
"to_task_id": null
|
||||
},
|
||||
{
|
||||
"workplan": "FLEX-WP-0010",
|
||||
"from": "FLEX-WP-0010",
|
||||
"target": "FLEX-WP-0008",
|
||||
"relationship_type": "blocks",
|
||||
"from_workplan_id": "fdabae84-dc9e-5ccd-81df-8ae7e66b90b8",
|
||||
"from_task_id": null,
|
||||
"to_workplan_id": "1358db95-967c-5a03-8b8c-4816dc106594",
|
||||
"to_task_id": null
|
||||
}
|
||||
],
|
||||
"refused": [],
|
||||
"notes": []
|
||||
}
|
||||
}
|
||||
|
|
@ -0,0 +1,201 @@
|
|||
{
|
||||
"schema": "state-hub.repository-projection-reconcile.v1",
|
||||
"instance_role": "primary",
|
||||
"instance_label": "railiance01",
|
||||
"expected_commit": "f9f8df039258a0d8b6fc29dc1f7c4bcc75fdc8c0",
|
||||
"derived_commit": "f9f8df039258a0d8b6fc29dc1f7c4bcc75fdc8c0",
|
||||
"outcome": {
|
||||
"schema": "state-hub.projection-reset.v1",
|
||||
"repo_slug": "activity-core",
|
||||
"commit": "f9f8df039258a0d8b6fc29dc1f7c4bcc75fdc8c0",
|
||||
"status": "applied",
|
||||
"counts": {
|
||||
"created": 0,
|
||||
"updated": 47,
|
||||
"retired": 0,
|
||||
"refused": 0,
|
||||
"released": 0,
|
||||
"created_tasks": 0,
|
||||
"updated_tasks": 6,
|
||||
"cancelled_tasks": 0,
|
||||
"created_edges": 0,
|
||||
"removed_edges": 0,
|
||||
"unresolved_edges": 0,
|
||||
"external_edges": 10
|
||||
},
|
||||
"created": [],
|
||||
"updated": [
|
||||
"ACTIVITY-WP-0005",
|
||||
"ACTIVITY-WP-0006",
|
||||
"ACTIVITY-WP-0007",
|
||||
"ACTIVITY-WP-0008",
|
||||
"ACTIVITY-WP-0009",
|
||||
"ACTIVITY-WP-0010",
|
||||
"ACTIVITY-WP-0011",
|
||||
"ACTIVITY-WP-0012",
|
||||
"ACTIVITY-WP-0013",
|
||||
"ACTIVITY-WP-0014",
|
||||
"ACTIVITY-WP-0015",
|
||||
"ACTIVITY-WP-0016",
|
||||
"ACTIVITY-WP-0017",
|
||||
"ACTIVITY-WP-0018",
|
||||
"ACTIVITY-WP-0019",
|
||||
"ACTIVITY-WP-0020",
|
||||
"ACTIVITY-WP-0021",
|
||||
"ACTIVITY-WP-0022",
|
||||
"ACTIVITY-WP-0023",
|
||||
"ACTIVITY-WP-0024",
|
||||
"ACTIVITY-WP-0025",
|
||||
"ACTIVITY-WP-0026",
|
||||
"ACTIVITY-WP-0027",
|
||||
"ACTIVITY-WP-0028",
|
||||
"ACTIVITY-WP-0029",
|
||||
"ACTIVITY-WP-0030",
|
||||
"ACTIVITY-WP-0031",
|
||||
"ACTIVITY-WP-0032",
|
||||
"ACTIVITY-WP-0033",
|
||||
"ACTIVITY-WP-0034",
|
||||
"ACTIVITY-WP-0035",
|
||||
"ACTIVITY-WP-0036",
|
||||
"ACTIVITY-WP-0037",
|
||||
"ACTIVITY-WP-0038",
|
||||
"ACTIVITY-WP-0039",
|
||||
"ACTIVITY-WP-0040",
|
||||
"ACTIVITY-WP-0041",
|
||||
"ACTIVITY-WP-0042",
|
||||
"ACTIVITY-WP-0043",
|
||||
"ACTIVITY-WP-0044",
|
||||
"ACTIVITY-WP-0045",
|
||||
"ACTIVITY-WP-0046",
|
||||
"ACTIVITY-WP-0047",
|
||||
"ACTIVITY-WP-ADHOC-2026-06-01",
|
||||
"ACTIVITY-WP-ADHOC-2026-08-20",
|
||||
"ACTIVITY-WP-ADHOC-2026-08-23",
|
||||
"ACTIVITY-WP-ADHOC-2026-09-14"
|
||||
],
|
||||
"retired": [],
|
||||
"released": [],
|
||||
"created_tasks": [],
|
||||
"updated_tasks": [
|
||||
"ACTIVITY-WP-0046-T01",
|
||||
"ACTIVITY-WP-0046-T02",
|
||||
"ACTIVITY-WP-0046-T03",
|
||||
"ACTIVITY-WP-0047-T01",
|
||||
"ACTIVITY-WP-0047-T02",
|
||||
"ACTIVITY-WP-0047-T03"
|
||||
],
|
||||
"cancelled_tasks": [],
|
||||
"created_edges": [],
|
||||
"removed_edges": [],
|
||||
"unresolved_edges": [],
|
||||
"external_edges": [
|
||||
{
|
||||
"workplan": "ACTIVITY-WP-0041",
|
||||
"from": "ACTIVITY-WP-0041-T02",
|
||||
"target": "RPF-WP-0048-T02",
|
||||
"relationship_type": "starts_after",
|
||||
"from_workplan_id": "12798750-3eee-5d81-a411-c3c4c5ce2d2c",
|
||||
"from_task_id": "af09865d-8cc9-5571-9c34-20ae679a1e4e",
|
||||
"to_workplan_id": null,
|
||||
"to_task_id": "63b44949-39f8-52fd-ab63-e618b67ef992"
|
||||
},
|
||||
{
|
||||
"workplan": "ACTIVITY-WP-0028",
|
||||
"from": "ACTIVITY-WP-0028",
|
||||
"target": "ACTIVITY-WP-0018",
|
||||
"relationship_type": "blocks",
|
||||
"from_workplan_id": "1f99bf6f-5180-5e4e-b9a5-5137c48d84c4",
|
||||
"from_task_id": null,
|
||||
"to_workplan_id": "0220b38b-7c73-4601-9601-5f2c1a5b29e8",
|
||||
"to_task_id": null
|
||||
},
|
||||
{
|
||||
"workplan": "ACTIVITY-WP-0028",
|
||||
"from": "ACTIVITY-WP-0028",
|
||||
"target": "ACTIVITY-WP-0024",
|
||||
"relationship_type": "blocks",
|
||||
"from_workplan_id": "1f99bf6f-5180-5e4e-b9a5-5137c48d84c4",
|
||||
"from_task_id": null,
|
||||
"to_workplan_id": "555c6bb2-73e2-579b-837b-a7df0daad621",
|
||||
"to_task_id": null
|
||||
},
|
||||
{
|
||||
"workplan": "ACTIVITY-WP-0028",
|
||||
"from": "ACTIVITY-WP-0028",
|
||||
"target": "ACTIVITY-WP-0027",
|
||||
"relationship_type": "blocks",
|
||||
"from_workplan_id": "1f99bf6f-5180-5e4e-b9a5-5137c48d84c4",
|
||||
"from_task_id": null,
|
||||
"to_workplan_id": "bf348869-6e24-5034-a7b8-d2ce3266d5a0",
|
||||
"to_task_id": null
|
||||
},
|
||||
{
|
||||
"workplan": "ACTIVITY-WP-0032",
|
||||
"from": "ACTIVITY-WP-0032-T05",
|
||||
"target": "GLAS-WP-0012",
|
||||
"relationship_type": "blocks",
|
||||
"from_workplan_id": "256dad13-28b4-5361-ab8a-7d1373a5d14b",
|
||||
"from_task_id": "e71423f9-8baf-566b-8a70-eec195e2f65f",
|
||||
"to_workplan_id": "170bf1ae-337f-5553-8d1e-03b07100e08f",
|
||||
"to_task_id": null
|
||||
},
|
||||
{
|
||||
"workplan": "ACTIVITY-WP-0027",
|
||||
"from": "ACTIVITY-WP-0027",
|
||||
"target": "ACTIVITY-WP-0025",
|
||||
"relationship_type": "blocks",
|
||||
"from_workplan_id": "bf348869-6e24-5034-a7b8-d2ce3266d5a0",
|
||||
"from_task_id": null,
|
||||
"to_workplan_id": "347cad20-d66c-5151-b577-50eb93a85023",
|
||||
"to_task_id": null
|
||||
},
|
||||
{
|
||||
"workplan": "ACTIVITY-WP-0027",
|
||||
"from": "ACTIVITY-WP-0027",
|
||||
"target": "ACTIVITY-WP-0024",
|
||||
"relationship_type": "blocks",
|
||||
"from_workplan_id": "bf348869-6e24-5034-a7b8-d2ce3266d5a0",
|
||||
"from_task_id": null,
|
||||
"to_workplan_id": "555c6bb2-73e2-579b-837b-a7df0daad621",
|
||||
"to_task_id": null
|
||||
},
|
||||
{
|
||||
"workplan": "ACTIVITY-WP-0027",
|
||||
"from": "ACTIVITY-WP-0027",
|
||||
"target": "ACTIVITY-WP-0026",
|
||||
"relationship_type": "blocks",
|
||||
"from_workplan_id": "bf348869-6e24-5034-a7b8-d2ce3266d5a0",
|
||||
"from_task_id": null,
|
||||
"to_workplan_id": "d05e49dd-dbc9-59f4-bbc8-8bfced64d4a8",
|
||||
"to_task_id": null
|
||||
},
|
||||
{
|
||||
"workplan": "ACTIVITY-WP-0042",
|
||||
"from": "ACTIVITY-WP-0042-T02",
|
||||
"target": "ACTIVITY-WP-0042-T01",
|
||||
"relationship_type": "starts_after",
|
||||
"from_workplan_id": "e1bfb5a4-e647-592d-883f-fe8728ad2f5f",
|
||||
"from_task_id": "250c6e8e-7281-5dec-9a92-06081b8c96bb",
|
||||
"to_workplan_id": null,
|
||||
"to_task_id": "2a368988-2611-596a-a847-82c048bd179e"
|
||||
},
|
||||
{
|
||||
"workplan": "ACTIVITY-WP-0042",
|
||||
"from": "ACTIVITY-WP-0042-T02",
|
||||
"target": "ACTIVITY-WP-0042-T05",
|
||||
"relationship_type": "starts_after",
|
||||
"from_workplan_id": "e1bfb5a4-e647-592d-883f-fe8728ad2f5f",
|
||||
"from_task_id": "250c6e8e-7281-5dec-9a92-06081b8c96bb",
|
||||
"to_workplan_id": null,
|
||||
"to_task_id": "a2d95c80-bfc5-54b7-9987-ad3571d9c75f"
|
||||
}
|
||||
],
|
||||
"refused": [],
|
||||
"notes": [
|
||||
"Preserved bound historical row and task UUIDs: custodian-WP-0001",
|
||||
"Preserved bound historical row and task UUIDs: custodian-WP-0002",
|
||||
"Preserved bound historical row and task UUIDs: custodian-WP-0003",
|
||||
"Preserved bound historical row and task UUIDs: custodian-WP-0004"
|
||||
]
|
||||
}
|
||||
}
|
||||
|
|
@ -0,0 +1,63 @@
|
|||
{
|
||||
"schema": "state-hub.repository-projection-reconcile.v1",
|
||||
"instance_role": "primary",
|
||||
"instance_label": "railiance01",
|
||||
"expected_commit": "d40e842052f449ce2b5aa68abae1351720dbf41e",
|
||||
"derived_commit": "d40e842052f449ce2b5aa68abae1351720dbf41e",
|
||||
"outcome": {
|
||||
"schema": "state-hub.projection-reset.v1",
|
||||
"repo_slug": "approval-engine",
|
||||
"commit": "d40e842052f449ce2b5aa68abae1351720dbf41e",
|
||||
"status": "applied",
|
||||
"counts": {
|
||||
"created": 0,
|
||||
"updated": 9,
|
||||
"retired": 0,
|
||||
"refused": 0,
|
||||
"released": 0,
|
||||
"created_tasks": 1,
|
||||
"updated_tasks": 10,
|
||||
"cancelled_tasks": 0,
|
||||
"created_edges": 0,
|
||||
"removed_edges": 0,
|
||||
"unresolved_edges": 0,
|
||||
"external_edges": 0
|
||||
},
|
||||
"created": [],
|
||||
"updated": [
|
||||
"APPROVAL-WP-0001",
|
||||
"APPROVAL-WP-0002",
|
||||
"APPROVAL-WP-0003",
|
||||
"APPROVAL-WP-0004",
|
||||
"APPROVAL-WP-0005",
|
||||
"APPROVAL-WP-0006",
|
||||
"APPROVAL-WP-ADHOC-2026-10-10",
|
||||
"APPROVAL-WP-ADHOC-2026-10-11",
|
||||
"APPROVAL-WP-ADHOC-2026-10-16"
|
||||
],
|
||||
"retired": [],
|
||||
"released": [],
|
||||
"created_tasks": [
|
||||
"APPROVAL-WP-ADHOC-2026-10-11-T02"
|
||||
],
|
||||
"updated_tasks": [
|
||||
"APPROVAL-WP-0004-T01",
|
||||
"APPROVAL-WP-0004-T02",
|
||||
"APPROVAL-WP-0005-T01",
|
||||
"APPROVAL-WP-0005-T02",
|
||||
"APPROVAL-WP-0005-T03",
|
||||
"APPROVAL-WP-0006-T01",
|
||||
"APPROVAL-WP-0006-T02",
|
||||
"APPROVAL-WP-ADHOC-2026-10-10-T01",
|
||||
"APPROVAL-WP-ADHOC-2026-10-11-T01",
|
||||
"APPROVAL-WP-ADHOC-2026-10-16-T01"
|
||||
],
|
||||
"cancelled_tasks": [],
|
||||
"created_edges": [],
|
||||
"removed_edges": [],
|
||||
"unresolved_edges": [],
|
||||
"external_edges": [],
|
||||
"refused": [],
|
||||
"notes": []
|
||||
}
|
||||
}
|
||||
File diff suppressed because it is too large
Load diff
|
|
@ -0,0 +1,12 @@
|
|||
{
|
||||
"status": "prepared_waiting_for_root_final_signal_not_executed",
|
||||
"baseline_files": 30,
|
||||
"counts_policy": "derive current per-file task counts dynamically; baseline counts are informational only",
|
||||
"adapted_from": "docs/changes/netkingdom-target-2026-10-17/native-gates-r2/verify.py",
|
||||
"adapted_source_sha256": "sha256:f2267a6b908b97b5be215ddc81ffd56f67d0f4d9fba285de9f9dddacec1b13c1",
|
||||
"new_verifier_sha256": "sha256:595203988f16b46100b7fd82ba1df9d5cc9f9adc2eb89275539320d3b70f1f58",
|
||||
"writes": "new final-audit-r1 result path only, refusing to overwrite existing result",
|
||||
"live_api_mode": "read-only snapshots and health",
|
||||
"remote_mode": "read-only git ls-remote per current branch",
|
||||
"native_gate_acceptance": false
|
||||
}
|
||||
|
|
@ -0,0 +1,11 @@
|
|||
{
|
||||
"status": "retained_transient_source_publication_pending",
|
||||
"observed_at": "2026-10-17T11:35:07.164634+00:00",
|
||||
"result_sha256": "sha256:19184188e3115353657756aed30275d16e2cae48bd5f19219c75f3a4f1dca6f0",
|
||||
"verifier_sha256": "sha256:595203988f16b46100b7fd82ba1df9d5cc9f9adc2eb89275539320d3b70f1f58",
|
||||
"workplans": 30,
|
||||
"task_bindings": 211,
|
||||
"issue_count": 9,
|
||||
"native_target_gates_closed": 0,
|
||||
"expected_next_step": "Wait for canonical NK source publication/receiving; fresh successor result only, no cache write by auditor."
|
||||
}
|
||||
|
|
@ -0,0 +1,120 @@
|
|||
"""Read-only owner-source and primary projection check after source checkpoints."""
|
||||
from concurrent.futures import ThreadPoolExecutor
|
||||
from datetime import datetime, timezone
|
||||
from pathlib import Path
|
||||
import hashlib
|
||||
import json
|
||||
import re
|
||||
import subprocess
|
||||
import urllib.request
|
||||
import yaml
|
||||
|
||||
HERE = Path(__file__).resolve().parent
|
||||
PRIOR = HERE.parents[1] / 'native-gates-r1/native-gate-audit.json'
|
||||
prior = json.loads(PRIOR.read_text())
|
||||
def get(path):
|
||||
return json.load(urllib.request.urlopen('http://127.0.0.1:8000' + path, timeout=30))
|
||||
def git(root, *args):
|
||||
return subprocess.check_output(['git', '--no-optional-locks', '-C', str(root), *args], stderr=subprocess.PIPE).decode().strip()
|
||||
health = get('/state/health')
|
||||
assert (health['instance_role'], health['instance_label']) == ('primary', 'railiance01')
|
||||
repos = sorted({Path(r['path']).parents[1].name for r in prior['owner_refs']})
|
||||
with ThreadPoolExecutor(max_workers=4) as pool:
|
||||
snapshots = dict(zip(repos, pool.map(lambda repo: get('/repos/' + repo + '/work-record-projection/snapshot'), repos)))
|
||||
heads = {repo: git(Path('/home/worsch') / repo, 'rev-parse', 'HEAD') for repo in repos}
|
||||
def remote_head(repo):
|
||||
root = Path('/home/worsch') / repo
|
||||
branch = git(root, 'symbolic-ref', '--short', 'HEAD')
|
||||
result = subprocess.run(['git', '--no-optional-locks', '-C', str(root), 'ls-remote',
|
||||
'origin', 'refs/heads/' + branch],
|
||||
capture_output=True, text=True, timeout=45)
|
||||
if result.returncode or len(result.stdout.splitlines()) != 1:
|
||||
return {'branch': branch, 'status': 'unverified', 'remote_commit': None}
|
||||
return {'branch': branch, 'status': 'verified', 'remote_commit': result.stdout.split()[0]}
|
||||
with ThreadPoolExecutor(max_workers=4) as pool:
|
||||
remotes = dict(zip(repos, pool.map(remote_head, repos)))
|
||||
baseline_tasks = {task['uuid']: task for group in prior['hub_validation']['checks']
|
||||
for task in group.get('tasks', [])}
|
||||
|
||||
rows = []
|
||||
issues = []
|
||||
for repo in repos:
|
||||
if remotes[repo]['status'] != 'verified' or remotes[repo]['remote_commit'] != heads[repo]:
|
||||
issues.append({'repo': repo, 'field': 'source_head_remote_mismatch',
|
||||
'source': heads[repo], 'actual': remotes[repo]})
|
||||
new_source_tasks = []
|
||||
existing_source_deltas = []
|
||||
for ref in prior['owner_refs']:
|
||||
path = Path(ref['path']); root = path.parents[1]; repo = root.name
|
||||
raw = path.read_text(); front = yaml.safe_load(raw.split('---', 2)[1])
|
||||
if git(root, 'show', heads[repo] + ':' + str(path.relative_to(root))) != raw.strip():
|
||||
issues.append({'repo': repo, 'record': front['id'], 'field': 'source_not_committed',
|
||||
'source': str(path), 'actual': heads[repo]})
|
||||
tasks = [yaml.safe_load(s) for s in re.findall(r'```task\n(.*?)\n```', raw, re.S)]
|
||||
snapshot = snapshots[repo]
|
||||
plan = next(p for p in snapshot['workplans'] if p['id'] == front['state_hub_workstream_id'])
|
||||
if plan.get('projection_retired_at') is not None:
|
||||
issues.append({'repo': repo, 'record': front['id'], 'field': 'unexpected_projection_retirement',
|
||||
'actual': plan.get('projection_retired_at')})
|
||||
if plan['status'] != front['status']:
|
||||
issues.append({'repo': repo, 'record': front['id'], 'field': 'status', 'source': front['status'], 'actual': plan['status']})
|
||||
actual = [t for t in snapshot['tasks'] if t.get('workplan_id', t.get('workstream_id')) == plan['id']]
|
||||
if len(actual) != len(tasks):
|
||||
issues.append({'repo': repo, 'record': front['id'], 'field': 'task_count', 'source': len(tasks), 'actual': len(actual)})
|
||||
byid = {t['id']: t for t in actual}
|
||||
for task in tasks:
|
||||
baseline = baseline_tasks.get(task['state_hub_task_id'])
|
||||
if baseline is None:
|
||||
new_source_tasks.append({'repo': repo, 'workplan': front['id'],
|
||||
'record_id': task['id'], 'uuid': task['state_hub_task_id'],
|
||||
'status': task['status']})
|
||||
elif baseline['id'] != task['id'] or baseline.get('source_status') != task['status']:
|
||||
existing_source_deltas.append({'repo': repo, 'uuid': task['state_hub_task_id'],
|
||||
'baseline_record_id': baseline['id'], 'record_id': task['id'],
|
||||
'baseline_status': baseline.get('source_status'),
|
||||
'status': task['status']})
|
||||
t = byid.get(task['state_hub_task_id'])
|
||||
if t is None:
|
||||
issues.append({'repo': repo, 'record': task['id'], 'field': 'uuid_or_parent', 'source': task['state_hub_task_id'], 'actual': None})
|
||||
continue
|
||||
for field, expected in [('record_id', task['id']), ('status', task['status'])]:
|
||||
if t.get(field) != expected:
|
||||
issues.append({'repo': repo, 'record': task['id'], 'uuid': t['id'], 'field': field, 'source': expected, 'actual': t.get(field)})
|
||||
if 'needs_human' in task:
|
||||
if bool(t.get('needs_human')) != bool(task['needs_human']):
|
||||
issues.append({'repo': repo, 'record': task['id'], 'field': 'needs_human', 'source': bool(task['needs_human']), 'actual': bool(t.get('needs_human'))})
|
||||
rows.append({'repo': repo, 'workplan': front['id'], 'commit': heads[repo],
|
||||
'path': str(path), 'sha256': hashlib.sha256(path.read_bytes()).hexdigest(),
|
||||
'status': front['status'], 'flavor': front.get('flavor'),
|
||||
'workplan_uuid': front['state_hub_workstream_id'],
|
||||
'remote': remotes[repo],
|
||||
'tasks': [{'record_id': task['id'], 'uuid': task['state_hub_task_id'],
|
||||
'source_status': task['status'],
|
||||
'hub_record_id': byid.get(task['state_hub_task_id'], {}).get('record_id'),
|
||||
'hub_status': byid.get(task['state_hub_task_id'], {}).get('status'),
|
||||
'hub_parent_uuid': byid.get(task['state_hub_task_id'], {}).get('workplan_id',
|
||||
byid.get(task['state_hub_task_id'], {}).get('workstream_id')),
|
||||
'needs_human_explicit_in_source': 'needs_human' in task,
|
||||
'source_needs_human': bool(task['needs_human']) if 'needs_human' in task else None,
|
||||
'hub_needs_human': byid.get(task['state_hub_task_id'], {}).get('needs_human')}
|
||||
for task in tasks]})
|
||||
out = {'schema': 'custodian.native-owner-binding-audit.v2',
|
||||
'observed_at': datetime.now(timezone.utc).isoformat(), 'status': 'verified' if not issues else 'refused',
|
||||
'primary': 'primary/railiance01', 'workplans': len(rows),
|
||||
'task_bindings': sum(len(r['tasks']) for r in rows), 'rows': rows,
|
||||
'prior_audit_sha256': hashlib.sha256(PRIOR.read_bytes()).hexdigest(),
|
||||
'scope': 'Current source/primary workplan status, task UUID, status, parent and explicit human flag only; no new native gate acceptance inferred.',
|
||||
'native_target_gates_closed': 0, 'issues': issues,
|
||||
'source_counts_derived_dynamically': True,
|
||||
'baseline_task_bindings': len(baseline_tasks),
|
||||
'new_canonical_source_tasks_since_baseline': new_source_tasks,
|
||||
'existing_source_deltas_since_baseline_informational': existing_source_deltas,
|
||||
'owner_heads_and_remotes': [{'repo': repo, 'head': heads[repo], **remotes[repo]} for repo in repos],
|
||||
'verifier_source_sha256': hashlib.sha256(Path(__file__).read_bytes()).hexdigest()}
|
||||
|
||||
destination = 'owner-bindings.json' if not issues else 'owner-bindings-refused-r2.json'
|
||||
assert not (HERE / destination).exists(), 'never overwrite an earlier audit result'
|
||||
(HERE / destination).write_text(json.dumps(out, indent=2) + '\n')
|
||||
print(json.dumps({**{k: out[k] for k in ['status', 'workplans', 'task_bindings', 'native_target_gates_closed']},
|
||||
'issues': issues}))
|
||||
raise SystemExit(bool(issues))
|
||||
File diff suppressed because it is too large
Load diff
|
|
@ -0,0 +1,7 @@
|
|||
{
|
||||
"status": "prepared_waiting_for_NK_publication_signal",
|
||||
"copied_verifier_sha256": "sha256:595203988f16b46100b7fd82ba1df9d5cc9f9adc2eb89275539320d3b70f1f58",
|
||||
"retained_prior_refusal": "docs/changes/netkingdom-target-2026-10-17/native-gates-r2/final-audit-r1/owner-bindings-refused-r2.json",
|
||||
"retained_prior_refusal_sha256": "sha256:19184188e3115353657756aed30275d16e2cae48bd5f19219c75f3a4f1dca6f0",
|
||||
"execution_or_cache_mutation": false
|
||||
}
|
||||
|
|
@ -0,0 +1,146 @@
|
|||
{
|
||||
"schema": "custodian.native-owner-binding-audit-receipt.v1",
|
||||
"status": "verified",
|
||||
"observed_at": "2026-10-17T11:44:25.846988+00:00",
|
||||
"scope": "Current source/primary workplan status, task UUID, status, parent and explicit human flag only; no new native gate acceptance inferred.",
|
||||
"workplans": 30,
|
||||
"task_bindings": 211,
|
||||
"issues": 0,
|
||||
"native_target_gates_closed": 0,
|
||||
"source_and_cache_mutations": false,
|
||||
"source_owner_heads_and_remotes": [
|
||||
{
|
||||
"repo": "access-engine",
|
||||
"head": "d328a2601095686f74376d87791bff01e2a3a2a3",
|
||||
"branch": "main",
|
||||
"status": "verified",
|
||||
"remote_commit": "d328a2601095686f74376d87791bff01e2a3a2a3"
|
||||
},
|
||||
{
|
||||
"repo": "activity-core",
|
||||
"head": "f9f8df039258a0d8b6fc29dc1f7c4bcc75fdc8c0",
|
||||
"branch": "main",
|
||||
"status": "verified",
|
||||
"remote_commit": "f9f8df039258a0d8b6fc29dc1f7c4bcc75fdc8c0"
|
||||
},
|
||||
{
|
||||
"repo": "approval-engine",
|
||||
"head": "d40e842052f449ce2b5aa68abae1351720dbf41e",
|
||||
"branch": "main",
|
||||
"status": "verified",
|
||||
"remote_commit": "d40e842052f449ce2b5aa68abae1351720dbf41e"
|
||||
},
|
||||
{
|
||||
"repo": "audit-core",
|
||||
"head": "64509d2c4039ca1249f9e8aabf2bae030e3640cf",
|
||||
"branch": "main",
|
||||
"status": "verified",
|
||||
"remote_commit": "64509d2c4039ca1249f9e8aabf2bae030e3640cf"
|
||||
},
|
||||
{
|
||||
"repo": "glas-harness",
|
||||
"head": "c8751c97986011284ea4173c9adacc31e1fd9dfc",
|
||||
"branch": "main",
|
||||
"status": "verified",
|
||||
"remote_commit": "c8751c97986011284ea4173c9adacc31e1fd9dfc"
|
||||
},
|
||||
{
|
||||
"repo": "key-cape",
|
||||
"head": "d803e9282a47b49daf930fb905312fa5104c0ace",
|
||||
"branch": "main",
|
||||
"status": "verified",
|
||||
"remote_commit": "d803e9282a47b49daf930fb905312fa5104c0ace"
|
||||
},
|
||||
{
|
||||
"repo": "net-kingdom",
|
||||
"head": "3236d5000e52e0643f33906a26a7825aa0b67465",
|
||||
"branch": "main",
|
||||
"status": "verified",
|
||||
"remote_commit": "3236d5000e52e0643f33906a26a7825aa0b67465"
|
||||
},
|
||||
{
|
||||
"repo": "railiance-cluster",
|
||||
"head": "6ae3f847c83da3402883453ee7110457bfb2d0d6",
|
||||
"branch": "main",
|
||||
"status": "verified",
|
||||
"remote_commit": "6ae3f847c83da3402883453ee7110457bfb2d0d6"
|
||||
},
|
||||
{
|
||||
"repo": "railiance-forge",
|
||||
"head": "d322b9c9e8a1caa2b3479b270fff8a0e9f6c1f59",
|
||||
"branch": "main",
|
||||
"status": "verified",
|
||||
"remote_commit": "d322b9c9e8a1caa2b3479b270fff8a0e9f6c1f59"
|
||||
},
|
||||
{
|
||||
"repo": "railiance-platform",
|
||||
"head": "0a9617a62d4696a8070798923b459e8405c3dbf2",
|
||||
"branch": "main",
|
||||
"status": "verified",
|
||||
"remote_commit": "0a9617a62d4696a8070798923b459e8405c3dbf2"
|
||||
},
|
||||
{
|
||||
"repo": "rein-aharness",
|
||||
"head": "0b7a9cfdc801d9eccef316852b53fd51ba8daef1",
|
||||
"branch": "main",
|
||||
"status": "verified",
|
||||
"remote_commit": "0b7a9cfdc801d9eccef316852b53fd51ba8daef1"
|
||||
},
|
||||
{
|
||||
"repo": "repo-manager",
|
||||
"head": "3bcb1e1cf3e58b263f690534f7f28024d75cdbf6",
|
||||
"branch": "main",
|
||||
"status": "verified",
|
||||
"remote_commit": "3bcb1e1cf3e58b263f690534f7f28024d75cdbf6"
|
||||
},
|
||||
{
|
||||
"repo": "reuse-surface",
|
||||
"head": "01af18964b170eaa87f8560ce9285518e8dc6d7e",
|
||||
"branch": "main",
|
||||
"status": "verified",
|
||||
"remote_commit": "01af18964b170eaa87f8560ce9285518e8dc6d7e"
|
||||
},
|
||||
{
|
||||
"repo": "sand-boxer",
|
||||
"head": "c7c310266aba96ab7dd03cd8bfcaa65f22a3b66e",
|
||||
"branch": "main",
|
||||
"status": "verified",
|
||||
"remote_commit": "c7c310266aba96ab7dd03cd8bfcaa65f22a3b66e"
|
||||
},
|
||||
{
|
||||
"repo": "secrets-engine",
|
||||
"head": "691dc742362eeec45d5bd32d2b468f31a959748e",
|
||||
"branch": "main",
|
||||
"status": "verified",
|
||||
"remote_commit": "691dc742362eeec45d5bd32d2b468f31a959748e"
|
||||
},
|
||||
{
|
||||
"repo": "state-hub",
|
||||
"head": "200cbd0a61a805d0fe29f9d6d1c49a6cf1f1703a",
|
||||
"branch": "main",
|
||||
"status": "verified",
|
||||
"remote_commit": "200cbd0a61a805d0fe29f9d6d1c49a6cf1f1703a"
|
||||
},
|
||||
{
|
||||
"repo": "the-custodian",
|
||||
"head": "16ab1bb490336fb2f954612b85e91f15bc5e7eff",
|
||||
"branch": "main",
|
||||
"status": "verified",
|
||||
"remote_commit": "16ab1bb490336fb2f954612b85e91f15bc5e7eff"
|
||||
},
|
||||
{
|
||||
"repo": "user-engine",
|
||||
"head": "9557d6f867fe03c546aa26655f84b4192109981d",
|
||||
"branch": "main",
|
||||
"status": "verified",
|
||||
"remote_commit": "9557d6f867fe03c546aa26655f84b4192109981d"
|
||||
}
|
||||
],
|
||||
"retained_historical_refusal": "../final-audit-r1/owner-bindings-refused-r2.json",
|
||||
"retained_historical_refusal_sha256": "19184188e3115353657756aed30275d16e2cae48bd5f19219c75f3a4f1dca6f0",
|
||||
"files": {
|
||||
"verify.py": "595203988f16b46100b7fd82ba1df9d5cc9f9adc2eb89275539320d3b70f1f58",
|
||||
"preparation.json": "2609e04c50a254da638d88fad86f7e9c88efc27a8105b1c4b5c4c50d416b0fe3",
|
||||
"owner-bindings.json": "ef812abf65823dc81355c12963cfd55cee2b871a334927b6315c9c65f207d814"
|
||||
}
|
||||
}
|
||||
|
|
@ -0,0 +1,120 @@
|
|||
"""Read-only owner-source and primary projection check after source checkpoints."""
|
||||
from concurrent.futures import ThreadPoolExecutor
|
||||
from datetime import datetime, timezone
|
||||
from pathlib import Path
|
||||
import hashlib
|
||||
import json
|
||||
import re
|
||||
import subprocess
|
||||
import urllib.request
|
||||
import yaml
|
||||
|
||||
HERE = Path(__file__).resolve().parent
|
||||
PRIOR = HERE.parents[1] / 'native-gates-r1/native-gate-audit.json'
|
||||
prior = json.loads(PRIOR.read_text())
|
||||
def get(path):
|
||||
return json.load(urllib.request.urlopen('http://127.0.0.1:8000' + path, timeout=30))
|
||||
def git(root, *args):
|
||||
return subprocess.check_output(['git', '--no-optional-locks', '-C', str(root), *args], stderr=subprocess.PIPE).decode().strip()
|
||||
health = get('/state/health')
|
||||
assert (health['instance_role'], health['instance_label']) == ('primary', 'railiance01')
|
||||
repos = sorted({Path(r['path']).parents[1].name for r in prior['owner_refs']})
|
||||
with ThreadPoolExecutor(max_workers=4) as pool:
|
||||
snapshots = dict(zip(repos, pool.map(lambda repo: get('/repos/' + repo + '/work-record-projection/snapshot'), repos)))
|
||||
heads = {repo: git(Path('/home/worsch') / repo, 'rev-parse', 'HEAD') for repo in repos}
|
||||
def remote_head(repo):
|
||||
root = Path('/home/worsch') / repo
|
||||
branch = git(root, 'symbolic-ref', '--short', 'HEAD')
|
||||
result = subprocess.run(['git', '--no-optional-locks', '-C', str(root), 'ls-remote',
|
||||
'origin', 'refs/heads/' + branch],
|
||||
capture_output=True, text=True, timeout=45)
|
||||
if result.returncode or len(result.stdout.splitlines()) != 1:
|
||||
return {'branch': branch, 'status': 'unverified', 'remote_commit': None}
|
||||
return {'branch': branch, 'status': 'verified', 'remote_commit': result.stdout.split()[0]}
|
||||
with ThreadPoolExecutor(max_workers=4) as pool:
|
||||
remotes = dict(zip(repos, pool.map(remote_head, repos)))
|
||||
baseline_tasks = {task['uuid']: task for group in prior['hub_validation']['checks']
|
||||
for task in group.get('tasks', [])}
|
||||
|
||||
rows = []
|
||||
issues = []
|
||||
for repo in repos:
|
||||
if remotes[repo]['status'] != 'verified' or remotes[repo]['remote_commit'] != heads[repo]:
|
||||
issues.append({'repo': repo, 'field': 'source_head_remote_mismatch',
|
||||
'source': heads[repo], 'actual': remotes[repo]})
|
||||
new_source_tasks = []
|
||||
existing_source_deltas = []
|
||||
for ref in prior['owner_refs']:
|
||||
path = Path(ref['path']); root = path.parents[1]; repo = root.name
|
||||
raw = path.read_text(); front = yaml.safe_load(raw.split('---', 2)[1])
|
||||
if git(root, 'show', heads[repo] + ':' + str(path.relative_to(root))) != raw.strip():
|
||||
issues.append({'repo': repo, 'record': front['id'], 'field': 'source_not_committed',
|
||||
'source': str(path), 'actual': heads[repo]})
|
||||
tasks = [yaml.safe_load(s) for s in re.findall(r'```task\n(.*?)\n```', raw, re.S)]
|
||||
snapshot = snapshots[repo]
|
||||
plan = next(p for p in snapshot['workplans'] if p['id'] == front['state_hub_workstream_id'])
|
||||
if plan.get('projection_retired_at') is not None:
|
||||
issues.append({'repo': repo, 'record': front['id'], 'field': 'unexpected_projection_retirement',
|
||||
'actual': plan.get('projection_retired_at')})
|
||||
if plan['status'] != front['status']:
|
||||
issues.append({'repo': repo, 'record': front['id'], 'field': 'status', 'source': front['status'], 'actual': plan['status']})
|
||||
actual = [t for t in snapshot['tasks'] if t.get('workplan_id', t.get('workstream_id')) == plan['id']]
|
||||
if len(actual) != len(tasks):
|
||||
issues.append({'repo': repo, 'record': front['id'], 'field': 'task_count', 'source': len(tasks), 'actual': len(actual)})
|
||||
byid = {t['id']: t for t in actual}
|
||||
for task in tasks:
|
||||
baseline = baseline_tasks.get(task['state_hub_task_id'])
|
||||
if baseline is None:
|
||||
new_source_tasks.append({'repo': repo, 'workplan': front['id'],
|
||||
'record_id': task['id'], 'uuid': task['state_hub_task_id'],
|
||||
'status': task['status']})
|
||||
elif baseline['id'] != task['id'] or baseline.get('source_status') != task['status']:
|
||||
existing_source_deltas.append({'repo': repo, 'uuid': task['state_hub_task_id'],
|
||||
'baseline_record_id': baseline['id'], 'record_id': task['id'],
|
||||
'baseline_status': baseline.get('source_status'),
|
||||
'status': task['status']})
|
||||
t = byid.get(task['state_hub_task_id'])
|
||||
if t is None:
|
||||
issues.append({'repo': repo, 'record': task['id'], 'field': 'uuid_or_parent', 'source': task['state_hub_task_id'], 'actual': None})
|
||||
continue
|
||||
for field, expected in [('record_id', task['id']), ('status', task['status'])]:
|
||||
if t.get(field) != expected:
|
||||
issues.append({'repo': repo, 'record': task['id'], 'uuid': t['id'], 'field': field, 'source': expected, 'actual': t.get(field)})
|
||||
if 'needs_human' in task:
|
||||
if bool(t.get('needs_human')) != bool(task['needs_human']):
|
||||
issues.append({'repo': repo, 'record': task['id'], 'field': 'needs_human', 'source': bool(task['needs_human']), 'actual': bool(t.get('needs_human'))})
|
||||
rows.append({'repo': repo, 'workplan': front['id'], 'commit': heads[repo],
|
||||
'path': str(path), 'sha256': hashlib.sha256(path.read_bytes()).hexdigest(),
|
||||
'status': front['status'], 'flavor': front.get('flavor'),
|
||||
'workplan_uuid': front['state_hub_workstream_id'],
|
||||
'remote': remotes[repo],
|
||||
'tasks': [{'record_id': task['id'], 'uuid': task['state_hub_task_id'],
|
||||
'source_status': task['status'],
|
||||
'hub_record_id': byid.get(task['state_hub_task_id'], {}).get('record_id'),
|
||||
'hub_status': byid.get(task['state_hub_task_id'], {}).get('status'),
|
||||
'hub_parent_uuid': byid.get(task['state_hub_task_id'], {}).get('workplan_id',
|
||||
byid.get(task['state_hub_task_id'], {}).get('workstream_id')),
|
||||
'needs_human_explicit_in_source': 'needs_human' in task,
|
||||
'source_needs_human': bool(task['needs_human']) if 'needs_human' in task else None,
|
||||
'hub_needs_human': byid.get(task['state_hub_task_id'], {}).get('needs_human')}
|
||||
for task in tasks]})
|
||||
out = {'schema': 'custodian.native-owner-binding-audit.v2',
|
||||
'observed_at': datetime.now(timezone.utc).isoformat(), 'status': 'verified' if not issues else 'refused',
|
||||
'primary': 'primary/railiance01', 'workplans': len(rows),
|
||||
'task_bindings': sum(len(r['tasks']) for r in rows), 'rows': rows,
|
||||
'prior_audit_sha256': hashlib.sha256(PRIOR.read_bytes()).hexdigest(),
|
||||
'scope': 'Current source/primary workplan status, task UUID, status, parent and explicit human flag only; no new native gate acceptance inferred.',
|
||||
'native_target_gates_closed': 0, 'issues': issues,
|
||||
'source_counts_derived_dynamically': True,
|
||||
'baseline_task_bindings': len(baseline_tasks),
|
||||
'new_canonical_source_tasks_since_baseline': new_source_tasks,
|
||||
'existing_source_deltas_since_baseline_informational': existing_source_deltas,
|
||||
'owner_heads_and_remotes': [{'repo': repo, 'head': heads[repo], **remotes[repo]} for repo in repos],
|
||||
'verifier_source_sha256': hashlib.sha256(Path(__file__).read_bytes()).hexdigest()}
|
||||
|
||||
destination = 'owner-bindings.json' if not issues else 'owner-bindings-refused-r2.json'
|
||||
assert not (HERE / destination).exists(), 'never overwrite an earlier audit result'
|
||||
(HERE / destination).write_text(json.dumps(out, indent=2) + '\n')
|
||||
print(json.dumps({**{k: out[k] for k in ['status', 'workplans', 'task_bindings', 'native_target_gates_closed']},
|
||||
'issues': issues}))
|
||||
raise SystemExit(bool(issues))
|
||||
|
|
@ -0,0 +1,223 @@
|
|||
{
|
||||
"schema": "state-hub.repository-projection-reconcile.v1",
|
||||
"instance_role": "primary",
|
||||
"instance_label": "railiance01",
|
||||
"expected_commit": "e76d4130f31a02554048f30bf838043cea7a5b80",
|
||||
"derived_commit": "e76d4130f31a02554048f30bf838043cea7a5b80",
|
||||
"outcome": {
|
||||
"schema": "state-hub.projection-reset.v1",
|
||||
"repo_slug": "key-cape",
|
||||
"commit": "e76d4130f31a02554048f30bf838043cea7a5b80",
|
||||
"status": "applied",
|
||||
"counts": {
|
||||
"created": 0,
|
||||
"updated": 44,
|
||||
"retired": 0,
|
||||
"refused": 0,
|
||||
"released": 0,
|
||||
"created_tasks": 1,
|
||||
"updated_tasks": 16,
|
||||
"cancelled_tasks": 0,
|
||||
"created_edges": 3,
|
||||
"removed_edges": 0,
|
||||
"unresolved_edges": 1,
|
||||
"external_edges": 8
|
||||
},
|
||||
"created": [],
|
||||
"updated": [
|
||||
"ADHOC-2026-09-05",
|
||||
"ADHOC-2026-09-07",
|
||||
"ADHOC-2026-09-27",
|
||||
"KEY-WP-0001",
|
||||
"KEY-WP-0002",
|
||||
"KEY-WP-0003",
|
||||
"KEY-WP-0004",
|
||||
"KEY-WP-0005",
|
||||
"KEY-WP-0006",
|
||||
"KEY-WP-0007",
|
||||
"KEY-WP-0008",
|
||||
"KEY-WP-0009",
|
||||
"KEY-WP-0010",
|
||||
"KEY-WP-0011",
|
||||
"KEY-WP-0012",
|
||||
"KEY-WP-0013",
|
||||
"KEY-WP-0014",
|
||||
"KEY-WP-0015",
|
||||
"KEY-WP-0016",
|
||||
"KEY-WP-0017",
|
||||
"KEY-WP-0018",
|
||||
"KEY-WP-0019",
|
||||
"KEY-WP-0020",
|
||||
"KEY-WP-0021",
|
||||
"KEY-WP-0022",
|
||||
"KEY-WP-0023",
|
||||
"KEY-WP-0024",
|
||||
"KEY-WP-0025",
|
||||
"KEY-WP-0026",
|
||||
"KEY-WP-0027",
|
||||
"KEY-WP-0028",
|
||||
"KEY-WP-0029",
|
||||
"KEY-WP-0030",
|
||||
"KEY-WP-0031",
|
||||
"KEY-WP-0032",
|
||||
"KEY-WP-0033",
|
||||
"KEY-WP-0034",
|
||||
"KEY-WP-0035",
|
||||
"KEY-WP-0036",
|
||||
"KEY-WP-0037",
|
||||
"KEY-WP-0038",
|
||||
"KEY-WP-0039",
|
||||
"KEY-WP-0040",
|
||||
"KEY-WP-0041"
|
||||
],
|
||||
"retired": [],
|
||||
"released": [],
|
||||
"created_tasks": [
|
||||
"ADHOC-2026-09-27-T02"
|
||||
],
|
||||
"updated_tasks": [
|
||||
"ADHOC-2026-09-27-T01",
|
||||
"KEY-WP-0037-T01",
|
||||
"KEY-WP-0037-T02",
|
||||
"KEY-WP-0037-T03",
|
||||
"KEY-WP-0037-T04",
|
||||
"KEY-WP-0038-T01",
|
||||
"KEY-WP-0038-T02",
|
||||
"KEY-WP-0038-T03",
|
||||
"KEY-WP-0038-T04",
|
||||
"KEY-WP-0039-T01",
|
||||
"KEY-WP-0039-T02",
|
||||
"KEY-WP-0039-T03",
|
||||
"KEY-WP-0040-T01",
|
||||
"KEY-WP-0040-T02",
|
||||
"KEY-WP-0041-T01",
|
||||
"KEY-WP-0041-T02"
|
||||
],
|
||||
"cancelled_tasks": [],
|
||||
"created_edges": [
|
||||
{
|
||||
"workplan": "KEY-WP-0008",
|
||||
"from": "KEY-WP-0008",
|
||||
"target": "NK-WP-0025",
|
||||
"relationship_type": "blocks",
|
||||
"from_workplan_id": "23eb67d4-cf10-57a1-92f6-90146a294bda",
|
||||
"from_task_id": null,
|
||||
"to_workplan_id": "2412a251-d6b5-5f05-8082-3eb7697c51dc",
|
||||
"to_task_id": null
|
||||
},
|
||||
{
|
||||
"workplan": "KEY-WP-0007",
|
||||
"from": "KEY-WP-0007",
|
||||
"target": "USER-WP-0020",
|
||||
"relationship_type": "blocks",
|
||||
"from_workplan_id": "24db4178-705c-5b09-b7db-ee7a345d71a0",
|
||||
"from_task_id": null,
|
||||
"to_workplan_id": "9d03e5da-9182-52a5-bdda-521a6c3bdfb6",
|
||||
"to_task_id": null
|
||||
},
|
||||
{
|
||||
"workplan": "KEY-WP-0009",
|
||||
"from": "KEY-WP-0009",
|
||||
"target": "NK-WP-0030",
|
||||
"relationship_type": "blocks",
|
||||
"from_workplan_id": "c1a9b1cc-2ff0-566a-b544-1a2ef967fc0d",
|
||||
"from_task_id": null,
|
||||
"to_workplan_id": "8a884593-b7f9-508a-9e15-bfd901463ac1",
|
||||
"to_task_id": null
|
||||
}
|
||||
],
|
||||
"removed_edges": [],
|
||||
"unresolved_edges": [
|
||||
{
|
||||
"workplan": "KEY-WP-0010",
|
||||
"from": "KEY-WP-0010",
|
||||
"target": "RAILIANCE-WP-0027",
|
||||
"reason": "missing"
|
||||
}
|
||||
],
|
||||
"external_edges": [
|
||||
{
|
||||
"workplan": "KEY-WP-0038",
|
||||
"from": "KEY-WP-0038-T03",
|
||||
"target": "KEY-WP-0038-T02",
|
||||
"relationship_type": "starts_after",
|
||||
"from_workplan_id": "098e3e2c-a138-560e-b2d3-3a15eb49d8a9",
|
||||
"from_task_id": "40ddaa29-7245-508c-ad48-ddc063e25115",
|
||||
"to_workplan_id": null,
|
||||
"to_task_id": "ddcfb482-8f33-5c81-9ce8-84be8fa5dc30"
|
||||
},
|
||||
{
|
||||
"workplan": "KEY-WP-0038",
|
||||
"from": "KEY-WP-0038-T02",
|
||||
"target": "KEY-WP-0038-T01",
|
||||
"relationship_type": "starts_after",
|
||||
"from_workplan_id": "098e3e2c-a138-560e-b2d3-3a15eb49d8a9",
|
||||
"from_task_id": "ddcfb482-8f33-5c81-9ce8-84be8fa5dc30",
|
||||
"to_workplan_id": null,
|
||||
"to_task_id": "5f019d13-1fa3-5b88-a27a-75a3339ca96e"
|
||||
},
|
||||
{
|
||||
"workplan": "KEY-WP-0038",
|
||||
"from": "KEY-WP-0038-T02",
|
||||
"target": "NK-WP-0048-T06",
|
||||
"relationship_type": "starts_after",
|
||||
"from_workplan_id": "098e3e2c-a138-560e-b2d3-3a15eb49d8a9",
|
||||
"from_task_id": "ddcfb482-8f33-5c81-9ce8-84be8fa5dc30",
|
||||
"to_workplan_id": null,
|
||||
"to_task_id": "d9b26bcf-a7c6-59a2-92a0-f913d76a203c"
|
||||
},
|
||||
{
|
||||
"workplan": "KEY-WP-0039",
|
||||
"from": "KEY-WP-0039-T02",
|
||||
"target": "KEY-WP-0038-T03",
|
||||
"relationship_type": "starts_after",
|
||||
"from_workplan_id": "09c3bddf-6058-5603-8488-cccdb7be4f86",
|
||||
"from_task_id": "03da4c38-1dac-53b1-8b0b-e697df48e9d3",
|
||||
"to_workplan_id": null,
|
||||
"to_task_id": "40ddaa29-7245-508c-ad48-ddc063e25115"
|
||||
},
|
||||
{
|
||||
"workplan": "KEY-WP-0039",
|
||||
"from": "KEY-WP-0039-T02",
|
||||
"target": "KEY-WP-0039-T01",
|
||||
"relationship_type": "starts_after",
|
||||
"from_workplan_id": "09c3bddf-6058-5603-8488-cccdb7be4f86",
|
||||
"from_task_id": "03da4c38-1dac-53b1-8b0b-e697df48e9d3",
|
||||
"to_workplan_id": null,
|
||||
"to_task_id": "4d06b059-3768-53bb-83a4-a9a71c0850b8"
|
||||
},
|
||||
{
|
||||
"workplan": "KEY-WP-0039",
|
||||
"from": "KEY-WP-0039-T02",
|
||||
"target": "KEY-WP-0038-T02",
|
||||
"relationship_type": "starts_after",
|
||||
"from_workplan_id": "09c3bddf-6058-5603-8488-cccdb7be4f86",
|
||||
"from_task_id": "03da4c38-1dac-53b1-8b0b-e697df48e9d3",
|
||||
"to_workplan_id": null,
|
||||
"to_task_id": "ddcfb482-8f33-5c81-9ce8-84be8fa5dc30"
|
||||
},
|
||||
{
|
||||
"workplan": "KEY-WP-0007",
|
||||
"from": "KEY-WP-0007",
|
||||
"target": "KEY-WP-0005",
|
||||
"relationship_type": "blocks",
|
||||
"from_workplan_id": "24db4178-705c-5b09-b7db-ee7a345d71a0",
|
||||
"from_task_id": null,
|
||||
"to_workplan_id": "711a8303-69aa-5db6-9043-92530c6dc81b",
|
||||
"to_task_id": null
|
||||
},
|
||||
{
|
||||
"workplan": "KEY-WP-0009",
|
||||
"from": "KEY-WP-0009",
|
||||
"target": "KEY-WP-0006",
|
||||
"relationship_type": "blocks",
|
||||
"from_workplan_id": "c1a9b1cc-2ff0-566a-b544-1a2ef967fc0d",
|
||||
"from_task_id": null,
|
||||
"to_workplan_id": "d8d20d8f-61e0-54e2-9a88-a3958f0b6f2d",
|
||||
"to_task_id": null
|
||||
}
|
||||
],
|
||||
"refused": [],
|
||||
"notes": []
|
||||
}
|
||||
}
|
||||
File diff suppressed because it is too large
Load diff
|
|
@ -0,0 +1,69 @@
|
|||
"""Refresh the normal authoritative-forge cache without local UUID writeback.
|
||||
|
||||
The local CLI preview found unrelated missing historical UUIDs. Leave those
|
||||
source files and identity decisions unchanged. This uses the very same receiving
|
||||
endpoint and its independent derivation/collision/historical-preservation guards,
|
||||
with retirement acknowledgement false. It neither patches task rows nor assigns
|
||||
source identifiers.
|
||||
"""
|
||||
from pathlib import Path
|
||||
import hashlib
|
||||
import json
|
||||
import subprocess
|
||||
import urllib.error
|
||||
import urllib.request
|
||||
|
||||
HERE = Path(__file__).resolve().parent
|
||||
BASE = 'http://127.0.0.1:8000'
|
||||
prior = json.loads((HERE / 'owner-bindings-refused-r2.json').read_text())
|
||||
issues = [i for i in prior['issues'] if i['field'] == 'record_id']
|
||||
assert all(i['actual'] is None for i in issues)
|
||||
repos = sorted({i['repo'] for i in issues})
|
||||
def git(root, *args):
|
||||
return subprocess.check_output(['git', '--no-optional-locks', '-C', str(root), *args], stderr=subprocess.PIPE, timeout=40).decode().strip()
|
||||
def get(path):
|
||||
return json.load(urllib.request.urlopen(BASE + path, timeout=30))
|
||||
health = get('/state/health')
|
||||
assert (health['instance_role'], health['instance_label']) == ('primary', 'railiance01')
|
||||
receipts = []
|
||||
for repo in repos:
|
||||
root = Path('/home/worsch') / repo
|
||||
head = git(root, 'rev-parse', 'HEAD')
|
||||
assert git(root, 'ls-remote', 'origin', 'refs/heads/main').split()[0] == head
|
||||
selected = [r for r in prior['rows'] if r['repo'] == repo]
|
||||
for row in selected:
|
||||
assert hashlib.sha256(Path(row['path']).read_bytes()).hexdigest() == row['sha256']
|
||||
assert git(root, 'show', head + ':' + str(Path(row['path']).relative_to(root))) == Path(row['path']).read_text().strip()
|
||||
path = '/repos/' + repo + '/work-record-projection/reconcile'
|
||||
body = {'expected_commit': head, 'acknowledge_retirements': False}
|
||||
key = hashlib.sha256(json.dumps({'path': path, 'body': body, 'missing_records': [i['source'] for i in issues if i['repo'] == repo]}, sort_keys=True).encode()).hexdigest()
|
||||
request = urllib.request.Request(BASE + path, data=json.dumps(body).encode(), method='POST',
|
||||
headers={'Content-Type': 'application/json', 'Idempotency-Key': 'custodian-record-id-refresh-r1:' + key,
|
||||
'X-StateHub-Component': 'the-custodian', 'X-StateHub-Source-Agent': 'the-custodian'})
|
||||
try:
|
||||
with urllib.request.urlopen(request, timeout=120) as response:
|
||||
result = json.load(response)
|
||||
except Exception as error:
|
||||
failure = {'repo': repo, 'commit': head, 'status': 'failed_or_uncertain',
|
||||
'exception_type': type(error).__name__, 'http_status': getattr(error, 'code', None), 'automatic_retry': False}
|
||||
(HERE / (repo + '-receiving-refusal.json')).write_text(json.dumps(failure, indent=2) + '\n')
|
||||
raise RuntimeError('normal receiving refused; retained metadata; no source mutation or automatic retry') from None
|
||||
(HERE / (repo + '-receiving.json')).write_text(json.dumps(result, indent=2) + '\n')
|
||||
assert result['expected_commit'] == result['derived_commit'] == head
|
||||
assert (result['instance_role'], result['instance_label']) == ('primary', 'railiance01')
|
||||
assert result['outcome']['status'] == 'applied' and not result['outcome']['refused']
|
||||
snapshot = get('/repos/' + repo + '/work-record-projection/snapshot')
|
||||
actual = {t['id']: t for t in snapshot['tasks']}
|
||||
for row in selected:
|
||||
for old in row['tasks']:
|
||||
assert actual[old['uuid']]['status'] == old['status']
|
||||
for issue in issues:
|
||||
if issue['repo'] == repo:
|
||||
assert actual[issue['uuid']]['record_id'] == issue['source']
|
||||
assert git(root, 'rev-parse', 'HEAD') == head
|
||||
receipts.append({'repo': repo, 'commit': head, 'status': 'applied', 'source_and_uuid_fields_unchanged': True})
|
||||
output = {'status': 'verified', 'rows': receipts, 'record_ids_restored': len(issues),
|
||||
'source_uuid_gaps': 'Local CLI preview refusal remains; no identity migration or source writeback was performed.',
|
||||
'native_target_gates_closed': 0}
|
||||
(HERE / 'committed-receiving-result.json').write_text(json.dumps(output, indent=2) + '\n')
|
||||
print(json.dumps({'status': 'verified', 'repos': repos, 'record_ids_restored': len(issues)}))
|
||||
|
|
@ -0,0 +1,76 @@
|
|||
"""Use normal committed-source projection to restore missing cache record IDs."""
|
||||
from pathlib import Path
|
||||
import argparse
|
||||
import hashlib
|
||||
import json
|
||||
import subprocess
|
||||
import sys
|
||||
import urllib.request
|
||||
|
||||
HERE = Path(__file__).resolve().parent
|
||||
sys.path.insert(0, '/home/worsch/repo-manager/src')
|
||||
from repo_manager.identifiers import ensure_missing_work_record_identifiers
|
||||
|
||||
def git(root, *args):
|
||||
return subprocess.check_output(['git', '-C', str(root), *args], stderr=subprocess.PIPE, timeout=40).decode().strip()
|
||||
|
||||
def get(path):
|
||||
return json.load(urllib.request.urlopen('http://127.0.0.1:8000' + path, timeout=30))
|
||||
|
||||
def main(apply):
|
||||
prior = json.loads((HERE / 'owner-bindings-refused-r2.json').read_text())
|
||||
assert all(i['field'] == 'record_id' and i['actual'] is None or
|
||||
i['field'] == 'source_not_committed' and i['repo'] == 'the-custodian'
|
||||
for i in prior['issues']), 'unexpected drift requires review'
|
||||
repos = sorted({i['repo'] for i in prior['issues'] if i['field'] == 'record_id'})
|
||||
receipts = []
|
||||
for repo in repos:
|
||||
root = Path('/home/worsch') / repo
|
||||
head = git(root, 'rev-parse', 'HEAD')
|
||||
assert git(root, 'ls-remote', 'origin', 'refs/heads/main').split()[0] == head, 'unpublished owner source'
|
||||
preview = ensure_missing_work_record_identifiers(root, execute=False)
|
||||
assert preview['ok'] and not preview['files_changed'] and not preview['assignments'], 'unrelated UUID writeback'
|
||||
originals = {}
|
||||
for name in ['.custodian-brief.md', 'WORK-RECORDS.md']:
|
||||
if (root / name).exists():
|
||||
originals[name] = ((root / name).read_bytes(), git(root, 'ls-files', '--stage', '--', name))
|
||||
selected = [r for r in prior['rows'] if r['repo'] == repo]
|
||||
for row in selected:
|
||||
assert hashlib.sha256(Path(row['path']).read_bytes()).hexdigest() == row['sha256'], 'owner source changed'
|
||||
if not apply:
|
||||
receipts.append({'repo': repo, 'commit': head, 'uuid_writeback': False, 'status': 'ready'})
|
||||
continue
|
||||
result = subprocess.run(['/home/worsch/repo-manager/.venv/bin/rmgr', 'sync', '--path', str(root), '--push'],
|
||||
cwd=root, capture_output=True, text=True, timeout=180)
|
||||
(HERE / (repo + '-projection.json')).write_text(result.stdout)
|
||||
(HERE / (repo + '-projection.stderr.txt')).write_text(result.stderr)
|
||||
assert result.returncode == 0, 'normal projection refused; result retained'
|
||||
projection = json.loads(result.stdout)
|
||||
receipt = projection['receipt']
|
||||
assert projection['status'] == 'applied' and receipt['expected_commit'] == receipt['derived_commit'] == head
|
||||
assert (receipt['instance_role'], receipt['instance_label']) == ('primary', 'railiance01')
|
||||
assert git(root, 'rev-parse', 'HEAD') == head
|
||||
assert not projection['identifiers']['assignments']
|
||||
for name, (raw, entry) in originals.items():
|
||||
assert (root / name).read_bytes() == raw and git(root, 'ls-files', '--stage', '--', name) == entry
|
||||
snapshot = get('/repos/' + repo + '/work-record-projection/snapshot')
|
||||
actual = {t['id']: t for t in snapshot['tasks']}
|
||||
for row in selected:
|
||||
for old in row['tasks']:
|
||||
task = actual[old['uuid']]
|
||||
assert task['status'] == old['status'], 'status drift'
|
||||
for issue in prior['issues']:
|
||||
if issue['repo'] == repo:
|
||||
assert actual[issue['uuid']]['record_id'] == issue['source'], 'missing canonical record ID'
|
||||
receipts.append({'repo': repo, 'commit': head, 'status': 'applied',
|
||||
'other_work_preserved': True, 'task_statuses_preserved': True})
|
||||
output = {'schema': 'custodian.normal-record-id-reconciliation.v1',
|
||||
'status': 'applied' if apply else 'ready', 'rows': receipts,
|
||||
'scope': 'Normal source projection of already-published owners; no direct task patches, UUID assignment, source commit, deployment or native gate closure.'}
|
||||
(HERE / ('projection-reconciliation.json' if apply else 'projection-preview.json')).write_text(json.dumps(output, indent=2) + '\n')
|
||||
print(json.dumps({'status': output['status'], 'repos': repos}))
|
||||
|
||||
if __name__ == '__main__':
|
||||
parser = argparse.ArgumentParser()
|
||||
parser.add_argument('--apply', action='store_true')
|
||||
main(parser.parse_args().apply)
|
||||
|
|
@ -0,0 +1,49 @@
|
|||
{
|
||||
"status": "source_primary_mismatch",
|
||||
"source_task": "FLEX-WP-0024-T05",
|
||||
"source_status": "done",
|
||||
"actual_rows": [
|
||||
{
|
||||
"id": "041612ea-1be4-5997-8c32-49f8bcc50855",
|
||||
"record_id": "FLEX-WP-0024-T03",
|
||||
"status": "done",
|
||||
"workplan_id": "90577acd-6910-548d-a13e-1dbfdfb8ed27",
|
||||
"needs_human": false,
|
||||
"updated_at": "2026-09-14T07:58:25.163619Z"
|
||||
},
|
||||
{
|
||||
"id": "5482f3cd-36cb-55e0-8c52-0ca2340ed4d7",
|
||||
"record_id": "FLEX-WP-0024-T02",
|
||||
"status": "done",
|
||||
"workplan_id": "90577acd-6910-548d-a13e-1dbfdfb8ed27",
|
||||
"needs_human": false,
|
||||
"updated_at": "2026-09-14T07:58:23.723017Z"
|
||||
},
|
||||
{
|
||||
"id": "82d6b75e-e2c6-5e3d-a897-fbdfb7c9094e",
|
||||
"record_id": "FLEX-WP-0024-T04",
|
||||
"status": "done",
|
||||
"workplan_id": "90577acd-6910-548d-a13e-1dbfdfb8ed27",
|
||||
"needs_human": false,
|
||||
"updated_at": "2026-09-07T06:46:18.457274Z"
|
||||
},
|
||||
{
|
||||
"id": "b8fad80d-5c44-5e26-a632-5096e0c0f3c5",
|
||||
"record_id": "FLEX-WP-0024-T01",
|
||||
"status": "done",
|
||||
"workplan_id": "90577acd-6910-548d-a13e-1dbfdfb8ed27",
|
||||
"needs_human": false,
|
||||
"updated_at": "2026-09-06T21:38:40.008858Z"
|
||||
},
|
||||
{
|
||||
"id": "cfe4d275-9f02-5090-8391-06eea59d45c5",
|
||||
"record_id": null,
|
||||
"status": "done",
|
||||
"workplan_id": "90577acd-6910-548d-a13e-1dbfdfb8ed27",
|
||||
"needs_human": false,
|
||||
"updated_at": "2026-10-16T14:13:32.998220Z"
|
||||
}
|
||||
],
|
||||
"failed_verifier": "verify.py r1; requires exact record_id/status/parent",
|
||||
"effect": "read-only refusal; no successful full audit claimed"
|
||||
}
|
||||
|
|
@ -0,0 +1,49 @@
|
|||
{
|
||||
"schema": "state-hub.repository-projection-reconcile.v1",
|
||||
"instance_role": "primary",
|
||||
"instance_label": "railiance01",
|
||||
"expected_commit": "9b88cadaa817e5abea7950b4a264d4e2739a5ddb",
|
||||
"derived_commit": "9b88cadaa817e5abea7950b4a264d4e2739a5ddb",
|
||||
"outcome": {
|
||||
"schema": "state-hub.projection-reset.v1",
|
||||
"repo_slug": "rein-aharness",
|
||||
"commit": "9b88cadaa817e5abea7950b4a264d4e2739a5ddb",
|
||||
"status": "refused",
|
||||
"counts": {
|
||||
"created": 0,
|
||||
"updated": 0,
|
||||
"retired": 0,
|
||||
"refused": 1,
|
||||
"released": 0,
|
||||
"created_tasks": 0,
|
||||
"updated_tasks": 0,
|
||||
"cancelled_tasks": 0,
|
||||
"created_edges": 0,
|
||||
"removed_edges": 0,
|
||||
"unresolved_edges": 0,
|
||||
"external_edges": 0
|
||||
},
|
||||
"created": [],
|
||||
"updated": [],
|
||||
"retired": [],
|
||||
"released": [],
|
||||
"created_tasks": [],
|
||||
"updated_tasks": [],
|
||||
"cancelled_tasks": [],
|
||||
"created_edges": [],
|
||||
"removed_edges": [],
|
||||
"unresolved_edges": [],
|
||||
"external_edges": [],
|
||||
"refused": [
|
||||
{
|
||||
"reason": "would be retired; the forge no longer derives it",
|
||||
"slug": "harness-wp-0008",
|
||||
"status": "blocked",
|
||||
"backing_relative_path": "workplans/REINAH-WP-0008-simpler-metered-retry.md"
|
||||
}
|
||||
],
|
||||
"notes": [
|
||||
"Re-run with acknowledgement to retire these. Nothing was changed."
|
||||
]
|
||||
}
|
||||
}
|
||||
|
|
@ -0,0 +1,54 @@
|
|||
"""Read-only owner-source and primary projection check after source checkpoints."""
|
||||
from concurrent.futures import ThreadPoolExecutor
|
||||
from datetime import datetime, timezone
|
||||
from pathlib import Path
|
||||
import hashlib
|
||||
import json
|
||||
import re
|
||||
import subprocess
|
||||
import urllib.request
|
||||
import yaml
|
||||
|
||||
HERE = Path(__file__).resolve().parent
|
||||
PRIOR = HERE.parent / 'native-gates-r1/native-gate-audit.json'
|
||||
prior = json.loads(PRIOR.read_text())
|
||||
def get(path):
|
||||
return json.load(urllib.request.urlopen('http://127.0.0.1:8000' + path, timeout=30))
|
||||
def git(root, *args):
|
||||
return subprocess.check_output(['git', '--no-optional-locks', '-C', str(root), *args], stderr=subprocess.PIPE).decode().strip()
|
||||
health = get('/state/health')
|
||||
assert (health['instance_role'], health['instance_label']) == ('primary', 'railiance01')
|
||||
repos = sorted({Path(r['path']).parents[1].name for r in prior['owner_refs']})
|
||||
with ThreadPoolExecutor(max_workers=4) as pool:
|
||||
snapshots = dict(zip(repos, pool.map(lambda repo: get('/repos/' + repo + '/work-record-projection/snapshot'), repos)))
|
||||
heads = {repo: git(Path('/home/worsch') / repo, 'rev-parse', 'HEAD') for repo in repos}
|
||||
rows = []
|
||||
for ref in prior['owner_refs']:
|
||||
path = Path(ref['path']); root = path.parents[1]; repo = root.name
|
||||
raw = path.read_text(); front = yaml.safe_load(raw.split('---', 2)[1])
|
||||
assert git(root, 'show', heads[repo] + ':' + str(path.relative_to(root))) == raw.strip(), str(path)
|
||||
tasks = [yaml.safe_load(s) for s in re.findall(r'```task\n(.*?)\n```', raw, re.S)]
|
||||
snapshot = snapshots[repo]
|
||||
plan = next(p for p in snapshot['workplans'] if p['id'] == front['state_hub_workstream_id'])
|
||||
assert plan['status'] == front['status'], front['id']
|
||||
actual = [t for t in snapshot['tasks'] if t.get('workplan_id', t.get('workstream_id')) == plan['id']]
|
||||
assert len(actual) == len(tasks), front['id']
|
||||
byid = {t['id']: t for t in actual}
|
||||
for task in tasks:
|
||||
t = byid[task['state_hub_task_id']]
|
||||
assert t['record_id'] == task['id'] and t['status'] == task['status'], task['id']
|
||||
if 'needs_human' in task:
|
||||
assert bool(t.get('needs_human')) == bool(task['needs_human']), task['id']
|
||||
rows.append({'repo': repo, 'workplan': front['id'], 'commit': heads[repo],
|
||||
'path': str(path), 'sha256': hashlib.sha256(path.read_bytes()).hexdigest(),
|
||||
'status': front['status'], 'flavor': front.get('flavor'),
|
||||
'tasks': [{'record_id': t['record_id'], 'uuid': t['id'], 'status': t['status']} for t in actual]})
|
||||
out = {'schema': 'custodian.native-owner-binding-audit.v2',
|
||||
'observed_at': datetime.now(timezone.utc).isoformat(), 'status': 'verified',
|
||||
'primary': 'primary/railiance01', 'workplans': len(rows),
|
||||
'task_bindings': sum(len(r['tasks']) for r in rows), 'rows': rows,
|
||||
'prior_audit_sha256': hashlib.sha256(PRIOR.read_bytes()).hexdigest(),
|
||||
'scope': 'Current source/primary workplan status, task UUID, status, parent and explicit human flag only; no new native gate acceptance inferred.',
|
||||
'native_target_gates_closed': 0}
|
||||
(HERE / 'owner-bindings.json').write_text(json.dumps(out, indent=2) + '\n')
|
||||
print(json.dumps({k: out[k] for k in ['status', 'workplans', 'task_bindings', 'native_target_gates_closed']}))
|
||||
|
|
@ -0,0 +1,68 @@
|
|||
"""Read-only owner-source and primary projection check after source checkpoints."""
|
||||
from concurrent.futures import ThreadPoolExecutor
|
||||
from datetime import datetime, timezone
|
||||
from pathlib import Path
|
||||
import hashlib
|
||||
import json
|
||||
import re
|
||||
import subprocess
|
||||
import urllib.request
|
||||
import yaml
|
||||
|
||||
HERE = Path(__file__).resolve().parent
|
||||
PRIOR = HERE.parent / 'native-gates-r1/native-gate-audit.json'
|
||||
prior = json.loads(PRIOR.read_text())
|
||||
def get(path):
|
||||
return json.load(urllib.request.urlopen('http://127.0.0.1:8000' + path, timeout=30))
|
||||
def git(root, *args):
|
||||
return subprocess.check_output(['git', '--no-optional-locks', '-C', str(root), *args], stderr=subprocess.PIPE).decode().strip()
|
||||
health = get('/state/health')
|
||||
assert (health['instance_role'], health['instance_label']) == ('primary', 'railiance01')
|
||||
repos = sorted({Path(r['path']).parents[1].name for r in prior['owner_refs']})
|
||||
with ThreadPoolExecutor(max_workers=4) as pool:
|
||||
snapshots = dict(zip(repos, pool.map(lambda repo: get('/repos/' + repo + '/work-record-projection/snapshot'), repos)))
|
||||
heads = {repo: git(Path('/home/worsch') / repo, 'rev-parse', 'HEAD') for repo in repos}
|
||||
rows = []
|
||||
issues = []
|
||||
for ref in prior['owner_refs']:
|
||||
path = Path(ref['path']); root = path.parents[1]; repo = root.name
|
||||
raw = path.read_text(); front = yaml.safe_load(raw.split('---', 2)[1])
|
||||
if git(root, 'show', heads[repo] + ':' + str(path.relative_to(root))) != raw.strip():
|
||||
issues.append({'repo': repo, 'record': front['id'], 'field': 'source_not_committed',
|
||||
'source': str(path), 'actual': heads[repo]})
|
||||
tasks = [yaml.safe_load(s) for s in re.findall(r'```task\n(.*?)\n```', raw, re.S)]
|
||||
snapshot = snapshots[repo]
|
||||
plan = next(p for p in snapshot['workplans'] if p['id'] == front['state_hub_workstream_id'])
|
||||
if plan['status'] != front['status']:
|
||||
issues.append({'repo': repo, 'record': front['id'], 'field': 'status', 'source': front['status'], 'actual': plan['status']})
|
||||
actual = [t for t in snapshot['tasks'] if t.get('workplan_id', t.get('workstream_id')) == plan['id']]
|
||||
if len(actual) != len(tasks):
|
||||
issues.append({'repo': repo, 'record': front['id'], 'field': 'task_count', 'source': len(tasks), 'actual': len(actual)})
|
||||
byid = {t['id']: t for t in actual}
|
||||
for task in tasks:
|
||||
t = byid.get(task['state_hub_task_id'])
|
||||
if t is None:
|
||||
issues.append({'repo': repo, 'record': task['id'], 'field': 'uuid_or_parent', 'source': task['state_hub_task_id'], 'actual': None})
|
||||
continue
|
||||
for field, expected in [('record_id', task['id']), ('status', task['status'])]:
|
||||
if t.get(field) != expected:
|
||||
issues.append({'repo': repo, 'record': task['id'], 'uuid': t['id'], 'field': field, 'source': expected, 'actual': t.get(field)})
|
||||
if 'needs_human' in task:
|
||||
if bool(t.get('needs_human')) != bool(task['needs_human']):
|
||||
issues.append({'repo': repo, 'record': task['id'], 'field': 'needs_human', 'source': bool(task['needs_human']), 'actual': bool(t.get('needs_human'))})
|
||||
rows.append({'repo': repo, 'workplan': front['id'], 'commit': heads[repo],
|
||||
'path': str(path), 'sha256': hashlib.sha256(path.read_bytes()).hexdigest(),
|
||||
'status': front['status'], 'flavor': front.get('flavor'),
|
||||
'tasks': [{'record_id': t['record_id'], 'uuid': t['id'], 'status': t['status']} for t in actual]})
|
||||
out = {'schema': 'custodian.native-owner-binding-audit.v2',
|
||||
'observed_at': datetime.now(timezone.utc).isoformat(), 'status': 'verified' if not issues else 'refused',
|
||||
'primary': 'primary/railiance01', 'workplans': len(rows),
|
||||
'task_bindings': sum(len(r['tasks']) for r in rows), 'rows': rows,
|
||||
'prior_audit_sha256': hashlib.sha256(PRIOR.read_bytes()).hexdigest(),
|
||||
'scope': 'Current source/primary workplan status, task UUID, status, parent and explicit human flag only; no new native gate acceptance inferred.',
|
||||
'native_target_gates_closed': 0, 'issues': issues}
|
||||
destination = 'owner-bindings.json' if not issues else 'owner-bindings-refused-r2.json'
|
||||
(HERE / destination).write_text(json.dumps(out, indent=2) + '\n')
|
||||
print(json.dumps({**{k: out[k] for k in ['status', 'workplans', 'task_bindings', 'native_target_gates_closed']},
|
||||
'issues': issues}))
|
||||
raise SystemExit(bool(issues))
|
||||
|
|
@ -0,0 +1,131 @@
|
|||
{
|
||||
"repo_slug": "the-custodian",
|
||||
"repo_path": "/home/worsch/the-custodian",
|
||||
"source_revision": "16ab1bb490336fb2f954612b85e91f15bc5e7eff",
|
||||
"source_revision_reason": null,
|
||||
"issues": [
|
||||
{
|
||||
"severity": "WARN",
|
||||
"check_id": "C-35",
|
||||
"message": "Repo Manager warning: workplans/: repository uses more than one workplan prefix: ['CUST-WP', 'THE-WP']",
|
||||
"file_path": "workplans/",
|
||||
"db_id": "",
|
||||
"file_value": "",
|
||||
"db_value": "",
|
||||
"fixable": false
|
||||
},
|
||||
{
|
||||
"severity": "WARN",
|
||||
"check_id": "C-35",
|
||||
"message": "Repo Manager contradictory: workplans/ADHOC-2026-08-25-retired.md: workplan id 'CUST-WP-ADHOC-2026-08-25-RETIRED' is not accepted by the canon kind registry",
|
||||
"file_path": "workplans/ADHOC-2026-08-25-retired.md",
|
||||
"db_id": "",
|
||||
"file_value": "",
|
||||
"db_value": "",
|
||||
"fixable": false
|
||||
},
|
||||
{
|
||||
"severity": "WARN",
|
||||
"check_id": "C-05",
|
||||
"message": "Title drift in 'cust-wp-0010': file='Domain and Repository Goals' db='Workplan Lifecycle Documentation' (file wins)",
|
||||
"file_path": "workplans/CUST-WP-0010b-domain-and-repo-goals.md",
|
||||
"db_id": "def8455a-9de4-4891-a15a-5b09ca98ab1e",
|
||||
"file_value": "Domain and Repository Goals",
|
||||
"db_value": "Workplan Lifecycle Documentation",
|
||||
"fixable": true
|
||||
},
|
||||
{
|
||||
"severity": "WARN",
|
||||
"check_id": "C-20",
|
||||
"message": "Workplan dependency target 'STATE-WP-0092' is not linked to State Hub",
|
||||
"file_path": "workplans/CUST-WP-0072-fleet-flavor-and-depends-on-backfill.md",
|
||||
"db_id": "",
|
||||
"file_value": "STATE-WP-0092",
|
||||
"db_value": "",
|
||||
"fixable": false
|
||||
},
|
||||
{
|
||||
"severity": "WARN",
|
||||
"check_id": "C-40",
|
||||
"message": "blocker satisfied, task still wait: 'CUST-WP-0073-T05' in workplan 'CUST-WP-0073' \u2014 decision 1591daa1-6e85-4dfd-aadd-5a9fe1ef47fa is resolved",
|
||||
"file_path": "workplans/CUST-WP-0073-agent-credential-separation.md#CUST-WP-0073-T05",
|
||||
"db_id": "",
|
||||
"file_value": "1591daa1-6e85-4dfd-aadd-5a9fe1ef47fa",
|
||||
"db_value": "",
|
||||
"fixable": false
|
||||
},
|
||||
{
|
||||
"severity": "WARN",
|
||||
"check_id": "C-39",
|
||||
"message": "Human wait task 'CUST-WP-0079-T06' in workplan 'CUST-WP-0079' has needs_human: true without decision_id \u2014 unrouted human gate",
|
||||
"file_path": "workplans/CUST-WP-0079-deterministic-security-flow.md#CUST-WP-0079-T06",
|
||||
"db_id": "",
|
||||
"file_value": "needs_human: true",
|
||||
"db_value": "",
|
||||
"fixable": false
|
||||
},
|
||||
{
|
||||
"severity": "INFO",
|
||||
"check_id": "C-08",
|
||||
"message": "Closed DB workstream 'cust-wp-0010b' (id=416ff571\u2026, status=finished) has no backing workplan file",
|
||||
"file_path": "",
|
||||
"db_id": "416ff571-18cf-5cb2-9c8b-836f68a301b3",
|
||||
"file_value": "",
|
||||
"db_value": "",
|
||||
"fixable": false
|
||||
},
|
||||
{
|
||||
"severity": "INFO",
|
||||
"check_id": "C-08",
|
||||
"message": "Retired DB workstream 'interactive-the-custodian@retired-20260828' (id=370c2481\u2026, status=finished) has no backing workplan file \u2014 projection tombstone, not live work",
|
||||
"file_path": "",
|
||||
"db_id": "370c2481-6806-41eb-a917-f8874f03184f",
|
||||
"file_value": "",
|
||||
"db_value": "",
|
||||
"fixable": false
|
||||
},
|
||||
{
|
||||
"severity": "INFO",
|
||||
"check_id": "C-08",
|
||||
"message": "Retired DB workstream 'adhoc-2026-05-02@retired-20260827' (id=3f54ce9c\u2026, status=finished) has no backing workplan file \u2014 projection tombstone, not live work",
|
||||
"file_path": "",
|
||||
"db_id": "3f54ce9c-1f95-42de-894f-0f81a52ba2e8",
|
||||
"file_value": "",
|
||||
"db_value": "",
|
||||
"fixable": false
|
||||
},
|
||||
{
|
||||
"severity": "INFO",
|
||||
"check_id": "C-08",
|
||||
"message": "Retired DB workstream 'the-custodian-adhoc-2026-07-02@retired-20260827' (id=5c53733b\u2026, status=finished) has no backing workplan file \u2014 projection tombstone, not live work",
|
||||
"file_path": "",
|
||||
"db_id": "5c53733b-c077-4a93-be66-9c3af8f9b6fd",
|
||||
"file_value": "",
|
||||
"db_value": "",
|
||||
"fixable": false
|
||||
},
|
||||
{
|
||||
"severity": "WARN",
|
||||
"check_id": "C-26",
|
||||
"message": "Workplan id 'THE-WP-0001' uses prefix 'THE-WP' but repo canonical prefix is 'CUST-WP' \u2014 new plans must conform",
|
||||
"file_path": "workplans/THE-WP-0001-federation-interface.md",
|
||||
"db_id": "",
|
||||
"file_value": "THE-WP-0001",
|
||||
"db_value": "CUST-WP",
|
||||
"fixable": false
|
||||
}
|
||||
],
|
||||
"fixes_applied": [
|
||||
"bindings: synced 89/89",
|
||||
"C-17 cleared: pushed 1 backlogged commit(s)",
|
||||
"C-05 fixed: workstream def8455a\u2026 title \u2192 'Domain and Repository Goals'",
|
||||
"push: pushed"
|
||||
],
|
||||
"summary": {
|
||||
"fail": 0,
|
||||
"automation_error": 0,
|
||||
"warn": 7,
|
||||
"info": 4
|
||||
},
|
||||
"result": "warn"
|
||||
}
|
||||
|
|
@ -0,0 +1 @@
|
|||
WARN: working-memory commit failed: Generated-only commits rejected: staged
|
||||
|
|
@ -0,0 +1,292 @@
|
|||
{
|
||||
"ok": true,
|
||||
"status": "applied",
|
||||
"repo_slug": "the-custodian",
|
||||
"commit": "16ab1bb490336fb2f954612b85e91f15bc5e7eff",
|
||||
"requests": 2,
|
||||
"elapsed_ms": 9109.6,
|
||||
"git": {
|
||||
"upstream": "origin/main",
|
||||
"behind": 0,
|
||||
"ahead": 0
|
||||
},
|
||||
"identifiers": {
|
||||
"schema": "repo-manager.identifier-assignment.v1",
|
||||
"ok": true,
|
||||
"executed": true,
|
||||
"repo": "the-custodian",
|
||||
"namespace": "helixforge",
|
||||
"assignments": [],
|
||||
"historical_invalid_identifiers": [
|
||||
{
|
||||
"kind": "workplan",
|
||||
"id": "CUST-WP-ADHOC-2026-08-25-RETIRED",
|
||||
"source": "workplans/ADHOC-2026-08-25-retired.md"
|
||||
}
|
||||
],
|
||||
"historical_identity_collisions": [],
|
||||
"files_changed": []
|
||||
},
|
||||
"receipt": {
|
||||
"schema": "state-hub.repository-projection-reconcile.v1",
|
||||
"instance_role": "primary",
|
||||
"instance_label": "railiance01",
|
||||
"expected_commit": "16ab1bb490336fb2f954612b85e91f15bc5e7eff",
|
||||
"derived_commit": "16ab1bb490336fb2f954612b85e91f15bc5e7eff",
|
||||
"outcome": {
|
||||
"schema": "state-hub.projection-reset.v1",
|
||||
"repo_slug": "the-custodian",
|
||||
"commit": "16ab1bb490336fb2f954612b85e91f15bc5e7eff",
|
||||
"status": "applied",
|
||||
"counts": {
|
||||
"created": 0,
|
||||
"updated": 88,
|
||||
"retired": 0,
|
||||
"refused": 0,
|
||||
"released": 0,
|
||||
"created_tasks": 0,
|
||||
"updated_tasks": 0,
|
||||
"cancelled_tasks": 0,
|
||||
"created_edges": 0,
|
||||
"removed_edges": 0,
|
||||
"unresolved_edges": 0,
|
||||
"external_edges": 13
|
||||
},
|
||||
"created": [],
|
||||
"updated": [
|
||||
"CUST-WP-0000",
|
||||
"CUST-WP-0000b",
|
||||
"CUST-WP-0000c",
|
||||
"CUST-WP-0001",
|
||||
"CUST-WP-0002",
|
||||
"CUST-WP-0004",
|
||||
"CUST-WP-0005",
|
||||
"CUST-WP-0006",
|
||||
"CUST-WP-0007",
|
||||
"CUST-WP-0008",
|
||||
"CUST-WP-0009",
|
||||
"CUST-WP-0010",
|
||||
"CUST-WP-0010b",
|
||||
"CUST-WP-0013",
|
||||
"CUST-WP-0014",
|
||||
"CUST-WP-0015",
|
||||
"CUST-WP-0016",
|
||||
"CUST-WP-0017",
|
||||
"CUST-WP-0017-LEGACY",
|
||||
"CUST-WP-0018",
|
||||
"CUST-WP-0019",
|
||||
"CUST-WP-0020",
|
||||
"CUST-WP-0021",
|
||||
"CUST-WP-0022",
|
||||
"CUST-WP-0023",
|
||||
"CUST-WP-0024",
|
||||
"CUST-WP-0025",
|
||||
"CUST-WP-0026",
|
||||
"CUST-WP-0027",
|
||||
"CUST-WP-0028",
|
||||
"CUST-WP-0029",
|
||||
"CUST-WP-0030",
|
||||
"CUST-WP-0031",
|
||||
"CUST-WP-0032",
|
||||
"CUST-WP-0033",
|
||||
"CUST-WP-0034",
|
||||
"CUST-WP-0035",
|
||||
"CUST-WP-0036",
|
||||
"CUST-WP-0037",
|
||||
"CUST-WP-0039",
|
||||
"CUST-WP-0040",
|
||||
"CUST-WP-0041",
|
||||
"CUST-WP-0043",
|
||||
"CUST-WP-0044",
|
||||
"CUST-WP-0045",
|
||||
"CUST-WP-0046",
|
||||
"CUST-WP-0047",
|
||||
"CUST-WP-0048",
|
||||
"CUST-WP-0049",
|
||||
"CUST-WP-0050",
|
||||
"CUST-WP-0051",
|
||||
"CUST-WP-0052",
|
||||
"CUST-WP-0053",
|
||||
"CUST-WP-0053-LEGACY",
|
||||
"CUST-WP-0054",
|
||||
"CUST-WP-0055",
|
||||
"CUST-WP-0056",
|
||||
"CUST-WP-0057",
|
||||
"CUST-WP-0058",
|
||||
"CUST-WP-0059",
|
||||
"CUST-WP-0060",
|
||||
"CUST-WP-0061",
|
||||
"CUST-WP-0062",
|
||||
"CUST-WP-0063",
|
||||
"CUST-WP-0064",
|
||||
"CUST-WP-0065",
|
||||
"CUST-WP-0066",
|
||||
"CUST-WP-0067",
|
||||
"CUST-WP-0068",
|
||||
"CUST-WP-0069",
|
||||
"CUST-WP-0070",
|
||||
"CUST-WP-0071",
|
||||
"CUST-WP-0072",
|
||||
"CUST-WP-0073",
|
||||
"CUST-WP-0074",
|
||||
"CUST-WP-0075",
|
||||
"CUST-WP-0076",
|
||||
"CUST-WP-0077",
|
||||
"CUST-WP-0078",
|
||||
"CUST-WP-0079",
|
||||
"CUST-WP-0080",
|
||||
"CUST-WP-0081",
|
||||
"CUST-WP-ADHOC-2026-03-29",
|
||||
"CUST-WP-ADHOC-2026-05-02",
|
||||
"CUST-WP-ADHOC-2026-07-02",
|
||||
"CUST-WP-ADHOC-2026-08-25",
|
||||
"CUST-WP-ADHOC-2026-09-06",
|
||||
"THE-WP-0001"
|
||||
],
|
||||
"retired": [],
|
||||
"released": [],
|
||||
"created_tasks": [],
|
||||
"updated_tasks": [],
|
||||
"cancelled_tasks": [],
|
||||
"created_edges": [],
|
||||
"removed_edges": [],
|
||||
"unresolved_edges": [],
|
||||
"external_edges": [
|
||||
{
|
||||
"workplan": "CUST-WP-0071",
|
||||
"from": "CUST-WP-0071-T05",
|
||||
"target": "CUST-WP-0071-T04",
|
||||
"relationship_type": "starts_after",
|
||||
"from_workplan_id": "2249bddb-7524-5add-bd5c-c4163a6ca0f3",
|
||||
"from_task_id": "20ddd4d7-d85d-5b95-bb0a-7b0ca8af76ca",
|
||||
"to_workplan_id": null,
|
||||
"to_task_id": "944f98e2-7e42-5894-925b-752423f3a1cc"
|
||||
},
|
||||
{
|
||||
"workplan": "CUST-WP-0071",
|
||||
"from": "CUST-WP-0071-T03",
|
||||
"target": "CUST-WP-0071-T01",
|
||||
"relationship_type": "starts_after",
|
||||
"from_workplan_id": "2249bddb-7524-5add-bd5c-c4163a6ca0f3",
|
||||
"from_task_id": "6dc67558-eb1e-5bb6-a667-986f884dd495",
|
||||
"to_workplan_id": null,
|
||||
"to_task_id": "4ae8eb8d-f8c5-5256-ae50-c323cfd73d7a"
|
||||
},
|
||||
{
|
||||
"workplan": "CUST-WP-0071",
|
||||
"from": "CUST-WP-0071-T03",
|
||||
"target": "CUST-WP-0071-T02",
|
||||
"relationship_type": "starts_after",
|
||||
"from_workplan_id": "2249bddb-7524-5add-bd5c-c4163a6ca0f3",
|
||||
"from_task_id": "6dc67558-eb1e-5bb6-a667-986f884dd495",
|
||||
"to_workplan_id": null,
|
||||
"to_task_id": "82192370-2fd7-5363-88d2-3c67889d3d68"
|
||||
},
|
||||
{
|
||||
"workplan": "CUST-WP-0071",
|
||||
"from": "CUST-WP-0071-T02",
|
||||
"target": "CUST-WP-0071-T01",
|
||||
"relationship_type": "starts_after",
|
||||
"from_workplan_id": "2249bddb-7524-5add-bd5c-c4163a6ca0f3",
|
||||
"from_task_id": "82192370-2fd7-5363-88d2-3c67889d3d68",
|
||||
"to_workplan_id": null,
|
||||
"to_task_id": "4ae8eb8d-f8c5-5256-ae50-c323cfd73d7a"
|
||||
},
|
||||
{
|
||||
"workplan": "CUST-WP-0071",
|
||||
"from": "CUST-WP-0071-T02",
|
||||
"target": "RAPPS-WP-0014-T03",
|
||||
"relationship_type": "starts_after",
|
||||
"from_workplan_id": "2249bddb-7524-5add-bd5c-c4163a6ca0f3",
|
||||
"from_task_id": "82192370-2fd7-5363-88d2-3c67889d3d68",
|
||||
"to_workplan_id": null,
|
||||
"to_task_id": "dd069c6d-fcc1-5bac-b233-976f2f0d5cd1"
|
||||
},
|
||||
{
|
||||
"workplan": "CUST-WP-0071",
|
||||
"from": "CUST-WP-0071-T04",
|
||||
"target": "CUST-WP-0071-T03",
|
||||
"relationship_type": "starts_after",
|
||||
"from_workplan_id": "2249bddb-7524-5add-bd5c-c4163a6ca0f3",
|
||||
"from_task_id": "944f98e2-7e42-5894-925b-752423f3a1cc",
|
||||
"to_workplan_id": null,
|
||||
"to_task_id": "6dc67558-eb1e-5bb6-a667-986f884dd495"
|
||||
},
|
||||
{
|
||||
"workplan": "CUST-WP-0073",
|
||||
"from": "CUST-WP-0073-T02",
|
||||
"target": "GLAS-WP-0012",
|
||||
"relationship_type": "blocks",
|
||||
"from_workplan_id": "a98a9f34-83b4-5c8c-8107-e05f7806d50d",
|
||||
"from_task_id": "4b88b0b7-dc7e-5612-aa5d-1a08f0530c35",
|
||||
"to_workplan_id": "170bf1ae-337f-5553-8d1e-03b07100e08f",
|
||||
"to_task_id": null
|
||||
},
|
||||
{
|
||||
"workplan": "CUST-WP-0073",
|
||||
"from": "CUST-WP-0073-T04",
|
||||
"target": "CUST-WP-0073-T02",
|
||||
"relationship_type": "starts_after",
|
||||
"from_workplan_id": "a98a9f34-83b4-5c8c-8107-e05f7806d50d",
|
||||
"from_task_id": "90725511-4e31-549f-b567-47feff1a9ca4",
|
||||
"to_workplan_id": null,
|
||||
"to_task_id": "4b88b0b7-dc7e-5612-aa5d-1a08f0530c35"
|
||||
},
|
||||
{
|
||||
"workplan": "CUST-WP-0079",
|
||||
"from": "CUST-WP-0079-T03",
|
||||
"target": "ACTIVITY-WP-0047",
|
||||
"relationship_type": "blocks",
|
||||
"from_workplan_id": "ab288f92-d364-5c24-9362-aee451f266c3",
|
||||
"from_task_id": "1be0569c-221d-5925-a0ff-fd2af88e52b1",
|
||||
"to_workplan_id": "ee97869b-dca2-54c9-aa18-0b479c244fb3",
|
||||
"to_task_id": null
|
||||
},
|
||||
{
|
||||
"workplan": "CUST-WP-0079",
|
||||
"from": "CUST-WP-0079-T04",
|
||||
"target": "PNEX-WP-0006",
|
||||
"relationship_type": "blocks",
|
||||
"from_workplan_id": "ab288f92-d364-5c24-9362-aee451f266c3",
|
||||
"from_task_id": "5dd52156-09a8-5781-b288-99ae822f59a6",
|
||||
"to_workplan_id": "774c5037-a3d0-5e65-893c-d18970acd66a",
|
||||
"to_task_id": null
|
||||
},
|
||||
{
|
||||
"workplan": "CUST-WP-0080",
|
||||
"from": "CUST-WP-0080-T04",
|
||||
"target": "CUST-WP-0080-T03",
|
||||
"relationship_type": "starts_after",
|
||||
"from_workplan_id": "dfadb19b-445e-59c6-bcd6-48e87b912c52",
|
||||
"from_task_id": "82378b0f-7004-5c2f-9683-b356a1227576",
|
||||
"to_workplan_id": null,
|
||||
"to_task_id": "87637402-02f1-57c1-8fbc-4141598af8e3"
|
||||
},
|
||||
{
|
||||
"workplan": "CUST-WP-0080",
|
||||
"from": "CUST-WP-0080-T05",
|
||||
"target": "RPF-WP-0056",
|
||||
"relationship_type": "blocks",
|
||||
"from_workplan_id": "dfadb19b-445e-59c6-bcd6-48e87b912c52",
|
||||
"from_task_id": "ed8b909a-23bf-5e5f-b600-e477fbae136b",
|
||||
"to_workplan_id": "31933d08-c877-5fda-aff9-6220c3705c92",
|
||||
"to_task_id": null
|
||||
},
|
||||
{
|
||||
"workplan": "CUST-WP-0080",
|
||||
"from": "CUST-WP-0080-T05",
|
||||
"target": "RAPP-PLAYWRIGHT-WP-0004",
|
||||
"relationship_type": "blocks",
|
||||
"from_workplan_id": "dfadb19b-445e-59c6-bcd6-48e87b912c52",
|
||||
"from_task_id": "ed8b909a-23bf-5e5f-b600-e477fbae136b",
|
||||
"to_workplan_id": "f9280c40-201e-59b5-a6f0-1aace8e0e2e2",
|
||||
"to_task_id": null
|
||||
}
|
||||
],
|
||||
"refused": [],
|
||||
"notes": [
|
||||
"Preserved bound historical row and task UUIDs: CUST-WP-ADHOC-2026-08-25-RETIRED"
|
||||
]
|
||||
}
|
||||
}
|
||||
}
|
||||
|
|
@ -0,0 +1,62 @@
|
|||
<!-- custodian-brief: generated by fix-consistency — do not edit manually -->
|
||||
# Custodian Brief — the-custodian
|
||||
|
||||
**Domain:** infotech
|
||||
**Last synced:** 2026-10-15 23:45 UTC
|
||||
**State Hub:** http://127.0.0.1:8000 *(adjust if running on a remote machine)*
|
||||
|
||||
## Active Workstreams
|
||||
|
||||
### NetKingdom target security architecture and SEC-DSM implementation
|
||||
Progress: 2/6 done | workplan_id: `dfadb19b-445e-59c6-bcd6-48e87b912c52`
|
||||
|
||||
**Open tasks:**
|
||||
- ► Close source defects and reconcile uncovered lifecycle gaps `87637402`
|
||||
- ► Coordinate self-service Playwright identity delivery `ed8b909a`
|
||||
- ► Establish the target architecture and drive the restructuring `6aca534c`
|
||||
- · Verify native closure against every requirement `82378b0f`
|
||||
|
||||
### Separate agent credentials and establish supervised privileged execution
|
||||
Progress: 2/5 done | workplan_id: `a98a9f34-83b4-5c8c-8107-e05f7806d50d`
|
||||
|
||||
**Open tasks:**
|
||||
- ! Build and hand out the agent identity `4b88b0b7`
|
||||
*(wait: Await GLAS-WP-0012 (glas-harness) production acceptance of the local supervised profile; then railiance-platform RBAC, railiance-enablement k3s config, railiance-infra principal mapping and ops-warden certificate issuance.)*
|
||||
- ! Fleet guidance and harness guards `90725511`
|
||||
*(wait: Await CUST-WP-0073-T02: the verified agent identity and execution path must exist before it can be documented; Codex/Grok read-denial guard needs glas-harness or harness-owner delivery.)*
|
||||
- ! Rotate what was exposed `1b41b532`
|
||||
*(wait: Deferred by founder decision 2026-09-24; reopened only by the founder on one of the three triggers below, in one attended rotation window.)*
|
||||
|
||||
### Size Railiance workloads from actual demand and establish a weekly allocation review
|
||||
Progress: 1/5 done | workplan_id: `2249bddb-7524-5add-bd5c-c4163a6ca0f3`
|
||||
|
||||
**Open tasks:**
|
||||
- ! Measure the Vergabe prototype under representative pilot use `82192370`
|
||||
*(wait: Await RAPPS-WP-0014-T03 (blocked, needs_human): populated two-user/document workflow run by Bernd and the company contact, giving representative load for p95 <= 2s / zero failures.)*
|
||||
- ! Review ecosystem allocations and reserve operating room `6dc67558`
|
||||
*(wait: Await CUST-WP-0071-T02 representative sample; Forgejo/runner demand and zero-request workload review need owner input (railiance-cluster, railiance-forge, resource-control).)*
|
||||
- ! Apply accepted sizing changes and verify their effects `944f98e2`
|
||||
*(wait: Await reviewed allocation proposals and applicable workload-owner authority.)*
|
||||
- ! Establish the regular weekly workload-demand and allocation assessment `20ddd4d7`
|
||||
*(wait: Await the repeatable observation and accepted sizing/review procedure.)*
|
||||
|
||||
### Deterministic security flow: standing authorizations, flow report, and agent re-engagement
|
||||
Progress: 3/7 done | workplan_id: `ab288f92-d364-5c24-9362-aee451f266c3`
|
||||
|
||||
**Open tasks:**
|
||||
- ! Schedule the flow report and decision sync `1be0569c`
|
||||
*(wait: Activity Core accepted the schedule in ACTIVITY-WP-0047. Await claiming rein workstation/hub acceptance, owner activation and the first unassisted fire with report/checkpoint evidence.)*
|
||||
- ! Encode the standing change rule as a policy-nexus guardrail `5dd52156`
|
||||
*(wait: policy-nexus owns guardrail publication; handoff written as PNEX-WP-0006.)*
|
||||
- ! Stop agent-authored index and sync commits `8a3dc219`
|
||||
*(wait: Local guard and repeatable shared-hook installation are implemented. Fleet generator adoption and the required full week of clean history remain unverified; repo-manager owner acceptance is needed.)*
|
||||
- ! Attended window #1 `e3da807f`
|
||||
*(wait: Partly done 2026-10-11: list cut from 14 to 3; U05-U07 accepted, U08 waits on KEY-WP-0040-T01. Remaining founder acts: USER-WP-0026-T03 readback, RPF-WP-0044-T08 coulombcore check, the U08 re-run, and Sol's added RPF-WP-0044-T04 issuer login.)*
|
||||
|
||||
---
|
||||
## MCP Orientation (when available)
|
||||
|
||||
If the state-hub MCP server is reachable, call:
|
||||
`get_domain_summary("infotech")`
|
||||
This provides richer cross-domain context.
|
||||
If the MCP call fails, use this file as your orientation source.
|
||||
|
|
@ -0,0 +1,536 @@
|
|||
# Work Records — the-custodian
|
||||
|
||||
> Generated by `statehub fix-consistency` (CUST-WP-0061-T04, work-record
|
||||
> stage 3). Do not edit by hand — edit the source file/block listed for
|
||||
> each record and re-run fix-consistency to refresh this index. Archived
|
||||
> workplans are omitted; closed decisions/intakes/engagements stay listed
|
||||
> so recently-resolved work is still visible. [auto]
|
||||
|
||||
| Kind | ID | Status | Lane | Source |
|
||||
| --- | --- | --- | --- | --- |
|
||||
| workplan | CUST-WP-ADHOC-2026-05-02 | done | — | workplans/ADHOC-2026-05-02.md |
|
||||
| workplan | CUST-WP-ADHOC-2026-07-02 | finished | — | workplans/ADHOC-2026-07-02.md |
|
||||
| workplan | CUST-WP-ADHOC-2026-08-25-RETIRED | finished | — | workplans/ADHOC-2026-08-25-retired.md |
|
||||
| workplan | CUST-WP-ADHOC-2026-08-25 | finished | — | workplans/ADHOC-2026-08-25.md |
|
||||
| workplan | CUST-WP-ADHOC-2026-09-06 | finished | — | workplans/ADHOC-2026-09-06.md |
|
||||
| workplan | CUST-WP-0000 | finished | — | workplans/CUST-WP-0000-state-hub-v0.1-build-deploy.md |
|
||||
| workplan | CUST-WP-0000b | finished | — | workplans/CUST-WP-0000b-state-hub-v0.2-decisions-dependencies.md |
|
||||
| workplan | CUST-WP-0001 | done | — | workplans/CUST-WP-0001-custodian-agent-runtime.md |
|
||||
| workplan | CUST-WP-0002 | finished | — | workplans/CUST-WP-0002-contribution-tracking-sbom.md |
|
||||
| workplan | CUST-WP-0004 | finished | — | workplans/CUST-WP-0004-ep-td-tracking.md |
|
||||
| workplan | CUST-WP-0005 | finished | — | workplans/CUST-WP-0005-dynamic-domains.md |
|
||||
| workplan | CUST-WP-0006 | done | — | workplans/CUST-WP-0006-gems-state-hub.md |
|
||||
| workplan | CUST-WP-0007 | finished | — | workplans/CUST-WP-0007-gems-migration.md |
|
||||
| workplan | CUST-WP-0008 | done | — | workplans/CUST-WP-0008-consistency-engine.md |
|
||||
| workplan | CUST-WP-0009 | finished | — | workplans/CUST-WP-0009-human-interventions.md |
|
||||
| workplan | CUST-WP-0010 | finished | — | workplans/CUST-WP-0010-workstream-lifecycle-docs.md |
|
||||
| workplan | CUST-WP-0010b | finished | — | workplans/CUST-WP-0010b-domain-and-repo-goals.md |
|
||||
| workplan | CUST-WP-0013 | finished | — | workplans/CUST-WP-0013-sbom-infra-expansion.md |
|
||||
| workplan | CUST-WP-0015 | done | — | workplans/CUST-WP-0015-agent-inbox.md |
|
||||
| workplan | CUST-WP-0016 | done | — | workplans/CUST-WP-0016-kaizen-agentic-integration.md |
|
||||
| workplan | CUST-WP-0017 | done | — | workplans/CUST-WP-0017-scope-md-agent-and-coverage.md |
|
||||
| workplan | CUST-WP-0018 | done | — | workplans/CUST-WP-0018-api-hardening-code-quality.md |
|
||||
| workplan | CUST-WP-0019 | done | — | workplans/CUST-WP-0019-dashboard-ux-polish.md |
|
||||
| workplan | CUST-WP-0020 | done | — | workplans/CUST-WP-0020-test-suite.md |
|
||||
| workplan | CUST-WP-0021 | done | — | workplans/CUST-WP-0021-multi-host-repo-paths.md |
|
||||
| workplan | CUST-WP-0022 | done | — | workplans/CUST-WP-0022-capability-requests.md |
|
||||
| workplan | CUST-WP-0023 | done | — | workplans/CUST-WP-0023-tpsc.md |
|
||||
| workplan | CUST-WP-0024 | done | — | workplans/CUST-WP-0024-repo-doi-gate.md |
|
||||
| workplan | CUST-WP-0026 | done | — | workplans/CUST-WP-0026-distributed-consistency.md |
|
||||
| workplan | CUST-WP-0027 | done | — | workplans/CUST-WP-0027-capability-request-dispute.md |
|
||||
| workplan | CUST-WP-0029 | done | — | workplans/CUST-WP-0029-token-consumption-tracking.md |
|
||||
| workplan | CUST-WP-0030 | done | — | workplans/CUST-WP-0030-dashboard-entity-list-ux.md |
|
||||
| workplan | CUST-WP-0031 | done | — | workplans/CUST-WP-0031-capability-registry.md |
|
||||
| workplan | CUST-WP-0032 | done | — | workplans/CUST-WP-0032-haskell-build-machine.md |
|
||||
| workplan | CUST-WP-0033 | done | — | workplans/CUST-WP-0033-interface-change-registry.md |
|
||||
| workplan | CUST-WP-0039 | done | — | workplans/CUST-WP-0039-dashboard-poll-optimization.md |
|
||||
| workplan | CUST-WP-0040 | finished | — | workplans/CUST-WP-0040-state-hub-nats-activity-core-integration.md |
|
||||
| workplan | CUST-WP-0041 | done | — | workplans/CUST-WP-0041-api-performance.md |
|
||||
| workplan | CUST-WP-0043 | finished | — | workplans/CUST-WP-0043-state-hub-repo-extraction.md |
|
||||
| workplan | CUST-WP-0044 | finished | — | workplans/CUST-WP-0044-daily-statehub-wsjf-triage.md |
|
||||
| workplan | CUST-WP-0045 | finished | — | workplans/CUST-WP-0045-activity-core-daily-triage-runner.md |
|
||||
| workplan | CUST-WP-0069 | finished | — | workplans/CUST-WP-0045-cutover-runbook.md |
|
||||
| workplan | CUST-WP-0046 | finished | — | workplans/CUST-WP-0046-hourly-recently-on-scope-activity-core.md |
|
||||
| workplan | CUST-WP-0047 | finished | — | workplans/CUST-WP-0047-ops-hub-service-inventory-now-view.md |
|
||||
| workplan | CUST-WP-0048 | finished | — | workplans/CUST-WP-0048-hub-core-state-hub-import-refactor.md |
|
||||
| workplan | CUST-WP-0049 | finished | — | workplans/CUST-WP-0049-interhub-bootstrap-access-lane.md |
|
||||
| workplan | CUST-WP-0050 | finished | — | workplans/CUST-WP-0050-repo-classification-registration-redesign.md |
|
||||
| workplan | CUST-WP-0051 | finished | — | workplans/CUST-WP-0051-infrastructure-stabilization-metaplan.md |
|
||||
| workplan | CUST-WP-0052 | finished | — | workplans/CUST-WP-0052-core-hub-fos-reset.md |
|
||||
| workplan | CUST-WP-0053 | finished | — | workplans/CUST-WP-0053-coordination-hygiene-improvements.md |
|
||||
| workplan | CUST-WP-0055 | finished | — | workplans/CUST-WP-0055-workplan-terminology-fleet-refactor.md |
|
||||
| workplan | CUST-WP-0056 | finished | — | workplans/CUST-WP-0056-daily-todo-md-stale-review.md |
|
||||
| workplan | CUST-WP-0059 | finished | — | workplans/CUST-WP-0059-forgejo-ci-publish-cutover-tail.md |
|
||||
| workplan | CUST-WP-0060 | finished | — | workplans/CUST-WP-0060-work-record-canonization.md |
|
||||
| workplan | CUST-WP-0061 | finished | — | workplans/CUST-WP-0061-work-record-stage3-intake-promotion-index.md |
|
||||
| workplan | CUST-WP-0062 | finished | — | workplans/CUST-WP-0062-sbom-nexus-daily-catchup.md |
|
||||
| workplan | CUST-WP-0063 | finished | — | workplans/CUST-WP-0063-inbox-governance-packets.md |
|
||||
| workplan | CUST-WP-0064 | finished | — | workplans/CUST-WP-0064-sbom-controlled-scan-inputs.md |
|
||||
| workplan | CUST-WP-0065 | finished | — | workplans/CUST-WP-0065-reclassify-repos-and-guidance-docs-to-the-new-sector-domain.md |
|
||||
| workplan | CUST-WP-0066 | finished | — | workplans/CUST-WP-0066-repository-qualified-ad-hoc-identifiers.md |
|
||||
| workplan | CUST-WP-0067 | finished | — | workplans/CUST-WP-0067-hub-authority-target-resolution.md |
|
||||
| workplan | CUST-WP-0068 | finished | — | workplans/CUST-WP-0068-cache-only-work-record-recovery.md |
|
||||
| workplan | CUST-WP-0070 | finished | — | workplans/CUST-WP-0070-publication-repo-category.md |
|
||||
| workplan | CUST-WP-0071 | blocked | — | workplans/CUST-WP-0071-measured-workload-sizing-and-weekly-review.md |
|
||||
| workplan | CUST-WP-0072 | finished | — | workplans/CUST-WP-0072-fleet-flavor-and-depends-on-backfill.md |
|
||||
| workplan | CUST-WP-0073 | blocked | — | workplans/CUST-WP-0073-agent-credential-separation.md |
|
||||
| workplan | CUST-WP-0074 | finished | — | workplans/CUST-WP-0074-qualified-wait-states.md |
|
||||
| workplan | CUST-WP-0075 | finished | — | workplans/CUST-WP-0075-dependency-graph-driven-unblocking.md |
|
||||
| workplan | CUST-WP-0076 | finished | — | workplans/CUST-WP-0076-provisioning-window-cadence.md |
|
||||
| workplan | CUST-WP-0077 | finished | — | workplans/CUST-WP-0077-dependency-root-execution-wave.md |
|
||||
| workplan | CUST-WP-0078 | finished | — | workplans/CUST-WP-0078-security-collaboration-consolidation.md |
|
||||
| workplan | CUST-WP-0079 | blocked | — | workplans/CUST-WP-0079-deterministic-security-flow.md |
|
||||
| workplan | CUST-WP-0080 | active | — | workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md |
|
||||
| workplan | CUST-WP-0081 | finished | — | workplans/CUST-WP-0081-netkingdom-architecture-review-and-reuse.md |
|
||||
| workplan | THE-WP-0001 | finished | — | workplans/THE-WP-0001-federation-interface.md |
|
||||
| task | CUST-WP-ADHOC-2026-05-02-T01 | done | — | workplans/ADHOC-2026-05-02.md |
|
||||
| task | CUST-WP-ADHOC-2026-07-02-T01 | done | — | workplans/ADHOC-2026-07-02.md |
|
||||
| task | ADHOC-2026-08-25-T01 | done | — | workplans/ADHOC-2026-08-25-retired.md |
|
||||
| task | CUST-WP-ADHOC-2026-08-25-T01 | done | — | workplans/ADHOC-2026-08-25.md |
|
||||
| task | CUST-WP-ADHOC-2026-09-06-T01 | done | — | workplans/ADHOC-2026-09-06.md |
|
||||
| task | CUST-WP-0001-T01 | done | — | workplans/CUST-WP-0001-custodian-agent-runtime.md |
|
||||
| task | CUST-WP-0001-T02 | done | — | workplans/CUST-WP-0001-custodian-agent-runtime.md |
|
||||
| task | CUST-WP-0002-T01 | done | — | workplans/CUST-WP-0002-contribution-tracking-sbom.md |
|
||||
| task | CUST-WP-0002-T02 | done | — | workplans/CUST-WP-0002-contribution-tracking-sbom.md |
|
||||
| task | CUST-WP-0002-T03 | done | — | workplans/CUST-WP-0002-contribution-tracking-sbom.md |
|
||||
| task | CUST-WP-0002-T04 | done | — | workplans/CUST-WP-0002-contribution-tracking-sbom.md |
|
||||
| task | CUST-WP-0002-T05 | done | — | workplans/CUST-WP-0002-contribution-tracking-sbom.md |
|
||||
| task | CUST-WP-0002-T06 | done | — | workplans/CUST-WP-0002-contribution-tracking-sbom.md |
|
||||
| task | CUST-WP-0002-T07 | done | — | workplans/CUST-WP-0002-contribution-tracking-sbom.md |
|
||||
| task | CUST-WP-0002-T08 | done | — | workplans/CUST-WP-0002-contribution-tracking-sbom.md |
|
||||
| task | CUST-WP-0002-T09 | done | — | workplans/CUST-WP-0002-contribution-tracking-sbom.md |
|
||||
| task | CUST-WP-0002-T10 | done | — | workplans/CUST-WP-0002-contribution-tracking-sbom.md |
|
||||
| task | CUST-WP-0002-T11 | done | — | workplans/CUST-WP-0002-contribution-tracking-sbom.md |
|
||||
| task | CUST-WP-0002-T12 | done | — | workplans/CUST-WP-0002-contribution-tracking-sbom.md |
|
||||
| task | CUST-WP-0002-T13 | done | — | workplans/CUST-WP-0002-contribution-tracking-sbom.md |
|
||||
| task | CUST-WP-0002-T14 | done | — | workplans/CUST-WP-0002-contribution-tracking-sbom.md |
|
||||
| task | CUST-WP-0002-T15 | done | — | workplans/CUST-WP-0002-contribution-tracking-sbom.md |
|
||||
| task | CUST-WP-0004-T01 | done | — | workplans/CUST-WP-0004-ep-td-tracking.md |
|
||||
| task | CUST-WP-0004-T02 | done | — | workplans/CUST-WP-0004-ep-td-tracking.md |
|
||||
| task | CUST-WP-0004-T03 | done | — | workplans/CUST-WP-0004-ep-td-tracking.md |
|
||||
| task | CUST-WP-0004-T04 | done | — | workplans/CUST-WP-0004-ep-td-tracking.md |
|
||||
| task | CUST-WP-0004-T05 | done | — | workplans/CUST-WP-0004-ep-td-tracking.md |
|
||||
| task | CUST-WP-0004-T06 | done | — | workplans/CUST-WP-0004-ep-td-tracking.md |
|
||||
| task | CUST-WP-0004-T07 | done | — | workplans/CUST-WP-0004-ep-td-tracking.md |
|
||||
| task | CUST-WP-0004-T08 | done | — | workplans/CUST-WP-0004-ep-td-tracking.md |
|
||||
| task | CUST-WP-0004-T09 | done | — | workplans/CUST-WP-0004-ep-td-tracking.md |
|
||||
| task | CUST-WP-0004-T10 | done | — | workplans/CUST-WP-0004-ep-td-tracking.md |
|
||||
| task | CUST-WP-0005-T01 | done | — | workplans/CUST-WP-0005-dynamic-domains.md |
|
||||
| task | CUST-WP-0005-T02 | done | — | workplans/CUST-WP-0005-dynamic-domains.md |
|
||||
| task | CUST-WP-0005-T03 | done | — | workplans/CUST-WP-0005-dynamic-domains.md |
|
||||
| task | CUST-WP-0005-T04 | done | — | workplans/CUST-WP-0005-dynamic-domains.md |
|
||||
| task | CUST-WP-0005-T05 | done | — | workplans/CUST-WP-0005-dynamic-domains.md |
|
||||
| task | CUST-WP-0005-T06 | done | — | workplans/CUST-WP-0005-dynamic-domains.md |
|
||||
| task | CUST-WP-0005-T07 | done | — | workplans/CUST-WP-0005-dynamic-domains.md |
|
||||
| task | CUST-WP-0005-T08 | done | — | workplans/CUST-WP-0005-dynamic-domains.md |
|
||||
| task | CUST-WP-0005-T09 | done | — | workplans/CUST-WP-0005-dynamic-domains.md |
|
||||
| task | CUST-WP-0005-T10 | done | — | workplans/CUST-WP-0005-dynamic-domains.md |
|
||||
| task | CUST-WP-0005-T11 | done | — | workplans/CUST-WP-0005-dynamic-domains.md |
|
||||
| task | T01 | done | — | workplans/CUST-WP-0006-gems-state-hub.md |
|
||||
| task | T02 | done | — | workplans/CUST-WP-0006-gems-state-hub.md |
|
||||
| task | T03 | done | — | workplans/CUST-WP-0006-gems-state-hub.md |
|
||||
| task | T04 | done | — | workplans/CUST-WP-0006-gems-state-hub.md |
|
||||
| task | T05 | done | — | workplans/CUST-WP-0006-gems-state-hub.md |
|
||||
| task | T01 | done | — | workplans/CUST-WP-0007-gems-migration.md |
|
||||
| task | T02 | done | — | workplans/CUST-WP-0007-gems-migration.md |
|
||||
| task | T03 | done | — | workplans/CUST-WP-0007-gems-migration.md |
|
||||
| task | T04 | done | — | workplans/CUST-WP-0007-gems-migration.md |
|
||||
| task | T05 | done | — | workplans/CUST-WP-0007-gems-migration.md |
|
||||
| task | T06 | done | — | workplans/CUST-WP-0007-gems-migration.md |
|
||||
| task | T07 | done | — | workplans/CUST-WP-0007-gems-migration.md |
|
||||
| task | T08 | done | — | workplans/CUST-WP-0007-gems-migration.md |
|
||||
| task | T09 | done | — | workplans/CUST-WP-0007-gems-migration.md |
|
||||
| task | T10 | done | — | workplans/CUST-WP-0007-gems-migration.md |
|
||||
| task | T11 | done | — | workplans/CUST-WP-0007-gems-migration.md |
|
||||
| task | T12 | done | — | workplans/CUST-WP-0007-gems-migration.md |
|
||||
| task | T13 | done | — | workplans/CUST-WP-0007-gems-migration.md |
|
||||
| task | T14 | done | — | workplans/CUST-WP-0007-gems-migration.md |
|
||||
| task | T15 | done | — | workplans/CUST-WP-0007-gems-migration.md |
|
||||
| task | T16 | done | — | workplans/CUST-WP-0007-gems-migration.md |
|
||||
| task | T17 | done | — | workplans/CUST-WP-0007-gems-migration.md |
|
||||
| task | CUST-WP-0008-T01 | done | — | workplans/CUST-WP-0008-consistency-engine.md |
|
||||
| task | CUST-WP-0008-T02 | done | — | workplans/CUST-WP-0008-consistency-engine.md |
|
||||
| task | CUST-WP-0008-T03 | done | — | workplans/CUST-WP-0008-consistency-engine.md |
|
||||
| task | CUST-WP-0008-T04 | done | — | workplans/CUST-WP-0008-consistency-engine.md |
|
||||
| task | CUST-WP-0009-T1 | done | — | workplans/CUST-WP-0009-human-interventions.md |
|
||||
| task | CUST-WP-0009-T2 | done | — | workplans/CUST-WP-0009-human-interventions.md |
|
||||
| task | CUST-WP-0009-T3 | done | — | workplans/CUST-WP-0009-human-interventions.md |
|
||||
| task | CUST-WP-0010-T1 | done | — | workplans/CUST-WP-0010-workstream-lifecycle-docs.md |
|
||||
| task | CUST-WP-0010-T2 | done | — | workplans/CUST-WP-0010-workstream-lifecycle-docs.md |
|
||||
| task | CUST-WP-0010-T3 | done | — | workplans/CUST-WP-0010-workstream-lifecycle-docs.md |
|
||||
| task | CUST-WP-0010b-T01 | done | — | workplans/CUST-WP-0010b-domain-and-repo-goals.md |
|
||||
| task | CUST-WP-0010b-T02 | done | — | workplans/CUST-WP-0010b-domain-and-repo-goals.md |
|
||||
| task | CUST-WP-0013-T01 | done | — | workplans/CUST-WP-0013-sbom-infra-expansion.md |
|
||||
| task | CUST-WP-0013-T02 | done | — | workplans/CUST-WP-0013-sbom-infra-expansion.md |
|
||||
| task | CUST-WP-0013-T03 | done | — | workplans/CUST-WP-0013-sbom-infra-expansion.md |
|
||||
| task | CUST-WP-0013-T04 | done | — | workplans/CUST-WP-0013-sbom-infra-expansion.md |
|
||||
| task | CUST-WP-0013-T05 | done | — | workplans/CUST-WP-0013-sbom-infra-expansion.md |
|
||||
| task | CUST-WP-0013-T06 | done | — | workplans/CUST-WP-0013-sbom-infra-expansion.md |
|
||||
| task | CUST-WP-0013-T07 | done | — | workplans/CUST-WP-0013-sbom-infra-expansion.md |
|
||||
| task | CUST-WP-0013-T08 | done | — | workplans/CUST-WP-0013-sbom-infra-expansion.md |
|
||||
| task | CUST-WP-0013-T09 | done | — | workplans/CUST-WP-0013-sbom-infra-expansion.md |
|
||||
| task | CUST-WP-0013-T10 | done | — | workplans/CUST-WP-0013-sbom-infra-expansion.md |
|
||||
| task | CUST-WP-0013-T11 | done | — | workplans/CUST-WP-0013-sbom-infra-expansion.md |
|
||||
| task | CUST-WP-0013-T12 | done | — | workplans/CUST-WP-0013-sbom-infra-expansion.md |
|
||||
| task | CUST-WP-0013-T13 | done | — | workplans/CUST-WP-0013-sbom-infra-expansion.md |
|
||||
| task | CUST-WP-0013-T14 | done | — | workplans/CUST-WP-0013-sbom-infra-expansion.md |
|
||||
| task | CUST-WP-0015-T01 | done | — | workplans/CUST-WP-0015-agent-inbox.md |
|
||||
| task | CUST-WP-0015-T02 | done | — | workplans/CUST-WP-0015-agent-inbox.md |
|
||||
| task | CUST-WP-0015-T03 | done | — | workplans/CUST-WP-0015-agent-inbox.md |
|
||||
| task | CUST-WP-0015-T04 | done | — | workplans/CUST-WP-0015-agent-inbox.md |
|
||||
| task | CUST-WP-0015-T05 | done | — | workplans/CUST-WP-0015-agent-inbox.md |
|
||||
| task | CUST-WP-0016-T01 | done | — | workplans/CUST-WP-0016-kaizen-agentic-integration.md |
|
||||
| task | CUST-WP-0016-T02 | done | — | workplans/CUST-WP-0016-kaizen-agentic-integration.md |
|
||||
| task | CUST-WP-0016-T03 | done | — | workplans/CUST-WP-0016-kaizen-agentic-integration.md |
|
||||
| task | CUST-WP-0016-T04 | done | — | workplans/CUST-WP-0016-kaizen-agentic-integration.md |
|
||||
| task | CUST-WP-0016-T05 | done | — | workplans/CUST-WP-0016-kaizen-agentic-integration.md |
|
||||
| task | CUST-WP-0017-T01 | done | — | workplans/CUST-WP-0017-scope-md-agent-and-coverage.md |
|
||||
| task | CUST-WP-0017-T02 | done | — | workplans/CUST-WP-0017-scope-md-agent-and-coverage.md |
|
||||
| task | CUST-WP-0017-T03 | done | — | workplans/CUST-WP-0017-scope-md-agent-and-coverage.md |
|
||||
| task | CUST-WP-0017-T04 | done | — | workplans/CUST-WP-0017-scope-md-agent-and-coverage.md |
|
||||
| task | CUST-WP-0017-T05 | done | — | workplans/CUST-WP-0017-scope-md-agent-and-coverage.md |
|
||||
| task | CUST-WP-0017-T06 | done | — | workplans/CUST-WP-0017-scope-md-agent-and-coverage.md |
|
||||
| task | CUST-WP-0018-T01 | done | — | workplans/CUST-WP-0018-api-hardening-code-quality.md |
|
||||
| task | CUST-WP-0018-T02 | done | — | workplans/CUST-WP-0018-api-hardening-code-quality.md |
|
||||
| task | CUST-WP-0018-T03 | done | — | workplans/CUST-WP-0018-api-hardening-code-quality.md |
|
||||
| task | CUST-WP-0018-T04 | done | — | workplans/CUST-WP-0018-api-hardening-code-quality.md |
|
||||
| task | CUST-WP-0018-T05 | done | — | workplans/CUST-WP-0018-api-hardening-code-quality.md |
|
||||
| task | CUST-WP-0018-T06 | done | — | workplans/CUST-WP-0018-api-hardening-code-quality.md |
|
||||
| task | CUST-WP-0018-T07 | done | — | workplans/CUST-WP-0018-api-hardening-code-quality.md |
|
||||
| task | CUST-WP-0019-T01 | done | — | workplans/CUST-WP-0019-dashboard-ux-polish.md |
|
||||
| task | CUST-WP-0019-T02 | done | — | workplans/CUST-WP-0019-dashboard-ux-polish.md |
|
||||
| task | CUST-WP-0019-T03 | done | — | workplans/CUST-WP-0019-dashboard-ux-polish.md |
|
||||
| task | CUST-WP-0020-T01 | done | — | workplans/CUST-WP-0020-test-suite.md |
|
||||
| task | CUST-WP-0020-T02 | done | — | workplans/CUST-WP-0020-test-suite.md |
|
||||
| task | CUST-WP-0020-T03 | done | — | workplans/CUST-WP-0020-test-suite.md |
|
||||
| task | CUST-WP-0020-T04 | done | — | workplans/CUST-WP-0020-test-suite.md |
|
||||
| task | CUST-WP-0020-T05 | done | — | workplans/CUST-WP-0020-test-suite.md |
|
||||
| task | CUST-WP-0021-T01 | done | — | workplans/CUST-WP-0021-multi-host-repo-paths.md |
|
||||
| task | CUST-WP-0021-T02 | done | — | workplans/CUST-WP-0021-multi-host-repo-paths.md |
|
||||
| task | CUST-WP-0021-T03 | done | — | workplans/CUST-WP-0021-multi-host-repo-paths.md |
|
||||
| task | CUST-WP-0021-T04 | done | — | workplans/CUST-WP-0021-multi-host-repo-paths.md |
|
||||
| task | CUST-WP-0021-T05 | done | — | workplans/CUST-WP-0021-multi-host-repo-paths.md |
|
||||
| task | CUST-WP-0022-T01 | done | — | workplans/CUST-WP-0022-capability-requests.md |
|
||||
| task | CUST-WP-0022-T02 | done | — | workplans/CUST-WP-0022-capability-requests.md |
|
||||
| task | CUST-WP-0022-T03 | done | — | workplans/CUST-WP-0022-capability-requests.md |
|
||||
| task | CUST-WP-0022-T04 | done | — | workplans/CUST-WP-0022-capability-requests.md |
|
||||
| task | CUST-WP-0022-T05 | done | — | workplans/CUST-WP-0022-capability-requests.md |
|
||||
| task | CUST-WP-0022-T06 | done | — | workplans/CUST-WP-0022-capability-requests.md |
|
||||
| task | CUST-WP-0022-T07 | done | — | workplans/CUST-WP-0022-capability-requests.md |
|
||||
| task | CUST-WP-0022-T08 | done | — | workplans/CUST-WP-0022-capability-requests.md |
|
||||
| task | CUST-WP-0022-T09 | done | — | workplans/CUST-WP-0022-capability-requests.md |
|
||||
| task | CUST-WP-0022-T10 | done | — | workplans/CUST-WP-0022-capability-requests.md |
|
||||
| task | CUST-WP-0023-T01 | done | — | workplans/CUST-WP-0023-tpsc.md |
|
||||
| task | CUST-WP-0023-T02 | done | — | workplans/CUST-WP-0023-tpsc.md |
|
||||
| task | CUST-WP-0023-T03 | done | — | workplans/CUST-WP-0023-tpsc.md |
|
||||
| task | CUST-WP-0023-T04 | done | — | workplans/CUST-WP-0023-tpsc.md |
|
||||
| task | CUST-WP-0023-T05 | done | — | workplans/CUST-WP-0023-tpsc.md |
|
||||
| task | CUST-WP-0023-T06 | done | — | workplans/CUST-WP-0023-tpsc.md |
|
||||
| task | CUST-WP-0023-T07 | done | — | workplans/CUST-WP-0023-tpsc.md |
|
||||
| task | CUST-WP-0023-T08 | done | — | workplans/CUST-WP-0023-tpsc.md |
|
||||
| task | CUST-WP-0023-T09 | done | — | workplans/CUST-WP-0023-tpsc.md |
|
||||
| task | CUST-WP-0023-T10 | done | — | workplans/CUST-WP-0023-tpsc.md |
|
||||
| task | CUST-WP-0024-T01 | done | — | workplans/CUST-WP-0024-repo-doi-gate.md |
|
||||
| task | CUST-WP-0024-T02 | done | — | workplans/CUST-WP-0024-repo-doi-gate.md |
|
||||
| task | CUST-WP-0024-T03 | done | — | workplans/CUST-WP-0024-repo-doi-gate.md |
|
||||
| task | CUST-WP-0024-T04 | done | — | workplans/CUST-WP-0024-repo-doi-gate.md |
|
||||
| task | CUST-WP-0024-T05 | done | — | workplans/CUST-WP-0024-repo-doi-gate.md |
|
||||
| task | CUST-WP-0026-T01 | done | — | workplans/CUST-WP-0026-distributed-consistency.md |
|
||||
| task | CUST-WP-0026-T02 | done | — | workplans/CUST-WP-0026-distributed-consistency.md |
|
||||
| task | CUST-WP-0026-T03 | done | — | workplans/CUST-WP-0026-distributed-consistency.md |
|
||||
| task | CUST-WP-0026-T04 | done | — | workplans/CUST-WP-0026-distributed-consistency.md |
|
||||
| task | CUST-WP-0026-T05 | done | — | workplans/CUST-WP-0026-distributed-consistency.md |
|
||||
| task | CUST-WP-0027-T01 | done | — | workplans/CUST-WP-0027-capability-request-dispute.md |
|
||||
| task | CUST-WP-0027-T02 | done | — | workplans/CUST-WP-0027-capability-request-dispute.md |
|
||||
| task | CUST-WP-0027-T03 | done | — | workplans/CUST-WP-0027-capability-request-dispute.md |
|
||||
| task | CUST-WP-0027-T04 | done | — | workplans/CUST-WP-0027-capability-request-dispute.md |
|
||||
| task | CUST-WP-0027-T05 | done | — | workplans/CUST-WP-0027-capability-request-dispute.md |
|
||||
| task | CUST-WP-0029-T01 | done | — | workplans/CUST-WP-0029-token-consumption-tracking.md |
|
||||
| task | CUST-WP-0029-T02 | done | — | workplans/CUST-WP-0029-token-consumption-tracking.md |
|
||||
| task | CUST-WP-0029-T03 | done | — | workplans/CUST-WP-0029-token-consumption-tracking.md |
|
||||
| task | CUST-WP-0029-T04 | done | — | workplans/CUST-WP-0029-token-consumption-tracking.md |
|
||||
| task | CUST-WP-0029-T05 | done | — | workplans/CUST-WP-0029-token-consumption-tracking.md |
|
||||
| task | CUST-WP-0029-T06 | done | — | workplans/CUST-WP-0029-token-consumption-tracking.md |
|
||||
| task | CUST-WP-0029-T07 | done | — | workplans/CUST-WP-0029-token-consumption-tracking.md |
|
||||
| task | CUST-WP-0029-T08 | done | — | workplans/CUST-WP-0029-token-consumption-tracking.md |
|
||||
| task | T01 | done | — | workplans/CUST-WP-0030-dashboard-entity-list-ux.md |
|
||||
| task | T02 | done | — | workplans/CUST-WP-0030-dashboard-entity-list-ux.md |
|
||||
| task | T03 | done | — | workplans/CUST-WP-0030-dashboard-entity-list-ux.md |
|
||||
| task | T04 | done | — | workplans/CUST-WP-0030-dashboard-entity-list-ux.md |
|
||||
| task | T05 | done | — | workplans/CUST-WP-0030-dashboard-entity-list-ux.md |
|
||||
| task | T06 | done | — | workplans/CUST-WP-0030-dashboard-entity-list-ux.md |
|
||||
| task | T07 | done | — | workplans/CUST-WP-0030-dashboard-entity-list-ux.md |
|
||||
| task | T08 | done | — | workplans/CUST-WP-0030-dashboard-entity-list-ux.md |
|
||||
| task | T09 | done | — | workplans/CUST-WP-0030-dashboard-entity-list-ux.md |
|
||||
| task | T01 | done | — | workplans/CUST-WP-0031-capability-registry.md |
|
||||
| task | T02 | done | — | workplans/CUST-WP-0031-capability-registry.md |
|
||||
| task | T03 | done | — | workplans/CUST-WP-0031-capability-registry.md |
|
||||
| task | T04 | done | — | workplans/CUST-WP-0031-capability-registry.md |
|
||||
| task | T05 | done | — | workplans/CUST-WP-0031-capability-registry.md |
|
||||
| task | T06 | done | — | workplans/CUST-WP-0031-capability-registry.md |
|
||||
| task | T07 | done | — | workplans/CUST-WP-0031-capability-registry.md |
|
||||
| task | CUST-WP-0032-T01 | done | — | workplans/CUST-WP-0032-haskell-build-machine.md |
|
||||
| task | CUST-WP-0032-T02 | done | — | workplans/CUST-WP-0032-haskell-build-machine.md |
|
||||
| task | CUST-WP-0032-T03 | done | — | workplans/CUST-WP-0032-haskell-build-machine.md |
|
||||
| task | CUST-WP-0032-T04 | done | — | workplans/CUST-WP-0032-haskell-build-machine.md |
|
||||
| task | CUST-WP-0032-T05 | done | — | workplans/CUST-WP-0032-haskell-build-machine.md |
|
||||
| task | CUST-WP-0032-T06 | done | — | workplans/CUST-WP-0032-haskell-build-machine.md |
|
||||
| task | CUST-WP-0032-T07 | done | — | workplans/CUST-WP-0032-haskell-build-machine.md |
|
||||
| task | CUST-WP-0032-T08 | done | — | workplans/CUST-WP-0032-haskell-build-machine.md |
|
||||
| task | CUST-WP-0032-T09 | done | — | workplans/CUST-WP-0032-haskell-build-machine.md |
|
||||
| task | CUST-WP-0032-T10 | done | — | workplans/CUST-WP-0032-haskell-build-machine.md |
|
||||
| task | CUST-WP-0032-T11 | done | — | workplans/CUST-WP-0032-haskell-build-machine.md |
|
||||
| task | CUST-WP-0032-T12 | done | — | workplans/CUST-WP-0032-haskell-build-machine.md |
|
||||
| task | CUST-WP-0032-T13 | done | — | workplans/CUST-WP-0032-haskell-build-machine.md |
|
||||
| task | CUST-WP-0032-T14 | done | — | workplans/CUST-WP-0032-haskell-build-machine.md |
|
||||
| task | CUST-WP-0032-T15 | done | — | workplans/CUST-WP-0032-haskell-build-machine.md |
|
||||
| task | CUST-WP-0033-T01 | done | — | workplans/CUST-WP-0033-interface-change-registry.md |
|
||||
| task | CUST-WP-0033-T02 | done | — | workplans/CUST-WP-0033-interface-change-registry.md |
|
||||
| task | CUST-WP-0033-T03 | done | — | workplans/CUST-WP-0033-interface-change-registry.md |
|
||||
| task | CUST-WP-0033-T04 | done | — | workplans/CUST-WP-0033-interface-change-registry.md |
|
||||
| task | CUST-WP-0033-T05 | done | — | workplans/CUST-WP-0033-interface-change-registry.md |
|
||||
| task | CUST-WP-0033-T06 | done | — | workplans/CUST-WP-0033-interface-change-registry.md |
|
||||
| task | CUST-WP-0039-T1 | done | — | workplans/CUST-WP-0039-dashboard-poll-optimization.md |
|
||||
| task | CUST-WP-0039-T2 | done | — | workplans/CUST-WP-0039-dashboard-poll-optimization.md |
|
||||
| task | CUST-WP-0039-T3 | done | — | workplans/CUST-WP-0039-dashboard-poll-optimization.md |
|
||||
| task | CUST-WP-0039-T4 | done | — | workplans/CUST-WP-0039-dashboard-poll-optimization.md |
|
||||
| task | CUST-WP-0039-T5 | done | — | workplans/CUST-WP-0039-dashboard-poll-optimization.md |
|
||||
| task | CUST-WP-0039-T6 | done | — | workplans/CUST-WP-0039-dashboard-poll-optimization.md |
|
||||
| task | T01 | done | — | workplans/CUST-WP-0040-state-hub-nats-activity-core-integration.md |
|
||||
| task | T02 | done | — | workplans/CUST-WP-0040-state-hub-nats-activity-core-integration.md |
|
||||
| task | T03 | done | — | workplans/CUST-WP-0040-state-hub-nats-activity-core-integration.md |
|
||||
| task | T04 | done | — | workplans/CUST-WP-0040-state-hub-nats-activity-core-integration.md |
|
||||
| task | T05 | done | — | workplans/CUST-WP-0040-state-hub-nats-activity-core-integration.md |
|
||||
| task | T06 | done | — | workplans/CUST-WP-0040-state-hub-nats-activity-core-integration.md |
|
||||
| task | CUST-WP-0041-T1 | done | — | workplans/CUST-WP-0041-api-performance.md |
|
||||
| task | CUST-WP-0041-T2 | done | — | workplans/CUST-WP-0041-api-performance.md |
|
||||
| task | CUST-WP-0041-T3 | done | — | workplans/CUST-WP-0041-api-performance.md |
|
||||
| task | CUST-WP-0041-T4 | done | — | workplans/CUST-WP-0041-api-performance.md |
|
||||
| task | CUST-WP-0043-T01 | done | — | workplans/CUST-WP-0043-state-hub-repo-extraction.md |
|
||||
| task | CUST-WP-0043-T02 | done | — | workplans/CUST-WP-0043-state-hub-repo-extraction.md |
|
||||
| task | CUST-WP-0043-T03 | done | — | workplans/CUST-WP-0043-state-hub-repo-extraction.md |
|
||||
| task | CUST-WP-0043-T04 | done | — | workplans/CUST-WP-0043-state-hub-repo-extraction.md |
|
||||
| task | CUST-WP-0043-T05 | done | — | workplans/CUST-WP-0043-state-hub-repo-extraction.md |
|
||||
| task | CUST-WP-0043-T06 | done | — | workplans/CUST-WP-0043-state-hub-repo-extraction.md |
|
||||
| task | CUST-WP-0043-T07 | done | — | workplans/CUST-WP-0043-state-hub-repo-extraction.md |
|
||||
| task | CUST-WP-0043-T08 | done | — | workplans/CUST-WP-0043-state-hub-repo-extraction.md |
|
||||
| task | CUST-WP-0043-T09 | done | — | workplans/CUST-WP-0043-state-hub-repo-extraction.md |
|
||||
| task | CUST-WP-0044-T01 | done | — | workplans/CUST-WP-0044-daily-statehub-wsjf-triage.md |
|
||||
| task | CUST-WP-0044-T02 | done | — | workplans/CUST-WP-0044-daily-statehub-wsjf-triage.md |
|
||||
| task | CUST-WP-0044-T03 | done | — | workplans/CUST-WP-0044-daily-statehub-wsjf-triage.md |
|
||||
| task | CUST-WP-0044-T04 | done | — | workplans/CUST-WP-0044-daily-statehub-wsjf-triage.md |
|
||||
| task | CUST-WP-0044-T05 | done | — | workplans/CUST-WP-0044-daily-statehub-wsjf-triage.md |
|
||||
| task | CUST-WP-0044-T06 | done | — | workplans/CUST-WP-0044-daily-statehub-wsjf-triage.md |
|
||||
| task | CUST-WP-0045-T01 | done | — | workplans/CUST-WP-0045-activity-core-daily-triage-runner.md |
|
||||
| task | CUST-WP-0045-T02 | done | — | workplans/CUST-WP-0045-activity-core-daily-triage-runner.md |
|
||||
| task | CUST-WP-0045-T03 | done | — | workplans/CUST-WP-0045-activity-core-daily-triage-runner.md |
|
||||
| task | CUST-WP-0045-T04 | done | — | workplans/CUST-WP-0045-activity-core-daily-triage-runner.md |
|
||||
| task | CUST-WP-0045-T05 | done | — | workplans/CUST-WP-0045-activity-core-daily-triage-runner.md |
|
||||
| task | CUST-WP-0045-T06 | done | — | workplans/CUST-WP-0045-activity-core-daily-triage-runner.md |
|
||||
| task | CUST-WP-0045-T07 | done | — | workplans/CUST-WP-0045-activity-core-daily-triage-runner.md |
|
||||
| task | CUST-WP-0045-T08 | done | — | workplans/CUST-WP-0045-activity-core-daily-triage-runner.md |
|
||||
| task | CUST-WP-0046-T01 | done | — | workplans/CUST-WP-0046-hourly-recently-on-scope-activity-core.md |
|
||||
| task | CUST-WP-0046-T02 | done | — | workplans/CUST-WP-0046-hourly-recently-on-scope-activity-core.md |
|
||||
| task | CUST-WP-0046-T03 | done | — | workplans/CUST-WP-0046-hourly-recently-on-scope-activity-core.md |
|
||||
| task | CUST-WP-0046-T04 | done | — | workplans/CUST-WP-0046-hourly-recently-on-scope-activity-core.md |
|
||||
| task | CUST-WP-0046-T05 | done | — | workplans/CUST-WP-0046-hourly-recently-on-scope-activity-core.md |
|
||||
| task | CUST-WP-0046-T06 | done | — | workplans/CUST-WP-0046-hourly-recently-on-scope-activity-core.md |
|
||||
| task | CUST-WP-0046-T07 | done | — | workplans/CUST-WP-0046-hourly-recently-on-scope-activity-core.md |
|
||||
| task | CUST-WP-0047-T01 | done | — | workplans/CUST-WP-0047-ops-hub-service-inventory-now-view.md |
|
||||
| task | CUST-WP-0047-T02 | done | — | workplans/CUST-WP-0047-ops-hub-service-inventory-now-view.md |
|
||||
| task | CUST-WP-0047-T03 | done | — | workplans/CUST-WP-0047-ops-hub-service-inventory-now-view.md |
|
||||
| task | CUST-WP-0047-T04 | done | — | workplans/CUST-WP-0047-ops-hub-service-inventory-now-view.md |
|
||||
| task | CUST-WP-0047-T05 | cancel | — | workplans/CUST-WP-0047-ops-hub-service-inventory-now-view.md |
|
||||
| task | CUST-WP-0047-T06 | done | — | workplans/CUST-WP-0047-ops-hub-service-inventory-now-view.md |
|
||||
| task | CUST-WP-0047-T07 | done | — | workplans/CUST-WP-0047-ops-hub-service-inventory-now-view.md |
|
||||
| task | CUST-WP-0048-T01 | done | — | workplans/CUST-WP-0048-hub-core-state-hub-import-refactor.md |
|
||||
| task | CUST-WP-0048-T02 | done | — | workplans/CUST-WP-0048-hub-core-state-hub-import-refactor.md |
|
||||
| task | CUST-WP-0048-T03 | done | — | workplans/CUST-WP-0048-hub-core-state-hub-import-refactor.md |
|
||||
| task | CUST-WP-0048-T04 | done | — | workplans/CUST-WP-0048-hub-core-state-hub-import-refactor.md |
|
||||
| task | CUST-WP-0048-T05 | done | — | workplans/CUST-WP-0048-hub-core-state-hub-import-refactor.md |
|
||||
| task | CUST-WP-0048-T06 | done | — | workplans/CUST-WP-0048-hub-core-state-hub-import-refactor.md |
|
||||
| task | CUST-WP-0048-T07 | done | — | workplans/CUST-WP-0048-hub-core-state-hub-import-refactor.md |
|
||||
| task | CUST-WP-0048-T08 | done | — | workplans/CUST-WP-0048-hub-core-state-hub-import-refactor.md |
|
||||
| task | CUST-WP-0049-T01 | done | — | workplans/CUST-WP-0049-interhub-bootstrap-access-lane.md |
|
||||
| task | CUST-WP-0049-T02 | done | — | workplans/CUST-WP-0049-interhub-bootstrap-access-lane.md |
|
||||
| task | CUST-WP-0049-T03 | done | — | workplans/CUST-WP-0049-interhub-bootstrap-access-lane.md |
|
||||
| task | CUST-WP-0049-T04 | done | — | workplans/CUST-WP-0049-interhub-bootstrap-access-lane.md |
|
||||
| task | CUST-WP-0049-T05 | done | — | workplans/CUST-WP-0049-interhub-bootstrap-access-lane.md |
|
||||
| task | CUST-WP-0049-T06 | cancel | — | workplans/CUST-WP-0049-interhub-bootstrap-access-lane.md |
|
||||
| task | CUST-WP-0050-T01 | done | — | workplans/CUST-WP-0050-repo-classification-registration-redesign.md |
|
||||
| task | CUST-WP-0050-T02 | done | — | workplans/CUST-WP-0050-repo-classification-registration-redesign.md |
|
||||
| task | CUST-WP-0050-T03 | cancel | — | workplans/CUST-WP-0050-repo-classification-registration-redesign.md |
|
||||
| task | CUST-WP-0050-T04 | cancel | — | workplans/CUST-WP-0050-repo-classification-registration-redesign.md |
|
||||
| task | CUST-WP-0050-T05 | cancel | — | workplans/CUST-WP-0050-repo-classification-registration-redesign.md |
|
||||
| task | CUST-WP-0050-T06 | cancel | — | workplans/CUST-WP-0050-repo-classification-registration-redesign.md |
|
||||
| task | CUST-WP-0050-T07 | cancel | — | workplans/CUST-WP-0050-repo-classification-registration-redesign.md |
|
||||
| task | CUST-WP-0050-T08 | cancel | — | workplans/CUST-WP-0050-repo-classification-registration-redesign.md |
|
||||
| task | CUST-WP-0050-T09 | cancel | — | workplans/CUST-WP-0050-repo-classification-registration-redesign.md |
|
||||
| task | CUST-WP-0050-T10 | cancel | — | workplans/CUST-WP-0050-repo-classification-registration-redesign.md |
|
||||
| task | CUST-WP-0050-T11 | done | — | workplans/CUST-WP-0050-repo-classification-registration-redesign.md |
|
||||
| task | CUST-WP-0051-T01 | done | — | workplans/CUST-WP-0051-infrastructure-stabilization-metaplan.md |
|
||||
| task | CUST-WP-0051-T02 | done | — | workplans/CUST-WP-0051-infrastructure-stabilization-metaplan.md |
|
||||
| task | CUST-WP-0051-T03 | done | — | workplans/CUST-WP-0051-infrastructure-stabilization-metaplan.md |
|
||||
| task | CUST-WP-0051-T04 | done | — | workplans/CUST-WP-0051-infrastructure-stabilization-metaplan.md |
|
||||
| task | CUST-WP-0051-T05 | done | — | workplans/CUST-WP-0051-infrastructure-stabilization-metaplan.md |
|
||||
| task | CUST-WP-0051-T06 | done | — | workplans/CUST-WP-0051-infrastructure-stabilization-metaplan.md |
|
||||
| task | CUST-WP-0051-T07 | done | — | workplans/CUST-WP-0051-infrastructure-stabilization-metaplan.md |
|
||||
| task | CUST-WP-0051-T08 | done | — | workplans/CUST-WP-0051-infrastructure-stabilization-metaplan.md |
|
||||
| task | CUST-WP-0052-T01 | done | — | workplans/CUST-WP-0052-core-hub-fos-reset.md |
|
||||
| task | CUST-WP-0052-T02 | done | — | workplans/CUST-WP-0052-core-hub-fos-reset.md |
|
||||
| task | CUST-WP-0052-T03 | done | — | workplans/CUST-WP-0052-core-hub-fos-reset.md |
|
||||
| task | CUST-WP-0052-T04 | done | — | workplans/CUST-WP-0052-core-hub-fos-reset.md |
|
||||
| task | CUST-WP-0052-T05 | done | — | workplans/CUST-WP-0052-core-hub-fos-reset.md |
|
||||
| task | CUST-WP-0052-T06 | done | — | workplans/CUST-WP-0052-core-hub-fos-reset.md |
|
||||
| task | CUST-WP-0052-T07 | done | — | workplans/CUST-WP-0052-core-hub-fos-reset.md |
|
||||
| task | CUST-WP-0053-T01 | done | — | workplans/CUST-WP-0053-coordination-hygiene-improvements.md |
|
||||
| task | CUST-WP-0053-T02 | done | — | workplans/CUST-WP-0053-coordination-hygiene-improvements.md |
|
||||
| task | CUST-WP-0053-T03 | done | — | workplans/CUST-WP-0053-coordination-hygiene-improvements.md |
|
||||
| task | CUST-WP-0053-T04 | done | — | workplans/CUST-WP-0053-coordination-hygiene-improvements.md |
|
||||
| task | CUST-WP-0053-T05 | done | — | workplans/CUST-WP-0053-coordination-hygiene-improvements.md |
|
||||
| task | CUST-WP-0055-T01 | done | — | workplans/CUST-WP-0055-workplan-terminology-fleet-refactor.md |
|
||||
| task | CUST-WP-0055-T02 | done | — | workplans/CUST-WP-0055-workplan-terminology-fleet-refactor.md |
|
||||
| task | CUST-WP-0055-T03 | done | — | workplans/CUST-WP-0055-workplan-terminology-fleet-refactor.md |
|
||||
| task | CUST-WP-0055-T04 | done | — | workplans/CUST-WP-0055-workplan-terminology-fleet-refactor.md |
|
||||
| task | CUST-WP-0055-T05 | done | — | workplans/CUST-WP-0055-workplan-terminology-fleet-refactor.md |
|
||||
| task | CUST-WP-0055-T06 | done | — | workplans/CUST-WP-0055-workplan-terminology-fleet-refactor.md |
|
||||
| task | CUST-WP-0055-T07 | done | — | workplans/CUST-WP-0055-workplan-terminology-fleet-refactor.md |
|
||||
| task | CUST-WP-0055-T08 | done | — | workplans/CUST-WP-0055-workplan-terminology-fleet-refactor.md |
|
||||
| task | CUST-WP-0056-T01 | done | — | workplans/CUST-WP-0056-daily-todo-md-stale-review.md |
|
||||
| task | CUST-WP-0056-T02 | done | — | workplans/CUST-WP-0056-daily-todo-md-stale-review.md |
|
||||
| task | CUST-WP-0056-T03 | done | — | workplans/CUST-WP-0056-daily-todo-md-stale-review.md |
|
||||
| task | CUST-WP-0059-T01 | done | — | workplans/CUST-WP-0059-forgejo-ci-publish-cutover-tail.md |
|
||||
| task | CUST-WP-0059-T02 | done | — | workplans/CUST-WP-0059-forgejo-ci-publish-cutover-tail.md |
|
||||
| task | CUST-WP-0059-T03 | done | — | workplans/CUST-WP-0059-forgejo-ci-publish-cutover-tail.md |
|
||||
| task | CUST-WP-0059-T04 | done | — | workplans/CUST-WP-0059-forgejo-ci-publish-cutover-tail.md |
|
||||
| task | CUST-WP-0059-T05 | done | — | workplans/CUST-WP-0059-forgejo-ci-publish-cutover-tail.md |
|
||||
| task | CUST-WP-0059-T06 | done | — | workplans/CUST-WP-0059-forgejo-ci-publish-cutover-tail.md |
|
||||
| task | CUST-WP-0060-T01 | done | — | workplans/CUST-WP-0060-work-record-canonization.md |
|
||||
| task | CUST-WP-0060-T02 | done | — | workplans/CUST-WP-0060-work-record-canonization.md |
|
||||
| task | CUST-WP-0060-T03 | done | — | workplans/CUST-WP-0060-work-record-canonization.md |
|
||||
| task | CUST-WP-0060-T04 | done | — | workplans/CUST-WP-0060-work-record-canonization.md |
|
||||
| task | CUST-WP-0060-T05 | done | — | workplans/CUST-WP-0060-work-record-canonization.md |
|
||||
| task | CUST-WP-0060-T06 | done | — | workplans/CUST-WP-0060-work-record-canonization.md |
|
||||
| task | CUST-WP-0060-T07 | done | — | workplans/CUST-WP-0060-work-record-canonization.md |
|
||||
| task | CUST-WP-0061-T01 | done | — | workplans/CUST-WP-0061-work-record-stage3-intake-promotion-index.md |
|
||||
| task | CUST-WP-0061-T02 | done | — | workplans/CUST-WP-0061-work-record-stage3-intake-promotion-index.md |
|
||||
| task | CUST-WP-0061-T03 | done | — | workplans/CUST-WP-0061-work-record-stage3-intake-promotion-index.md |
|
||||
| task | CUST-WP-0061-T04 | done | — | workplans/CUST-WP-0061-work-record-stage3-intake-promotion-index.md |
|
||||
| task | CUST-WP-0061-T05 | done | — | workplans/CUST-WP-0061-work-record-stage3-intake-promotion-index.md |
|
||||
| task | CUST-WP-0061-T06 | done | — | workplans/CUST-WP-0061-work-record-stage3-intake-promotion-index.md |
|
||||
| task | CUST-WP-0062-T01 | done | — | workplans/CUST-WP-0062-sbom-nexus-daily-catchup.md |
|
||||
| task | CUST-WP-0062-T02 | done | — | workplans/CUST-WP-0062-sbom-nexus-daily-catchup.md |
|
||||
| task | CUST-WP-0062-T03 | done | — | workplans/CUST-WP-0062-sbom-nexus-daily-catchup.md |
|
||||
| task | CUST-WP-0062-T04 | done | — | workplans/CUST-WP-0062-sbom-nexus-daily-catchup.md |
|
||||
| task | CUST-WP-0062-T05 | done | — | workplans/CUST-WP-0062-sbom-nexus-daily-catchup.md |
|
||||
| task | CUST-WP-0062-T06 | done | — | workplans/CUST-WP-0062-sbom-nexus-daily-catchup.md |
|
||||
| task | CUST-WP-0063-T01 | done | — | workplans/CUST-WP-0063-inbox-governance-packets.md |
|
||||
| task | CUST-WP-0063-T02 | done | — | workplans/CUST-WP-0063-inbox-governance-packets.md |
|
||||
| task | CUST-WP-0063-T03 | done | — | workplans/CUST-WP-0063-inbox-governance-packets.md |
|
||||
| task | CUST-WP-0063-T04 | done | — | workplans/CUST-WP-0063-inbox-governance-packets.md |
|
||||
| task | CUST-WP-0063-T05 | done | — | workplans/CUST-WP-0063-inbox-governance-packets.md |
|
||||
| task | CUST-WP-0064-T01 | done | — | workplans/CUST-WP-0064-sbom-controlled-scan-inputs.md |
|
||||
| task | CUST-WP-0064-T02 | done | — | workplans/CUST-WP-0064-sbom-controlled-scan-inputs.md |
|
||||
| task | CUST-WP-0064-T03 | done | — | workplans/CUST-WP-0064-sbom-controlled-scan-inputs.md |
|
||||
| task | CUST-WP-0064-T04 | done | — | workplans/CUST-WP-0064-sbom-controlled-scan-inputs.md |
|
||||
| task | CUST-WP-0065-T01 | done | — | workplans/CUST-WP-0065-reclassify-repos-and-guidance-docs-to-the-new-sector-domain.md |
|
||||
| task | CUST-WP-0065-T02 | done | — | workplans/CUST-WP-0065-reclassify-repos-and-guidance-docs-to-the-new-sector-domain.md |
|
||||
| task | CUST-WP-0065-T03 | done | — | workplans/CUST-WP-0065-reclassify-repos-and-guidance-docs-to-the-new-sector-domain.md |
|
||||
| task | CUST-WP-0065-T04 | done | — | workplans/CUST-WP-0065-reclassify-repos-and-guidance-docs-to-the-new-sector-domain.md |
|
||||
| task | CUST-WP-0066-T01 | done | — | workplans/CUST-WP-0066-repository-qualified-ad-hoc-identifiers.md |
|
||||
| task | CUST-WP-0066-T02 | done | — | workplans/CUST-WP-0066-repository-qualified-ad-hoc-identifiers.md |
|
||||
| task | CUST-WP-0066-T03 | done | — | workplans/CUST-WP-0066-repository-qualified-ad-hoc-identifiers.md |
|
||||
| task | CUST-WP-0067-T01 | done | — | workplans/CUST-WP-0067-hub-authority-target-resolution.md |
|
||||
| task | CUST-WP-0067-T02 | done | — | workplans/CUST-WP-0067-hub-authority-target-resolution.md |
|
||||
| task | CUST-WP-0067-T03 | done | — | workplans/CUST-WP-0067-hub-authority-target-resolution.md |
|
||||
| task | CUST-WP-0067-T04 | done | — | workplans/CUST-WP-0067-hub-authority-target-resolution.md |
|
||||
| task | CUST-WP-0067-T05 | done | — | workplans/CUST-WP-0067-hub-authority-target-resolution.md |
|
||||
| task | CUST-WP-0067-T06 | done | — | workplans/CUST-WP-0067-hub-authority-target-resolution.md |
|
||||
| task | CUST-WP-0067-T07 | done | — | workplans/CUST-WP-0067-hub-authority-target-resolution.md |
|
||||
| task | CUST-WP-0067-T08 | done | — | workplans/CUST-WP-0067-hub-authority-target-resolution.md |
|
||||
| task | CUST-WP-0067-T09 | done | — | workplans/CUST-WP-0067-hub-authority-target-resolution.md |
|
||||
| task | CUST-WP-0067-T10 | done | — | workplans/CUST-WP-0067-hub-authority-target-resolution.md |
|
||||
| task | CUST-WP-0068-T01 | done | — | workplans/CUST-WP-0068-cache-only-work-record-recovery.md |
|
||||
| task | CUST-WP-0068-T02 | done | — | workplans/CUST-WP-0068-cache-only-work-record-recovery.md |
|
||||
| task | CUST-WP-0068-T03 | done | — | workplans/CUST-WP-0068-cache-only-work-record-recovery.md |
|
||||
| task | CUST-WP-0068-T04 | done | — | workplans/CUST-WP-0068-cache-only-work-record-recovery.md |
|
||||
| task | CUST-WP-0068-T05 | done | — | workplans/CUST-WP-0068-cache-only-work-record-recovery.md |
|
||||
| task | CUST-WP-0068-T06 | done | — | workplans/CUST-WP-0068-cache-only-work-record-recovery.md |
|
||||
| task | CUST-WP-0068-T07 | done | — | workplans/CUST-WP-0068-cache-only-work-record-recovery.md |
|
||||
| task | CUST-WP-0068-T08 | done | — | workplans/CUST-WP-0068-cache-only-work-record-recovery.md |
|
||||
| task | CUST-WP-0068-T09 | done | — | workplans/CUST-WP-0068-cache-only-work-record-recovery.md |
|
||||
| task | CUST-WP-0070-T01 | done | — | workplans/CUST-WP-0070-publication-repo-category.md |
|
||||
| task | CUST-WP-0070-T02 | done | — | workplans/CUST-WP-0070-publication-repo-category.md |
|
||||
| task | CUST-WP-0070-T03 | done | — | workplans/CUST-WP-0070-publication-repo-category.md |
|
||||
| task | CUST-WP-0071-T01 | done | — | workplans/CUST-WP-0071-measured-workload-sizing-and-weekly-review.md |
|
||||
| task | CUST-WP-0071-T02 | wait | — | workplans/CUST-WP-0071-measured-workload-sizing-and-weekly-review.md |
|
||||
| task | CUST-WP-0071-T03 | wait | — | workplans/CUST-WP-0071-measured-workload-sizing-and-weekly-review.md |
|
||||
| task | CUST-WP-0071-T04 | wait | — | workplans/CUST-WP-0071-measured-workload-sizing-and-weekly-review.md |
|
||||
| task | CUST-WP-0071-T05 | wait | — | workplans/CUST-WP-0071-measured-workload-sizing-and-weekly-review.md |
|
||||
| task | CUST-WP-0072-T01 | done | — | workplans/CUST-WP-0072-fleet-flavor-and-depends-on-backfill.md |
|
||||
| task | CUST-WP-0072-T02 | done | — | workplans/CUST-WP-0072-fleet-flavor-and-depends-on-backfill.md |
|
||||
| task | CUST-WP-0072-T03 | done | — | workplans/CUST-WP-0072-fleet-flavor-and-depends-on-backfill.md |
|
||||
| task | CUST-WP-0072-T04 | done | — | workplans/CUST-WP-0072-fleet-flavor-and-depends-on-backfill.md |
|
||||
| task | CUST-WP-0073-T01 | done | — | workplans/CUST-WP-0073-agent-credential-separation.md |
|
||||
| task | CUST-WP-0073-T02 | wait | — | workplans/CUST-WP-0073-agent-credential-separation.md |
|
||||
| task | CUST-WP-0073-T03 | done | — | workplans/CUST-WP-0073-agent-credential-separation.md |
|
||||
| task | CUST-WP-0073-T04 | wait | — | workplans/CUST-WP-0073-agent-credential-separation.md |
|
||||
| task | CUST-WP-0073-T05 | wait | — | workplans/CUST-WP-0073-agent-credential-separation.md |
|
||||
| task | CUST-WP-0074-T01 | done | — | workplans/CUST-WP-0074-qualified-wait-states.md |
|
||||
| task | CUST-WP-0074-T02 | done | — | workplans/CUST-WP-0074-qualified-wait-states.md |
|
||||
| task | CUST-WP-0074-T03 | done | — | workplans/CUST-WP-0074-qualified-wait-states.md |
|
||||
| task | CUST-WP-0074-T04 | done | — | workplans/CUST-WP-0074-qualified-wait-states.md |
|
||||
| task | CUST-WP-0074-T05 | done | — | workplans/CUST-WP-0074-qualified-wait-states.md |
|
||||
| task | CUST-WP-0074-T06 | done | — | workplans/CUST-WP-0074-qualified-wait-states.md |
|
||||
| task | CUST-WP-0075-T01 | done | — | workplans/CUST-WP-0075-dependency-graph-driven-unblocking.md |
|
||||
| task | CUST-WP-0075-T02 | done | — | workplans/CUST-WP-0075-dependency-graph-driven-unblocking.md |
|
||||
| task | CUST-WP-0075-T03 | done | — | workplans/CUST-WP-0075-dependency-graph-driven-unblocking.md |
|
||||
| task | CUST-WP-0075-T04 | done | — | workplans/CUST-WP-0075-dependency-graph-driven-unblocking.md |
|
||||
| task | CUST-WP-0075-T05 | done | — | workplans/CUST-WP-0075-dependency-graph-driven-unblocking.md |
|
||||
| task | CUST-WP-0075-T06 | done | — | workplans/CUST-WP-0075-dependency-graph-driven-unblocking.md |
|
||||
| task | CUST-WP-0076-T01 | done | — | workplans/CUST-WP-0076-provisioning-window-cadence.md |
|
||||
| task | CUST-WP-0077-T01 | done | — | workplans/CUST-WP-0077-dependency-root-execution-wave.md |
|
||||
| task | CUST-WP-0077-T02 | done | — | workplans/CUST-WP-0077-dependency-root-execution-wave.md |
|
||||
| task | CUST-WP-0077-T03 | done | — | workplans/CUST-WP-0077-dependency-root-execution-wave.md |
|
||||
| task | CUST-WP-0077-T04 | done | — | workplans/CUST-WP-0077-dependency-root-execution-wave.md |
|
||||
| task | CUST-WP-0077-T05 | done | — | workplans/CUST-WP-0077-dependency-root-execution-wave.md |
|
||||
| task | CUST-WP-0078-T01 | done | — | workplans/CUST-WP-0078-security-collaboration-consolidation.md |
|
||||
| task | CUST-WP-0078-T02 | done | — | workplans/CUST-WP-0078-security-collaboration-consolidation.md |
|
||||
| task | CUST-WP-0078-T03 | done | — | workplans/CUST-WP-0078-security-collaboration-consolidation.md |
|
||||
| task | CUST-WP-0078-T04 | done | — | workplans/CUST-WP-0078-security-collaboration-consolidation.md |
|
||||
| task | CUST-WP-0079-T01 | done | — | workplans/CUST-WP-0079-deterministic-security-flow.md |
|
||||
| task | CUST-WP-0079-T02 | done | — | workplans/CUST-WP-0079-deterministic-security-flow.md |
|
||||
| task | CUST-WP-0079-T03 | wait | — | workplans/CUST-WP-0079-deterministic-security-flow.md |
|
||||
| task | CUST-WP-0079-T04 | wait | — | workplans/CUST-WP-0079-deterministic-security-flow.md |
|
||||
| task | CUST-WP-0079-T05 | wait | — | workplans/CUST-WP-0079-deterministic-security-flow.md |
|
||||
| task | CUST-WP-0079-T06 | wait | — | workplans/CUST-WP-0079-deterministic-security-flow.md |
|
||||
| task | CUST-WP-0079-T07 | done | — | workplans/CUST-WP-0079-deterministic-security-flow.md |
|
||||
| task | CUST-WP-0080-T01 | done | — | workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md |
|
||||
| task | CUST-WP-0080-T02 | done | — | workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md |
|
||||
| task | CUST-WP-0080-T03 | progress | — | workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md |
|
||||
| task | CUST-WP-0080-T04 | todo | — | workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md |
|
||||
| task | CUST-WP-0080-T05 | progress | — | workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md |
|
||||
| task | CUST-WP-0080-T06 | progress | — | workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md |
|
||||
| task | CUST-WP-0081-T01 | done | — | workplans/CUST-WP-0081-netkingdom-architecture-review-and-reuse.md |
|
||||
| task | CUST-WP-0081-T02 | done | — | workplans/CUST-WP-0081-netkingdom-architecture-review-and-reuse.md |
|
||||
| task | CUST-WP-0081-T03 | done | — | workplans/CUST-WP-0081-netkingdom-architecture-review-and-reuse.md |
|
||||
| task | THE-WP-0001-T01 | done | — | workplans/THE-WP-0001-federation-interface.md |
|
||||
| task | THE-WP-0001-T02 | done | — | workplans/THE-WP-0001-federation-interface.md |
|
||||
| intake | CUST-IN-0001 | closed | green | intake-legacy-suggestions-migration.md |
|
||||
| intake | CUST-IN-0002 | closed | green | intake-legacy-suggestions-migration.md |
|
||||
| intake | CUST-IN-0003 | closed | green | intake-legacy-suggestions-migration.md |
|
||||
| intake | CUST-IN-0004 | routed | green | intake-legacy-suggestions-migration.md |
|
||||
| intake | CUST-IN-0005 | closed | green | intake-legacy-suggestions-migration.md |
|
||||
| intake | CUST-IN-0006 | closed | green | intake-legacy-suggestions-migration.md |
|
||||
| intake | CUST-IN-0007 | closed | green | intake-legacy-suggestions-migration.md |
|
||||
| intake | CUST-IN-0008 | closed | blue | intake-legacy-suggestions-migration.md |
|
||||
| intake | CUST-IN-0009 | closed | blue | intake-legacy-suggestions-migration.md |
|
||||
| intake | CUST-IN-0010 | closed | green | intake-legacy-suggestions-migration.md |
|
||||
| intake | CUST-IN-0011 | routed | red | intakes.md |
|
||||
| intake | CUST-IN-0012 | closed | green | intakes.md |
|
||||
| intake | CUST-IN-0013 | closed | blue | intakes.md |
|
||||
| intake | CUST-IN-0014 | closed | blue | intakes.md |
|
||||
| intake | CUST-IN-0015 | open | blue | intakes.md |
|
||||
| intake | CUST-IN-0016 | open | green | intakes.md |
|
||||
| intake | CUST-IN-0017 | open | green | intakes.md |
|
||||
| intake | CUST-IN-0018 | open | green | intakes.md |
|
||||
|
|
@ -0,0 +1,10 @@
|
|||
[
|
||||
{
|
||||
"path": ".custodian-brief.md",
|
||||
"index": "100644 6aad3a5788fad3abd60c0f1270f160062dc0168b 0\t.custodian-brief.md"
|
||||
},
|
||||
{
|
||||
"path": "WORK-RECORDS.md",
|
||||
"index": "100644 d535e0f2dcc3d454e041a8f1b547b5dea4493380 0\tWORK-RECORDS.md"
|
||||
}
|
||||
]
|
||||
|
|
@ -0,0 +1,53 @@
|
|||
{
|
||||
"exit_code": 0,
|
||||
"commit": "16ab1bb490336fb2f954612b85e91f15bc5e7eff",
|
||||
"base": "c034f59befba077ed6c0e2bfc8679aa648aa9ed6",
|
||||
"files": [
|
||||
{
|
||||
"path": ".kaizen/agents/custodian-codex/supervision.json",
|
||||
"sha256": "5b39a08166cf20835253bb6e18cffd841bb8c28a1761554fe1e1fa2f3a2457f7"
|
||||
},
|
||||
{
|
||||
"path": "docs/netkingdom-target-implementation.md",
|
||||
"sha256": "2122503300da76c249e7b3fb492f459284bc67407c7b002b774dbbb23045e47d"
|
||||
},
|
||||
{
|
||||
"path": "workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md",
|
||||
"sha256": "9c8c91071f0418748b3bce7e5918e7bf39178e75a5944418d1225fd5ee7b8222"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r3/execution-receipt.json",
|
||||
"sha256": "3f70eedcff7ff4b191bac030ce5a8b0f8e68688960b4fe35ef1745ebc8f3a6eb"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-review-r3/approved-followthrough-preflight.json",
|
||||
"sha256": "1109d69b01d1e2915b0fd546a52574eba16d6e5753ff8be41bf0d044436b3b77"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-review-r3/verify-native-result.py",
|
||||
"sha256": "32d8d75081b0c61bf07c574c61a2b235b9ef9277577b41d99df1eabde265e8ec"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-review-r3/verified-native-result.json",
|
||||
"sha256": "cf20278572bdeca5bbcf3f9fd98017938e2c6be24361f8a9fa70921fcf08bf8a"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-review-r3/completed-supervision-report.json",
|
||||
"sha256": "5fc938005653db73e1be7ea5038f227a0db64e9d7f7d81703851ed0eb760a35e"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/key39-finalization-owner-followthrough-r1/registration-approval-readback.json",
|
||||
"sha256": "c301f87274a9cc6df873d8a42c1cc999bc3226931602cab0a7c4c02e928d1773"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/key39-finalization-owner-followthrough-r1/key39-progress-readback.json",
|
||||
"sha256": "e18a65d4766255b0900ea4b3fbb4d7ee5ca06e7356f9af12e6463728e2d077f4"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/native-source-publication-r3/verified-publication.json",
|
||||
"sha256": "fbeb00fe0df580cbecdb2fad6dde1aa215d8f29d33304f9c1d7cafeeb5d68efc"
|
||||
}
|
||||
],
|
||||
"stdout": "[main 16ab1bb] Record verified native offline startup and precise KEY39 approval scope\n 11 files changed, 531 insertions(+), 43 deletions(-)\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/key39-finalization-owner-followthrough-r1/key39-progress-readback.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/key39-finalization-owner-followthrough-r1/registration-approval-readback.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r3/execution-receipt.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-runtime-install-review-r3/approved-followthrough-preflight.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-runtime-install-review-r3/completed-supervision-report.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-runtime-install-review-r3/verified-native-result.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-runtime-install-review-r3/verify-native-result.py\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-source-publication-r3/verified-publication.json\n",
|
||||
"stderr": "{\"blocked_blob_ids\": [], \"scanned_blobs\": 11, \"scanner_sha256\": \"88f91962aa2f93ac6ab281d553b9e125f5197bbbce38f9f2437f7299c32e5509\", \"scanner_version\": \"8.30.1\", \"scope\": \"changed-staged-blobs\", \"status\": \"clean\"}\n"
|
||||
}
|
||||
|
|
@ -0,0 +1,51 @@
|
|||
{
|
||||
"owner": "the-custodian",
|
||||
"base_revision": "c034f59befba077ed6c0e2bfc8679aa648aa9ed6",
|
||||
"message": "Record verified native offline startup and precise KEY39 approval scope",
|
||||
"files": [
|
||||
{
|
||||
"path": ".kaizen/agents/custodian-codex/supervision.json",
|
||||
"sha256": "5b39a08166cf20835253bb6e18cffd841bb8c28a1761554fe1e1fa2f3a2457f7"
|
||||
},
|
||||
{
|
||||
"path": "docs/netkingdom-target-implementation.md",
|
||||
"sha256": "2122503300da76c249e7b3fb492f459284bc67407c7b002b774dbbb23045e47d"
|
||||
},
|
||||
{
|
||||
"path": "workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md",
|
||||
"sha256": "9c8c91071f0418748b3bce7e5918e7bf39178e75a5944418d1225fd5ee7b8222"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r3/execution-receipt.json",
|
||||
"sha256": "3f70eedcff7ff4b191bac030ce5a8b0f8e68688960b4fe35ef1745ebc8f3a6eb"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-review-r3/approved-followthrough-preflight.json",
|
||||
"sha256": "1109d69b01d1e2915b0fd546a52574eba16d6e5753ff8be41bf0d044436b3b77"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-review-r3/verify-native-result.py",
|
||||
"sha256": "32d8d75081b0c61bf07c574c61a2b235b9ef9277577b41d99df1eabde265e8ec"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-review-r3/verified-native-result.json",
|
||||
"sha256": "cf20278572bdeca5bbcf3f9fd98017938e2c6be24361f8a9fa70921fcf08bf8a"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-review-r3/completed-supervision-report.json",
|
||||
"sha256": "5fc938005653db73e1be7ea5038f227a0db64e9d7f7d81703851ed0eb760a35e"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/key39-finalization-owner-followthrough-r1/registration-approval-readback.json",
|
||||
"sha256": "c301f87274a9cc6df873d8a42c1cc999bc3226931602cab0a7c4c02e928d1773"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/key39-finalization-owner-followthrough-r1/key39-progress-readback.json",
|
||||
"sha256": "e18a65d4766255b0900ea4b3fbb4d7ee5ca06e7356f9af12e6463728e2d077f4"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/native-source-publication-r3/verified-publication.json",
|
||||
"sha256": "fbeb00fe0df580cbecdb2fad6dde1aa215d8f29d33304f9c1d7cafeeb5d68efc"
|
||||
}
|
||||
]
|
||||
}
|
||||
|
|
@ -0,0 +1,16 @@
|
|||
{
|
||||
"status": "verified",
|
||||
"commit": "16ab1bb490336fb2f954612b85e91f15bc5e7eff",
|
||||
"remote_exact": true,
|
||||
"selected_files_verified": 11,
|
||||
"primary": "primary/railiance01",
|
||||
"r3_exact_approved_executed_revision": 3,
|
||||
"r3_native_offline_launcher_exits": [
|
||||
0,
|
||||
0,
|
||||
0
|
||||
],
|
||||
"r2_failed_history_preserved": true,
|
||||
"key39_parent": "active_T02_wait",
|
||||
"target_native_gates_closed": 0
|
||||
}
|
||||
|
|
@ -0,0 +1,51 @@
|
|||
{
|
||||
"proposal_id": "REINAH-WP-0008-T07-install-f599-r1",
|
||||
"revision": 1,
|
||||
"scope": "install exact immutable artifact and credential-free native launcher rehearsal only; no provider/owner/config/catalog/queue actions",
|
||||
"runtime_sha256": "sha256:f59959b605a51abd2901becde14e7abd852c2bd3f848004b51d250d1cb81af6d",
|
||||
"target": "railiance01/tegwick uid1000",
|
||||
"destination": "/home/tegwick/.helixforge-factory/runtimes/f59959b605a51abd2901becde14e7abd852c2bd3f848004b51d250d1cb81af6d",
|
||||
"staging": "/home/tegwick/.helixforge-factory/runtime-install-f599-r1-20261017",
|
||||
"archive": {
|
||||
"sha256": "sha256:4c55b2740e759175d645705518fc33db30b26b4611f68e052a4ca909173084c7",
|
||||
"bytes": 109931109,
|
||||
"logical_file_bytes": 260668241,
|
||||
"members": 1448,
|
||||
"format": "gzip mtime0; PAX tar; sorted tree; root runtime; UID/GID1000; modes and relative symlinks retained"
|
||||
},
|
||||
"helper_hashes": {
|
||||
"execute-install.py": "sha256:2e98dae25c8d7dd52c0d9db23da7a03dc2e9bdfbec3027e56cba3017ae00d218",
|
||||
"install-verified.py": "sha256:da3fe31f2c63431321b01909de0105ed8fb5ee92aede34543e95c03cea589912",
|
||||
"build-transfer.py": "sha256:99914629f354d4b6d5a4750850b32ec2cb64ac5ce18e86702d9157ea6f6b0124",
|
||||
"runtime.py": "sha256:19b5fb687288bbc836978b0251599dc1e4d1593e8b5efee85a6abb6a7f388412"
|
||||
},
|
||||
"source_components": {
|
||||
"sandboxer_runtime_and_store": {
|
||||
"revision": "221126cb77ea41ec283598a23d628f760a51bdea",
|
||||
"matches_current_owner_revision": "53f800c4f7a9c91469834d04ef6f58e906b0bd49"
|
||||
},
|
||||
"rein_owner_rehearsal": {
|
||||
"revision": "9b88cadaa817e5abea7950b4a264d4e2739a5ddb"
|
||||
}
|
||||
},
|
||||
"minimum_free_disk_bytes": 2147483648,
|
||||
"minimum_available_memory_bytes": 1073741824,
|
||||
"cost": {
|
||||
"provider_requests": 0,
|
||||
"new_paid_resource_commitment": false,
|
||||
"incremental_infrastructure_and_operator_eur": "unknown; explicitly supervised"
|
||||
},
|
||||
"risk": {
|
||||
"credible_loss_eur": "unknown; explicitly supervised",
|
||||
"scope": "dormant owner-store append plus bounded local read-only namespace help/version launches; existing shared single-node host IO/CPU risk"
|
||||
},
|
||||
"authority": "pending root exact proposal retention and fresh founder approval",
|
||||
"maximum_cpu_busy_fraction": 0.85,
|
||||
"cpu_sample_seconds": 1,
|
||||
"native_executables": {
|
||||
"controller": "/usr/bin/python3",
|
||||
"readonly_node_client": "/usr/local/bin/kubectl",
|
||||
"sandbox": "/usr/bin/bwrap"
|
||||
},
|
||||
"conditional_cleanup_helper_sha256": "sha256:210401e74ac35897a091ab76095fc09dc9bffb629c89868525016c6a8fec8ed2"
|
||||
}
|
||||
|
|
@ -0,0 +1,76 @@
|
|||
{
|
||||
"proposal_id": "REINAH-WP-0008-T07-install-f599-r1",
|
||||
"revision": 1,
|
||||
"status": "pending-root-review-and-founder-approval",
|
||||
"native_mutation_authorized": false,
|
||||
"files": [
|
||||
{
|
||||
"path": "FINAL-PROPOSAL.md",
|
||||
"sha256": "sha256:408d779a19e0e83b3be9a80ad624c1f7b7be906d22c0a8efe6e629185cc0cd0a"
|
||||
},
|
||||
{
|
||||
"path": "action-inputs.json",
|
||||
"sha256": "sha256:f19316734888dd6702c07bf24f5125f79132d2c64315edcaa25fd35445e4d556"
|
||||
},
|
||||
{
|
||||
"path": "build-transfer.py",
|
||||
"sha256": "sha256:99914629f354d4b6d5a4750850b32ec2cb64ac5ce18e86702d9157ea6f6b0124"
|
||||
},
|
||||
{
|
||||
"path": "cleanup-upload-staging.py",
|
||||
"sha256": "sha256:210401e74ac35897a091ab76095fc09dc9bffb629c89868525016c6a8fec8ed2"
|
||||
},
|
||||
{
|
||||
"path": "cpu-readonly-observation.json",
|
||||
"sha256": "sha256:c424ecb281baf128d6c79f1e6c6f678093f9b5e9c84a3454f9891fe6197b2e95"
|
||||
},
|
||||
{
|
||||
"path": "executable-readonly-observation.json",
|
||||
"sha256": "sha256:3ee73cdeeb4f82a55b31d19c6a24aacc4199e2e8647335d65b4e8f2e7d079c18"
|
||||
},
|
||||
{
|
||||
"path": "execute-install.py",
|
||||
"sha256": "sha256:2e98dae25c8d7dd52c0d9db23da7a03dc2e9bdfbec3027e56cba3017ae00d218"
|
||||
},
|
||||
{
|
||||
"path": "final-readonly-dry-run.json",
|
||||
"sha256": "sha256:c6e792272e718d241648d8179be169fd0c0bb92cb785dc48064fe34acde21cad"
|
||||
},
|
||||
{
|
||||
"path": "install-verified.py",
|
||||
"sha256": "sha256:da3fe31f2c63431321b01909de0105ed8fb5ee92aede34543e95c03cea589912"
|
||||
},
|
||||
{
|
||||
"path": "local-transfer-check.py",
|
||||
"sha256": "sha256:97fbec826d517b1746a2ec5ef67e5aab053777690977abdddc8b33ec5804e22e"
|
||||
},
|
||||
{
|
||||
"path": "local-transfer-verification.json",
|
||||
"sha256": "sha256:2331b854389b4c15f5adce1f62aa0846e9f47dfda351a7ef166c90b5e9b2737c"
|
||||
},
|
||||
{
|
||||
"path": "pre-absolute-path-dry-run.json",
|
||||
"sha256": "sha256:9ea47b71b8636e4beb7dadf595f1d08bde261c9986986a1335d0c00d581a6d0c"
|
||||
},
|
||||
{
|
||||
"path": "retained-headroom-refusal.json",
|
||||
"sha256": "sha256:89c847b4a75f138ff2464fc8291cf36939d293a777fd41ffd41d72f96ba9a2f8"
|
||||
},
|
||||
{
|
||||
"path": "runtime.py",
|
||||
"sha256": "sha256:19b5fb687288bbc836978b0251599dc1e4d1593e8b5efee85a6abb6a7f388412"
|
||||
},
|
||||
{
|
||||
"path": "target-readonly-addendum.json",
|
||||
"sha256": "sha256:9588f51b353093d178b8c52892ca627c2317fab761591715a0765603a4182a8f"
|
||||
},
|
||||
{
|
||||
"path": "target-readonly-observation.json",
|
||||
"sha256": "sha256:ba4012303e5634686208a818b221113a1a670c31ed29269d8a4cc98308616275"
|
||||
},
|
||||
{
|
||||
"path": "transfer-archive.json",
|
||||
"sha256": "sha256:3222ccd39ea968353ea5e58ec36f0e3ca35b608020444243b053074a36abfe0b"
|
||||
}
|
||||
]
|
||||
}
|
||||
Loading…
Add table
Add a link
Reference in a new issue