coulomb/the-custodian
4
0
Fork 0
Code Issues 1 Pull requests Projects Releases Packages Wiki Activity Actions

Record GH-DEC-2026-021 and the closing of B2.

Browse source 
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This commit is contained in:
codex 2026-09-21 12:44:25 +02:00
parent 69802056cd
commit 5764669645
1 changed files with 25 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

25
docs/assessments/2026-09-21-layer-declaration-boundaries.md
View file

@ -260,3 +260,28 @@ The round produced the same failure a third time, now in the checkers: each wrot
- **`VALIDATED_AGAINST`:** six checkers name the v0.7 text in force; tenant-engine and flex-auth name the held v0.8.
ops-warden wrote one reference detector into its playbook (0f9ada0). All of this went to gate-house, with a proposed additional v0.8 flip condition.
## Fourth round, 2026-09-21: GH-DEC-2026-021 and B2 closed
gate-house ruled the third round's findings in GH-DEC-2026-021:
- **Prose citations:** the narrow reading. A12 reaches only a version carried as a pin, so no declaration changes. The ruling notes that this reading benefits gate-house. The wording is drafted as A12 r3 and sent for assent.
- **VALIDATED_AGAINST:** checkers name the accepted v0.7 plus the gate-house decisions they enforce. tenant-engine and flex-auth re-point now.
- **Detector:** ops-warden's playbook detector is the estate reference. Each copy converges on it when next edited, and no later than the post-flip commit.
- **Flip:** not added to GH-DEC-2026-019, because it would be circular as a precondition. Instead it is a post-flip task, GH-WP-0004-T11, and the flip notice must name all eight checkers.
- **A11 r2:** permits a single-repository conformance run.
B2 is closed. All four undeclared repositories declared their own layer:
| Repository | Layer |
|---|---|
| gate-house | Staff |
| key-cape | Tooling |
| ops-mason | Staff, pep-shaped |
| net-kingdom | Taxonomy |
Each reading agrees with §4, and GH-DEC-2026-019's third closing condition is met. Three things surfaced:
- **key-cape:** its token endpoint has the shape of a PIP, and its authentication enforcement sits where §3.3 places enforcement boundaries. It read both as Tooling behaviour.
- **ops-mason:** it writes OpenBao policies and auth roles, creates secret_ids and runs `kubectl apply`, gated by the founder approving the plan rather than by an access-engine decision. Its own earlier review note said otherwise. These are declared as dated gaps to 2026-12-21.
- **net-kingdom:** the canon repository carries runtime material, `identity-provisioner/` and `sso-mfa/k8s/`.
Still open: A11 r2 and A12 r3 assent, INFD-IN-0007 (the §3 cut, outside the §11 hold), and the role vocabulary after A9.