coulomb/the-custodian
4
0
Fork 0
Code Issues 1 Pull requests Projects Releases Packages Wiki Activity Actions

chore(workplan): record CUST-WP-0067-T03 instance identity guard
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This commit is contained in:
codex 2026-08-25 10:37:12 +02:00
parent 71ac0e20ed
commit 5851e11ff2
1 changed files with 27 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

28
workplans/CUST-WP-0067-hub-authority-target-resolution.md
View file

@ -165,7 +165,7 @@ Remote agents and the documented port map must be repointed *before* removal.
```task
id: CUST-WP-0067-T03
status: todo
status: progress
priority: high
state_hub_task_id: "29977448-1a74-5a4d-b729-974c15b6bbde"
```
@ -184,6 +184,32 @@ Acceptance: `--confirm-primary` fails against a non-primary instance and names
what it reached; a hub reports its role; `statehub status` shows role alongside
the API base.
**Built (2026-08-25).** The hub can now declare what it is: `instance_role` and
`instance_label` in settings, surfaced on `/state/health`, defaulting to
`unknown` — an instance that has not declared itself is not the primary.
Production values declare `primary` / `railiance01`; the chart default stays
`unknown` because a chart can be installed anywhere.
`_check_primary` now requires `instance_role=primary`. An instance declaring
nothing is refused with a message naming what to set, and proceeding anyway
requires an explicit `--allow-unverified-primary` rather than a silent default —
the same principle as `--api-base` having no default.
Verified against the live hub, not only in tests: it refuses central today
(which declares nothing yet) and accepts with the explicit flag. Four tests
cover `_check_primary` directly; the existing suite monkeypatched it and never
exercised it, which is why it never caught the original defect. repo-manager
126 passed, state-hub 656 passed.
Worth recording: `registrar-reconcile` returns `noop` before reaching the
authority check when there is nothing to write. That is correct — no write, no
authority needed — but it means a live test on a clean repo proves nothing
about the guard.
**Remaining:** one deploy. Central declares no role until a `helm upgrade`
picks up the ConfigMap, so `--confirm-primary` needs the explicit flag until
then. CI is building `19fab26`.
## Give Repo Manager a real onboarding write path
```task