Close generator adoption and retain briefs as local orientation
This commit is contained in:
codex
parent
392ab7f0d8
commit
60d893af1b
9 changed files with 112 additions and 72 deletions
|
|
@ -1,52 +0,0 @@
|
|||
<!-- custodian-brief: generated by fix-consistency — do not edit manually -->
|
||||
# Custodian Brief — the-custodian
|
||||
|
||||
**Domain:** infotech
|
||||
**Last synced:** 2026-10-19 10:44 UTC
|
||||
**State Hub:** http://127.0.0.1:8000 *(adjust if running on a remote machine)*
|
||||
|
||||
## Active Workstreams
|
||||
|
||||
### Deterministic security flow: standing authorizations, flow report, and agent re-engagement
|
||||
Progress: 3/7 done | workplan_id: `ab288f92-d364-5c24-9362-aee451f266c3`
|
||||
|
||||
**Open tasks:**
|
||||
- ! Schedule the flow report and decision sync `1be0569c`
|
||||
*(wait: Activity Core accepted the schedule in ACTIVITY-WP-0047. Await claiming rein workstation/hub acceptance, owner activation and the first unassisted fire with report/checkpoint evidence.)*
|
||||
- ! Encode the standing change rule as a policy-nexus guardrail `5dd52156`
|
||||
*(wait: policy-nexus owns guardrail publication; handoff written as PNEX-WP-0006.)*
|
||||
- ! Attended window #1 `e3da807f`
|
||||
*(wait: Owner source rechecked 2026-10-19: RPF-WP-0044-T08 is done and KEY-WP-0040-T01 preview is done. Remaining attended acts are USER-WP-0026-T03 positive readback, USER-WP-0028-T03 U08 recovery, and RPF-WP-0044-T04 OpenBao OIDC/MFA login; completed preview does not authorize factor mutation.)*
|
||||
- ► Stop agent-authored index and sync commits `8a3dc219`
|
||||
|
||||
### Separate agent credentials and establish supervised privileged execution
|
||||
Progress: 2/5 done | workplan_id: `a98a9f34-83b4-5c8c-8107-e05f7806d50d`
|
||||
|
||||
**Open tasks:**
|
||||
- ! Build and hand out the agent identity `4b88b0b7`
|
||||
*(wait: Await GLAS-WP-0012 (glas-harness) production acceptance of the local supervised profile; then railiance-platform RBAC, railiance-cluster persistent k3s config, railiance-infra principal/account mapping and ops-warden certificate issuance.)*
|
||||
- ! Fleet guidance and harness guards `90725511`
|
||||
*(wait: Await CUST-WP-0073-T02: the verified agent identity and execution path must exist before it can be documented; Codex/Grok read-denial guard needs glas-harness or harness-owner delivery.)*
|
||||
- ! Rotate what was exposed `1b41b532`
|
||||
*(wait: Deferred by founder decision 2026-09-24; reopened only by the founder on one of the three triggers below, in one attended rotation window.)*
|
||||
|
||||
### Size Railiance workloads from actual demand and establish a weekly allocation review
|
||||
Progress: 1/5 done | workplan_id: `2249bddb-7524-5add-bd5c-c4163a6ca0f3`
|
||||
|
||||
**Open tasks:**
|
||||
- ! Measure the Vergabe prototype under representative pilot use `82192370`
|
||||
*(wait: Await RAPPS-WP-0014-T03 (blocked, needs_human): populated two-user/document workflow run by Bernd and the company contact, giving representative load for p95 <= 2s / zero failures.)*
|
||||
- ! Review ecosystem allocations and reserve operating room `6dc67558`
|
||||
*(wait: Await CUST-WP-0071-T02 representative sample; Forgejo/runner demand and zero-request workload review need owner input (railiance-cluster, railiance-forge, resource-control).)*
|
||||
- ! Apply accepted sizing changes and verify their effects `944f98e2`
|
||||
*(wait: Await reviewed allocation proposals and applicable workload-owner authority.)*
|
||||
- ! Establish the regular weekly workload-demand and allocation assessment `20ddd4d7`
|
||||
*(wait: Await the repeatable observation and accepted sizing/review procedure.)*
|
||||
|
||||
---
|
||||
## MCP Orientation (when available)
|
||||
|
||||
If the state-hub MCP server is reachable, call:
|
||||
`get_domain_summary("infotech")`
|
||||
This provides richer cross-domain context.
|
||||
If the MCP call fails, use this file as your orientation source.
|
||||
3
.gitignore
vendored
3
.gitignore
vendored
|
|
@ -197,3 +197,6 @@ agents_backup_*/
|
|||
|
||||
# Protected native evidence snapshots; custody receipts are tracked separately.
|
||||
.private-backups/
|
||||
|
||||
# Local generated orientation; refreshed by State Hub.
|
||||
/.custodian-brief.md
|
||||
|
|
|
|||
4
SCOPE.md
4
SCOPE.md
|
|
@ -211,14 +211,14 @@ keywords: [security, workplans, dependencies, reports, checkpoints, scheduling]
|
|||
```capability
|
||||
type: tool
|
||||
title: Generated-only commit guard
|
||||
description: scripts/check_generated_only_commit.py checks staged changes or commit ranges; make generated-commit-hook preserves existing hook routing. Local enforcement and tests exist; the 2026-10-12 through 2026-10-19 local history audit found no generated-only commits across the 15-repo security estate. Fleet generator adoption remains a CUST-WP-0079-T05 acceptance obligation.
|
||||
description: scripts/check_generated_only_commit.py checks staged changes or commit ranges; make generated-commit-hook preserves existing hook routing. Local enforcement and tests exist; the 2026-10-12 through 2026-10-19 local history audit found no generated-only commits across the 15-repo security estate. CUST-WP-0079-T05 records completed owner-generator adoption and local-history acceptance; runtime schedule and publication gates remain separate.
|
||||
keywords: [git, generated, hooks, work-records, validation]
|
||||
```
|
||||
|
||||
```capability
|
||||
type: tool
|
||||
title: Staged work-record index generation
|
||||
description: make generated-work-records reuses the State Hub renderer on staged Markdown, with explicit repository identity, and stages only WORK-RECORDS.md while refusing unstaged generated-file edits. make generated-work-records-check is read-only. Source adapter and tests are implemented; the shared/local hook supports explicit per-repo adoption, with provider adoption and exact commit receipts tracked in CUST-WP-0079. Other artifact families still need owner automation. See docs/staged-work-record-generation.md.
|
||||
description: make generated-work-records reuses the State Hub renderer on staged Markdown, with explicit repository identity, and stages only WORK-RECORDS.md while refusing unstaged generated-file edits. make generated-work-records-check is read-only. Source adapter and tests are implemented; the shared/local hook supports explicit per-repo adoption, with provider adoption and exact commit receipts tracked in CUST-WP-0079. Owner-specific artifact automation and local-only briefs are recorded in CUST-WP-0079. See docs/staged-work-record-generation.md.
|
||||
keywords: [git, generated, work-records, staged-sources, validation]
|
||||
```
|
||||
|
||||
|
|
|
|||
|
|
@ -79,7 +79,7 @@
|
|||
| workplan | CUST-WP-0076 | finished | — | workplans/CUST-WP-0076-provisioning-window-cadence.md |
|
||||
| workplan | CUST-WP-0077 | finished | — | workplans/CUST-WP-0077-dependency-root-execution-wave.md |
|
||||
| workplan | CUST-WP-0078 | finished | — | workplans/CUST-WP-0078-security-collaboration-consolidation.md |
|
||||
| workplan | CUST-WP-0079 | active | — | workplans/CUST-WP-0079-deterministic-security-flow.md |
|
||||
| workplan | CUST-WP-0079 | blocked | — | workplans/CUST-WP-0079-deterministic-security-flow.md |
|
||||
| workplan | CUST-WP-0080 | finished | — | workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md |
|
||||
| workplan | CUST-WP-0081 | finished | — | workplans/CUST-WP-0081-netkingdom-architecture-review-and-reuse.md |
|
||||
| workplan | CUST-WP-0082 | backlog | — | workplans/CUST-WP-0082-netkingdom-security-hardening.md |
|
||||
|
|
@ -503,7 +503,7 @@
|
|||
| task | CUST-WP-0079-T02 | done | — | workplans/CUST-WP-0079-deterministic-security-flow.md |
|
||||
| task | CUST-WP-0079-T03 | wait | — | workplans/CUST-WP-0079-deterministic-security-flow.md |
|
||||
| task | CUST-WP-0079-T04 | wait | — | workplans/CUST-WP-0079-deterministic-security-flow.md |
|
||||
| task | CUST-WP-0079-T05 | progress | — | workplans/CUST-WP-0079-deterministic-security-flow.md |
|
||||
| task | CUST-WP-0079-T05 | done | — | workplans/CUST-WP-0079-deterministic-security-flow.md |
|
||||
| task | CUST-WP-0079-T06 | wait | — | workplans/CUST-WP-0079-deterministic-security-flow.md |
|
||||
| task | CUST-WP-0079-T07 | done | — | workplans/CUST-WP-0079-deterministic-security-flow.md |
|
||||
| task | CUST-WP-0080-T01 | done | — | workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md |
|
||||
|
|
|
|||
|
|
@ -35,8 +35,8 @@ format, including its existing regeneration attribution.
|
|||
|
||||
The shared repo-manager hook and Custodian local hook now run the existing
|
||||
generated-only guard first, then the opt-in generator, then their existing secret
|
||||
scan. Activity Core, Policy Nexus and Repo Manager have committed opt-ins;
|
||||
Custodian source includes its opt-in. The guard still rejects generated-only
|
||||
scan. Twenty-five provider checkouts and Custodian have committed opt-ins; exact
|
||||
provider revisions and verification are recorded in CUST-WP-0079. The guard still rejects generated-only
|
||||
commits. Other repositories without a staged opt-in keep their prior behavior.
|
||||
|
||||
The tracked `.generated-work-records.json` supplies version 1 and canonical
|
||||
|
|
@ -62,7 +62,7 @@ python3 scripts/install_shared_generated_guard.py --repo . --install --enable-ge
|
|||
Unknown hook compositions are refused; existing other hooks and routing remain
|
||||
unchanged. The option does not opt any repository into generation on its own. Source inventories and publication indexes
|
||||
retain their respective owner generators; this adapter generates only the
|
||||
work-record index. Provider adoption receipts are recorded in CUST-WP-0079-T05; other artifact families remain open.
|
||||
work-record index. Provider adoption and the completed artifact-family audit are recorded in CUST-WP-0079-T05.
|
||||
|
||||
|
||||
The State Hub owner also exposes `scripts/generate_custodian_brief.py` and
|
||||
|
|
@ -70,4 +70,8 @@ The State Hub owner also exposes `scripts/generate_custodian_brief.py` and
|
|||
This separate command reads the current hub projection, performs no Git operations,
|
||||
and preserves the existing brief on unavailable or malformed endpoint reads. It
|
||||
is not part of the staged Markdown hook: it cannot represent unprojected source.
|
||||
Keep historical timestamps when a fresh render fails; do not claim a fresh snapshot.
|
||||
On operator direction, briefs are now ignored local orientation rather than
|
||||
tracked snapshots. State Hub consistency refreshes generate them without Git
|
||||
operations. Migration preserves each local file and adds `/.custodian-brief.md`
|
||||
to `.gitignore`; `git rm --cached` removes only its tracked snapshot. Keep the
|
||||
prior local file when a fresh render fails; do not claim a fresh snapshot.
|
||||
|
|
|
|||
|
|
@ -89,13 +89,17 @@ request per run, keep it stable for retries, bind a real previous report, and
|
|||
retain reports beyond the seven-day raw-metric retention. The committed null
|
||||
template is not a production storage location or collection implementation.
|
||||
|
||||
Activity-core must select a scoped durable Railiance executor/profile before
|
||||
projection or activation; no workstation profile is asserted here. It owns the
|
||||
Monday 08:00 Europe/Berlin schedule and operations-run retry/lease evidence.
|
||||
Activity Core source `4ae00fc` selects its existing ADR-007 bounded-operation
|
||||
executor with fixed owner commands; both definitions remain disabled. The prior
|
||||
coding profile cannot run Python or reach the Hub. Runtime owners must still
|
||||
bind accepted source/fleet mounts, separate private retained state and scoped
|
||||
network access. Activity Core owns the Monday 08:00 Europe/Berlin schedule and
|
||||
bounded-activity/context/progress-sink evidence, with one Temporal attempt.
|
||||
The full binding contract is `activity-core/docs/custodian-bounded-operations.md`.
|
||||
The adapter's matching recommendation IDs are the downstream upsert keys for
|
||||
existing owner work records; it does not itself create those records. Delivery,
|
||||
explicit owner acknowledgment, independent missed/failed-run detection and
|
||||
recovery remain unbound. A report file or successful ops_run alone proves none
|
||||
recovery remain unbound. A report file or completed bounded activity alone proves none
|
||||
of them. T05 needs the first unattended schedule receipt and exercised recovery.
|
||||
|
||||
## Verification
|
||||
|
|
|
|||
|
|
@ -6,12 +6,13 @@
|
|||
"obligor_repo": "activity-core",
|
||||
"obligor_workplan_id": "ACTIVITY-WP-0047",
|
||||
"state": "waiting",
|
||||
"reason": "Schedule owner accepted; awaiting claiming rein workstation/hub acceptance, owner activation and the first unassisted fire. Definition remains disabled; no founder act requested.",
|
||||
"reason": "Existing bounded-operation executor selected after finding prior coding profile forbids Python/Hub access. Await accepted source/fleet/private-state/network bindings, activation and first unassisted activity/report/sink/owner receipts. Definition remains disabled.",
|
||||
"proposal_message_id": "117e538e-da06-48b8-ba68-b82300a832e7",
|
||||
"progress_receipt_id": "8edea261-4841-4db7-bc0e-1db8021106a6",
|
||||
"owner_reply_message_id": "00704319-97b2-469c-977e-6168ef20b9f9",
|
||||
"owner_workplan_uuid": "ee97869b-dca2-54c9-aa18-0b479c244fb3",
|
||||
"owner_source_commit": "83e6446807c4b36f3aa5023a5c16d4c7df8bd3df",
|
||||
"observed_at": "2026-10-13",
|
||||
"schedule_enabled": false
|
||||
"owner_source_commit": "4ae00fcd230e74b47c2810d816c3a3f095aa8830",
|
||||
"observed_at": "2026-10-19",
|
||||
"schedule_enabled": false,
|
||||
"executor_contract": "activity-core/docs/custodian-bounded-operations.md"
|
||||
}
|
||||
|
|
|
|||
|
|
@ -392,3 +392,15 @@ retention, stable task links, and misleading consecutive capture timestamps
|
|||
whose actual metric windows are only five days apart. The null executor request
|
||||
fails closed as intended. T02–T05 remain waiting for their existing acceptance
|
||||
returns; this source implementation does not close them.
|
||||
|
||||
|
||||
2026-10-19 scheduler source refinement: Activity Core's existing ACT-ADR-007
|
||||
bounded-operation path now has fixed-command integration for the offline weekly
|
||||
report. The previous coding profile could not execute the daily Python command
|
||||
or reach the Hub. Both schedule definitions remain disabled. Explicit owner
|
||||
source/fleet mounts, private retained state and executor-owned input request are
|
||||
required; source tests use fixtures, not representative workload measurements.
|
||||
This does not close T05: collection, recommendation handling, delivery, owner
|
||||
acknowledgment and missed/failed-run recovery still need runtime acceptance,
|
||||
after the existing representative pilot and sizing gates. No new scheduler,
|
||||
model call or credential-isolation claim is introduced.
|
||||
|
|
|
|||
|
|
@ -4,7 +4,7 @@ type: workplan
|
|||
title: "Deterministic security flow: standing authorizations, flow report, and agent re-engagement"
|
||||
domain: infotech
|
||||
repo: the-custodian
|
||||
status: active
|
||||
status: blocked
|
||||
owner: claude-code
|
||||
topic_slug: custodian
|
||||
created: "2026-10-11"
|
||||
|
|
@ -63,7 +63,7 @@ status: wait
|
|||
priority: high
|
||||
state_hub_task_id: "1be0569c-221d-5925-a0ff-fd2af88e52b1"
|
||||
depends_on: [ACTIVITY-WP-0047]
|
||||
blocking_reason: "Activity Core accepted the schedule in ACTIVITY-WP-0047. Await claiming rein workstation/hub acceptance, owner activation and the first unassisted fire with report/checkpoint evidence."
|
||||
blocking_reason: "ACTIVITY-WP-0047 now selects existing bounded operations: the prior coding profile cannot run Python or access the Hub. Await runtime-owner source/mount/state/network bindings, activation and first unassisted activity/report/sink/owner receipt."
|
||||
```
|
||||
|
||||
Run `sync_resolved_decisions.py --apply` and `security_flow_report.py --json` daily (activity-core
|
||||
|
|
@ -113,8 +113,7 @@ Canon source written 2026-10-11: `canon/standards/build-mode-change-authorizatio
|
|||
|
||||
```task
|
||||
id: CUST-WP-0079-T05
|
||||
status: progress
|
||||
blocking_reason: "Staged WORK-RECORDS generation is adopted across the default security estate and relevant providers. Other artifact families and recurring brief/source-inventory/coordination-frame automation remain open; the 498-commit local seven-day history check passed."
|
||||
status: done
|
||||
priority: medium
|
||||
state_hub_task_id: "8a3dc219-8982-5903-9407-e1b549d4544c"
|
||||
```
|
||||
|
|
@ -393,3 +392,72 @@ review; they were not included in the 25 clean provider claim. Custodian's
|
|||
inherited NetKingdom assessment receipts also remain outside these owner cleanup
|
||||
commits. Neither source adoption nor clean provider worktrees authorizes deleting
|
||||
unrelated observations.
|
||||
|
||||
|
||||
### Local brief policy and preserved metric snapshots — 2026-10-19
|
||||
|
||||
The operator selected local generated briefs and removal of tracked snapshots.
|
||||
State Hub's renderer now omits Git operations for brief refreshes, including the
|
||||
ordinary consistency path. The migration preserves the existing local bytes,
|
||||
adds root-anchored ignores and removes only the tracked snapshot. No offline
|
||||
orientation file is deleted. The explicit strict brief CLI remains available;
|
||||
failed fresh reads preserve prior local orientation. This supersedes the earlier
|
||||
plan to couple hub-derived brief snapshots to source commits.
|
||||
|
||||
The five State Hub legacy-meter snapshots reviewed in the preceding session are
|
||||
now preserved outside its checkout at
|
||||
`/home/worsch/.local/state/custodian-preserved/state-hub/legacy-meter-20261019/`.
|
||||
`manifest.json` records every original path, SHA256 and tracked-baseline hash.
|
||||
The tracked Oct14 baseline was restored and the four untracked copies removed
|
||||
only after exact archive verification. These are historical observations, not
|
||||
scheduled-execution or retirement acceptance. State Hub was clean after this
|
||||
archive and before the local-brief source migration. This updates the earlier
|
||||
intentionally-dirty observation without discarding evidence or committing a
|
||||
generated-only packet. Custodian's inherited NetKingdom receipts remain intact.
|
||||
|
||||
|
||||
### T05 acceptance audit — 2026-10-19
|
||||
|
||||
T05 is done. The earlier full seven-day local history audit covered 498 commits
|
||||
across the 15-repository default estate with no standalone generated-only
|
||||
commits. Staged WORK-RECORDS generation is adopted in all those repositories
|
||||
and the additional providers. The concrete remaining recurring artifacts were
|
||||
rechecked against tracked source paths, rather than inferred from filenames:
|
||||
|
||||
- NetKingdom `generated/coordination-frame/approval-engine-receiver.json` now
|
||||
derives from indexed owner sources through the local commit recipe (`bde143e`).
|
||||
Eleven tests cover the existing compiler plus partial staging, sibling
|
||||
preservation, target edits, symlinks and alternate-index refusal. The hook
|
||||
never rewrites sibling repos. Its subsequent local-brief migration is `1bd869c`.
|
||||
- Policy Nexus's generated release inventories and manifests already run in the
|
||||
scheduled Forgejo build. Its tracked `source-inventory.json` and config carry
|
||||
authored dispositions and must not be auto-refreshed as disposable output.
|
||||
`5a6e78f` adds a non-destructive staged review utility (65 tests), not a second
|
||||
versioned inventory. Publication remains a separate T04 gate: two newly
|
||||
discovered documents still need explicit dispositions and the founder's
|
||||
public-release batch. This audit does not claim a fresh scheduled release.
|
||||
- Brief snapshots are deliberately no longer Git artifacts, per operator choice.
|
||||
State Hub `39b51a2` removes the renderer's commit path; all 185 focused and
|
||||
consistency regression tests pass. Its owner sync returned applied at that
|
||||
exact revision. Local brief preservation was checked with hashes during the
|
||||
provider migration; the files remain available and ignored.
|
||||
|
||||
The default-estate path audit found no additional recurring source inventory,
|
||||
publication index or projection refresh output lacking its owner generation
|
||||
path. Dated historical receipts are retained observations, not refresh jobs.
|
||||
This closes generation and local-history acceptance only. T03, T04 and T06
|
||||
remain waiting on their named runtime/publication/attended gates, so this
|
||||
workplan is blocked rather than finished. No residual work is concealed by T05.
|
||||
|
||||
|
||||
Daily/weekly executor source is committed in Activity Core `4ae00fc`, with 57
|
||||
focused bounded-operation/evidence/definition tests passing. It reuses the
|
||||
existing ADR-007 fixed-command stage, suppresses raw command output, validates
|
||||
trusted bindings before subprocess execution and returns compact hash/count
|
||||
receipts. The selected commands emit no agent ops_run or model call. Both
|
||||
schedules remain disabled. ACTIVITY-WP-0047 records the replacement receipt
|
||||
contract and runtime acceptance gates; the corresponding Custodian handoff and
|
||||
weekly-report documentation now consume that contract. NetKingdom's required
|
||||
consistency pass synced 64/64 bindings with zero automation/assessment failures
|
||||
(27 existing warnings, 5 informational findings); its brief refreshed locally
|
||||
without any brief commit.
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue