diff --git a/docs/evidence/2026-10-10-security-consolidation/approval-confirmation-transport-counterexample.json b/docs/evidence/2026-10-10-security-consolidation/approval-confirmation-transport-counterexample.json new file mode 100644 index 00000000..2348c625 --- /dev/null +++ b/docs/evidence/2026-10-10-security-consolidation/approval-confirmation-transport-counterexample.json @@ -0,0 +1,11 @@ +{ + "schema": "custodian-local-counterexample/v1", + "scope": "ApprovalHTTPClient inherited transport used by ExecutionConfirmationClient", + "synthetic_only": true, + "native_access": false, + "source_changed": false, + "different_origin_redirect_followed": true, + "authorization_header_forwarded": true, + "redirected_json_accepted": true, + "next_action": "Approval owner transport correction before mediator adoption; source acknowledgment is not native route acceptance" +} diff --git a/docs/evidence/2026-10-10-security-consolidation/execution-source-integration-checkpoint.json b/docs/evidence/2026-10-10-security-consolidation/execution-source-integration-checkpoint.json new file mode 100644 index 00000000..bb348161 --- /dev/null +++ b/docs/evidence/2026-10-10-security-consolidation/execution-source-integration-checkpoint.json @@ -0,0 +1,61 @@ +{ + "schema": "custodian-source-integration-checkpoint/v1", + "source_commits": { + "secrets-engine": "d8edd9e", + "access-engine": "7687ac2", + "approval-engine": "b428ffe", + "railiance-platform": "4e8fa6e", + "net-kingdom": "bf6a44d", + "key-cape": "f60e741" + }, + "native_actions": false, + "authority_granted": false, + "source_tests": { + "secrets_actual_focused": 99, + "approval_actual_transport": 51, + "approval_actual_legacy_confirmation": 36, + "platform_actual_journal": 15, + "net_actual_discovered": 71 + }, + "open_inventory": { + "owner_repos": 13, + "open_plans": 47, + "nonresidual_plans": 45, + "residual_plans": 2, + "unfinished_tasks": 103 + }, + "remaining": [ + "owner compiled plan and verified initiating representation", + "distinct PDP execute-ccr package and consume confirmation integration", + "owner mediator, cleanup and native scoped grant", + "paired private producer/source launcher review and actual custody/transport admission", + "current route/plugin/leeway/readiness evidence and exact founder disposition" + ], + "files": [ + { + "repo": "secrets-engine", + "path": "src/secrets_engine/execution_contract.py", + "sha256": "75323911c229cb8b49d5116706a329c3f9ec2efdbeab6bfac8dbf5b92729f14a" + }, + { + "repo": "approval-engine", + "path": "approval_engine/pep.py", + "sha256": "4f82931accc27cf6eb03e5266f644d117bb1bd954c4683145a630878b3c33e24" + }, + { + "repo": "approval-engine", + "path": "approval_engine/http_transport.py", + "sha256": "ffd948f71fe12873bfc321ad3ea363065146c0cb1607b1d93e74e03875b9bfdb" + }, + { + "repo": "railiance-platform", + "path": "scripts/task_execution_journal.py", + "sha256": "dc9bbb4a153ce8c466f39fde1fd0104f2dd37af9ff765399dfb9415ca607e767" + }, + { + "repo": "net-kingdom", + "path": "sso-mfa/k8s/keycape/openbao-negative-session.py", + "sha256": "da4e0ab767e0c3bebb48bcf5ab578b50845d9fa7211a6771661a0e1baa4314ab" + } + ] +} diff --git a/docs/evidence/2026-10-10-security-consolidation/jwt-source-preparation-consistency/access-context-source-consistency.json b/docs/evidence/2026-10-10-security-consolidation/jwt-source-preparation-consistency/access-context-source-consistency.json new file mode 100644 index 00000000..109331f0 --- /dev/null +++ b/docs/evidence/2026-10-10-security-consolidation/jwt-source-preparation-consistency/access-context-source-consistency.json @@ -0,0 +1,50 @@ +{ + "repo_slug": "access-engine", + "repo_path": "/home/worsch/access-engine", + "issues": [ + { + "severity": "WARN", + "check_id": "C-11", + "message": "Task 'FLEX-WP-ADHOC-2026-10-11-T02' has no state_hub_task_id", + "file_path": "workplans/ADHOC-2026-10-11.md#FLEX-WP-ADHOC-2026-10-11-T02", + "db_id": "", + "file_value": "", + "db_value": "", + "fixable": true + }, + { + "severity": "WARN", + "check_id": "C-28", + "message": "2 unread inbox message(s) older than 3 day(s): the-custodian:23172cb2, the-custodian:51e9eace", + "file_path": "", + "db_id": "", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-28", + "message": "2 unread message(s) lack thread_id for supersession tracking: the-custodian:23172cb2, the-custodian:51e9eace", + "file_path": "", + "db_id": "", + "file_value": "", + "db_value": "", + "fixable": false + } + ], + "fixes_applied": [ + "bindings: synced 38/38", + "C-17 cleared: pushed 1 backlogged commit(s)", + "C-11 skipped: task 'FLEX-WP-ADHOC-2026-10-11-T02' in finished workstream \u2014 not created", + "brief: .custodian-brief.md updated", + "push: pushed" + ], + "summary": { + "fail": 0, + "automation_error": 0, + "warn": 3, + "info": 0 + }, + "result": "warn" +} diff --git a/docs/evidence/2026-10-10-security-consolidation/jwt-source-preparation-consistency/approval-transport-source-consistency.json b/docs/evidence/2026-10-10-security-consolidation/jwt-source-preparation-consistency/approval-transport-source-consistency.json new file mode 100644 index 00000000..86ad09f0 --- /dev/null +++ b/docs/evidence/2026-10-10-security-consolidation/jwt-source-preparation-consistency/approval-transport-source-consistency.json @@ -0,0 +1,80 @@ +{ + "repo_slug": "approval-engine", + "repo_path": "/home/worsch/approval-engine", + "issues": [ + { + "severity": "WARN", + "check_id": "C-33", + "message": "WORK-RECORDS.md is missing or stale \u2014 regenerate via fix-consistency (CUST-WP-0061-T04 generated work-record index)", + "file_path": "WORK-RECORDS.md", + "db_id": "", + "file_value": "", + "db_value": "", + "fixable": true + }, + { + "severity": "WARN", + "check_id": "C-11", + "message": "Task 'APPROVAL-WP-ADHOC-2026-10-11-T02' has no state_hub_task_id", + "file_path": "workplans/ADHOC-2026-10-11.md#APPROVAL-WP-ADHOC-2026-10-11-T02", + "db_id": "", + "file_value": "", + "db_value": "", + "fixable": true + }, + { + "severity": "WARN", + "check_id": "C-28", + "message": "10 unread inbox message(s) older than 3 day(s): informed-decision:59c5ee82, the-custodian:23172cb2, access-engine:9b8795d2, the-custodian:51e9eace, glas-harness:54ae49cc, ...", + "file_path": "", + "db_id": "", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-28", + "message": "9 unread message(s) lack thread_id for supersession tracking: key-cape:ffe5aff4, informed-decision:59c5ee82, the-custodian:23172cb2, access-engine:9b8795d2, the-custodian:51e9eace", + "file_path": "", + "db_id": "", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-29", + "message": "Unread work request from informed-decision (59c5ee82) may need a workplan file: INFD-WP-0005: service-requested approvals from informed-decision intake (two small asks)", + "file_path": "", + "db_id": "", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-29", + "message": "Unread work request from flex-auth (2523510b) may need a workplan file: FLEX-WP-0020 handoff request (consumer)", + "file_path": "", + "db_id": "", + "file_value": "", + "db_value": "", + "fixable": false + } + ], + "fixes_applied": [ + "bindings: synced 5/5", + "C-17 cleared: pushed 2 backlogged commit(s)", + "C-33 fixed: regenerated WORK-RECORDS.md", + "C-11 skipped: task 'APPROVAL-WP-ADHOC-2026-10-11-T02' in finished workstream \u2014 not created", + "push: pushed" + ], + "summary": { + "fail": 0, + "automation_error": 0, + "warn": 6, + "info": 0 + }, + "result": "warn" +} diff --git a/docs/evidence/2026-10-10-security-consolidation/jwt-source-preparation-consistency/keycape-v8-source-consistency.json b/docs/evidence/2026-10-10-security-consolidation/jwt-source-preparation-consistency/keycape-v8-source-consistency.json new file mode 100644 index 00000000..6b44c757 --- /dev/null +++ b/docs/evidence/2026-10-10-security-consolidation/jwt-source-preparation-consistency/keycape-v8-source-consistency.json @@ -0,0 +1,69 @@ +{ + "repo_slug": "key-cape", + "repo_path": "/home/worsch/key-cape", + "issues": [ + { + "severity": "WARN", + "check_id": "C-24", + "message": "Repo classification advisory: capability_tag 'security' is not a recommended family tag (allowed, check for synonym)", + "file_path": "", + "db_id": "", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-11", + "message": "Task 'ADHOC-2026-09-27-T02' has no state_hub_task_id", + "file_path": "workplans/ADHOC-2026-09-27.md#ADHOC-2026-09-27-T02", + "db_id": "", + "file_value": "", + "db_value": "", + "fixable": true + }, + { + "severity": "INFO", + "check_id": "C-08", + "message": "Closed DB workstream 'keycape-implementation@retired-20260826' (id=2c9caad8\u2026, status=archived) has no backing workplan file", + "file_path": "", + "db_id": "2c9caad8-2ced-492d-9d63-376387b4b9b0", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-28", + "message": "2 unread inbox message(s) older than 3 day(s): the-custodian:23172cb2, the-custodian:51e9eace", + "file_path": "", + "db_id": "", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-28", + "message": "2 unread message(s) lack thread_id for supersession tracking: the-custodian:23172cb2, the-custodian:51e9eace", + "file_path": "", + "db_id": "", + "file_value": "", + "db_value": "", + "fixable": false + } + ], + "fixes_applied": [ + "bindings: synced 42/42", + "C-17 cleared: pushed 1 backlogged commit(s)", + "C-11 skipped: task 'ADHOC-2026-09-27-T02' in finished workstream \u2014 not created", + "push: pushed" + ], + "summary": { + "fail": 0, + "automation_error": 0, + "warn": 4, + "info": 1 + }, + "result": "warn" +} diff --git a/docs/evidence/2026-10-10-security-consolidation/jwt-source-preparation-consistency/net-key39-v8-source-consistency.json b/docs/evidence/2026-10-10-security-consolidation/jwt-source-preparation-consistency/net-key39-v8-source-consistency.json new file mode 100644 index 00000000..94700c57 --- /dev/null +++ b/docs/evidence/2026-10-10-security-consolidation/jwt-source-preparation-consistency/net-key39-v8-source-consistency.json @@ -0,0 +1,203 @@ +{ + "repo_slug": "net-kingdom", + "repo_path": "/home/worsch/net-kingdom", + "issues": [ + { + "severity": "WARN", + "check_id": "C-24", + "message": "Repo classification advisory: capability_tag 'security' is not a recommended family tag (allowed, check for synonym)", + "file_path": "", + "db_id": "", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-35", + "message": "Repo Manager warning: workplans/: repository uses more than one workplan prefix: ['NET-WP', 'NK-WP']", + "file_path": "workplans/", + "db_id": "", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-11", + "message": "Task 'NK-WP-ADHOC-2026-10-11-T03' has no state_hub_task_id", + "file_path": "workplans/ADHOC-2026-10-11.md#NK-WP-ADHOC-2026-10-11-T03", + "db_id": "", + "file_value": "", + "db_value": "", + "fixable": true + }, + { + "severity": "WARN", + "check_id": "C-11", + "message": "Task 'NK-WP-ADHOC-2026-10-11-T04' has no state_hub_task_id", + "file_path": "workplans/ADHOC-2026-10-11.md#NK-WP-ADHOC-2026-10-11-T04", + "db_id": "", + "file_value": "", + "db_value": "", + "fixable": true + }, + { + "severity": "WARN", + "check_id": "C-11", + "message": "Task 'NK-WP-ADHOC-2026-10-11-T05' has no state_hub_task_id", + "file_path": "workplans/ADHOC-2026-10-11.md#NK-WP-ADHOC-2026-10-11-T05", + "db_id": "", + "file_value": "", + "db_value": "", + "fixable": true + }, + { + "severity": "WARN", + "check_id": "C-11", + "message": "Task 'NK-WP-ADHOC-2026-10-11-T06' has no state_hub_task_id", + "file_path": "workplans/ADHOC-2026-10-11.md#NK-WP-ADHOC-2026-10-11-T06", + "db_id": "", + "file_value": "", + "db_value": "", + "fixable": true + }, + { + "severity": "WARN", + "check_id": "C-11", + "message": "Task 'NK-WP-ADHOC-2026-10-11-T07' has no state_hub_task_id", + "file_path": "workplans/ADHOC-2026-10-11.md#NK-WP-ADHOC-2026-10-11-T07", + "db_id": "", + "file_value": "", + "db_value": "", + "fixable": true + }, + { + "severity": "INFO", + "check_id": "C-08", + "message": "Closed DB workstream 'nk-wp-0035@retired-20260908' (id=064c5e8b\u2026, status=archived) has no backing workplan file", + "file_path": "", + "db_id": "064c5e8b-7852-4d7f-a5fa-e26e406ab8e0", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "INFO", + "check_id": "C-08", + "message": "Closed DB workstream 'adhoc-2026-08-14@retired-20260827' (id=a5097121\u2026, status=finished) has no backing workplan file", + "file_path": "", + "db_id": "a5097121-1461-59f8-81fa-e6ecef527337", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "INFO", + "check_id": "C-08", + "message": "Closed DB workstream 'adhoc-2026-08-23@retired-20260827' (id=e25ba5fa\u2026, status=finished) has no backing workplan file", + "file_path": "", + "db_id": "e25ba5fa-eaae-5039-8d93-a69c6d837fc4", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "INFO", + "check_id": "C-08", + "message": "Closed DB workstream 'net-kingdom-adhoc-2026-06-14@retired-20260827' (id=c6f3d6bf\u2026, status=finished) has no backing workplan file", + "file_path": "", + "db_id": "c6f3d6bf-4916-490d-96ce-092d2776d7e7", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "INFO", + "check_id": "C-08", + "message": "Closed DB workstream 'net-kingdom-adhoc-2026-07-02@retired-20260827' (id=67c1c7ac\u2026, status=finished) has no backing workplan file", + "file_path": "", + "db_id": "67c1c7ac-d8b1-41dc-a81a-4e43f1afd068", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-26", + "message": "Workplan id 'NET-WP-0020' uses prefix 'NET-WP' but repo canonical prefix is 'NK-WP' \u2014 new plans must conform", + "file_path": "workplans/NET-WP-0020-openbao-unseal-custody-and-ssh-automation.md", + "db_id": "", + "file_value": "NET-WP-0020", + "db_value": "NK-WP", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-26", + "message": "Workplan id 'NET-WP-0015' uses prefix 'NET-WP' but repo canonical prefix is 'NK-WP' \u2014 new plans must conform", + "file_path": "workplans/archived/260603-NET-WP-0015-platform-root-custody-and-openbao-identity-bootstrap.md", + "db_id": "", + "file_value": "NET-WP-0015", + "db_value": "NK-WP", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-26", + "message": "Workplan id 'NET-WP-0016' uses prefix 'NET-WP' but repo canonical prefix is 'NK-WP' \u2014 new plans must conform", + "file_path": "workplans/archived/260603-NET-WP-0016-guided-security-bootstrap-experience.md", + "db_id": "", + "file_value": "NET-WP-0016", + "db_value": "NK-WP", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-26", + "message": "Workplan id 'NET-WP-0018' uses prefix 'NET-WP' but repo canonical prefix is 'NK-WP' \u2014 new plans must conform", + "file_path": "workplans/archived/260604-NET-WP-0018-bootstrap-automation-and-rebuild-readiness.md", + "db_id": "", + "file_value": "NET-WP-0018", + "db_value": "NK-WP", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-26", + "message": "Workplan id 'NET-WP-0017' uses prefix 'NET-WP' but repo canonical prefix is 'NK-WP' \u2014 new plans must conform", + "file_path": "workplans/archived/260702-NET-WP-0017-it-security-readiness-for-user-onboarding.md", + "db_id": "", + "file_value": "NET-WP-0017", + "db_value": "NK-WP", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-26", + "message": "Workplan id 'NET-WP-0019' uses prefix 'NET-WP' but repo canonical prefix is 'NK-WP' \u2014 new plans must conform", + "file_path": "workplans/archived/260702-NET-WP-0019-t06-adjacent-user-lifecycle-dry-run-polish.md", + "db_id": "", + "file_value": "NET-WP-0019", + "db_value": "NK-WP", + "fixable": false + } + ], + "fixes_applied": [ + "bindings: synced 60/60", + "C-17 cleared: pushed 1 backlogged commit(s)", + "C-11 skipped: task 'NK-WP-ADHOC-2026-10-11-T03' in finished workstream \u2014 not created", + "C-11 skipped: task 'NK-WP-ADHOC-2026-10-11-T04' in finished workstream \u2014 not created", + "C-11 skipped: task 'NK-WP-ADHOC-2026-10-11-T05' in finished workstream \u2014 not created", + "C-11 skipped: task 'NK-WP-ADHOC-2026-10-11-T06' in finished workstream \u2014 not created", + "C-11 skipped: task 'NK-WP-ADHOC-2026-10-11-T07' in finished workstream \u2014 not created", + "push: pushed" + ], + "summary": { + "fail": 0, + "automation_error": 0, + "warn": 13, + "info": 5 + }, + "result": "warn" +} diff --git a/docs/evidence/2026-10-10-security-consolidation/jwt-source-preparation-consistency/platform-journal-source-consistency.json b/docs/evidence/2026-10-10-security-consolidation/jwt-source-preparation-consistency/platform-journal-source-consistency.json new file mode 100644 index 00000000..38c92dcb --- /dev/null +++ b/docs/evidence/2026-10-10-security-consolidation/jwt-source-preparation-consistency/platform-journal-source-consistency.json @@ -0,0 +1,409 @@ +{ + "repo_slug": "railiance-platform", + "repo_path": "/home/worsch/railiance-platform", + "issues": [ + { + "severity": "WARN", + "check_id": "C-35", + "message": "Repo Manager missing: README.md: README.md is required for flavor tooling", + "file_path": "README.md", + "db_id": "", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-22", + "message": "Task description drift 'RPF-WP-0035-T13': file content differs from DB (file wins)", + "file_path": "workplans/RPF-WP-0035-credential-lane-implementation.md#RPF-WP-0035-T13", + "db_id": "8f6966fa-6e9a-58b2-8b40-c47340ec19d1", + "file_value": "2026-10-11: Platform agent loaded its owner instructions/INTENT and RPF35-T02,\nactual applied CCR38, exact native role/p", + "db_value": "2026-10-11: Platform agent loaded its owner instructions/INTENT and RPF35-T02,\nactual applied CCR38, exact native role/p", + "fixable": true + }, + { + "severity": "WARN", + "check_id": "C-23", + "message": "Lifecycle drift in 'rpf-wp-0053': workplan status 'proposed' has an active task \u2014 report only (ADR-007: do not auto-promote proposed)", + "file_path": "workplans/RPF-WP-0053-coulomb-paired-backup-admission.md", + "db_id": "cb55e474-c7a5-5c6f-bd72-ce65f853e3e3", + "file_value": "proposed", + "db_value": "proposed", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-20", + "message": "Workplan dependency target 'RAILIANCE-WP-0004' is not linked to State Hub", + "file_path": "workplans/archived/260702-RPF-WP-0023-workload-kv-access-lanes.md", + "db_id": "", + "file_value": "RAILIANCE-WP-0004", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-20", + "message": "Workplan dependency target 'RAILIANCE-WP-0005' is not linked to State Hub", + "file_path": "workplans/archived/260702-RPF-WP-0024-credential-change-approval-workflow.md", + "db_id": "", + "file_value": "RAILIANCE-WP-0005", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-20", + "message": "Workplan dependency target 'RAILIANCE-WP-0006' is not linked to State Hub", + "file_path": "workplans/archived/260702-RPF-WP-0024-credential-change-approval-workflow.md", + "db_id": "", + "file_value": "RAILIANCE-WP-0006", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-20", + "message": "Workplan dependency target 'RAILIANCE-WP-0005' is not linked to State Hub", + "file_path": "workplans/archived/260905-RPF-WP-0002-openbao-approved-automation-delegation.md", + "db_id": "", + "file_value": "RAILIANCE-WP-0005", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-20", + "message": "Workplan dependency target 'RAILIANCE-WP-0006' is not linked to State Hub", + "file_path": "workplans/archived/260905-RPF-WP-0002-openbao-approved-automation-delegation.md", + "db_id": "", + "file_value": "RAILIANCE-WP-0006", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-20", + "message": "Workplan dependency target 'RAILIANCE-WP-0007' is not linked to State Hub", + "file_path": "workplans/archived/260905-RPF-WP-0002-openbao-approved-automation-delegation.md", + "db_id": "", + "file_value": "RAILIANCE-WP-0007", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-20", + "message": "Workplan dependency target 'RAILIANCE-WP-0004' is not linked to State Hub", + "file_path": "workplans/archived/260905-RPF-WP-0003-issue-core-runtime-ingestion-key-lane.md", + "db_id": "", + "file_value": "RAILIANCE-WP-0004", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-20", + "message": "Workplan dependency target 'RAILIANCE-WP-0007' is not linked to State Hub", + "file_path": "workplans/archived/260905-RPF-WP-0003-issue-core-runtime-ingestion-key-lane.md", + "db_id": "", + "file_value": "RAILIANCE-WP-0007", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-20", + "message": "Workplan dependency target 'RAILIANCE-WP-0008' is not linked to State Hub", + "file_path": "workplans/archived/260905-RPF-WP-0003-issue-core-runtime-ingestion-key-lane.md", + "db_id": "", + "file_value": "RAILIANCE-WP-0008", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-20", + "message": "Workplan dependency target 'RAILIANCE-WP-0004' is not linked to State Hub", + "file_path": "workplans/archived/260905-RPF-WP-0004-llm-connect-openrouter-provider-key-lane.md", + "db_id": "", + "file_value": "RAILIANCE-WP-0004", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-20", + "message": "Workplan dependency target 'RAILIANCE-WP-0007' is not linked to State Hub", + "file_path": "workplans/archived/260905-RPF-WP-0004-llm-connect-openrouter-provider-key-lane.md", + "db_id": "", + "file_value": "RAILIANCE-WP-0007", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-20", + "message": "Workplan dependency target 'RAILIANCE-WP-0008' is not linked to State Hub", + "file_path": "workplans/archived/260905-RPF-WP-0004-llm-connect-openrouter-provider-key-lane.md", + "db_id": "", + "file_value": "RAILIANCE-WP-0008", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-20", + "message": "Workplan dependency target 'RAILIANCE-WP-0007' is not linked to State Hub", + "file_path": "workplans/archived/260905-RPF-WP-0005-reuse-surface-runtime-secrets-openbao-lane.md", + "db_id": "", + "file_value": "RAILIANCE-WP-0007", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-20", + "message": "Workplan dependency target 'RAILIANCE-WP-0008' is not linked to State Hub", + "file_path": "workplans/archived/260905-RPF-WP-0005-reuse-surface-runtime-secrets-openbao-lane.md", + "db_id": "", + "file_value": "RAILIANCE-WP-0008", + "db_value": "", + "fixable": false + }, + { + "severity": "INFO", + "check_id": "C-08", + "message": "Closed DB workstream 'railiance-wp-0003@retired-20260826' (id=665b3b9b\u2026, status=finished) has no backing workplan file", + "file_path": "", + "db_id": "665b3b9b-608a-4be4-84b6-dcb8261ff57b", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "INFO", + "check_id": "C-08", + "message": "Closed DB workstream 'railiance-platform-railiance-wp-0004@retired-20260826' (id=e57e487b\u2026, status=finished) has no backing workplan file", + "file_path": "", + "db_id": "e57e487b-8557-439d-8093-0457c73ede93", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "INFO", + "check_id": "C-08", + "message": "Closed DB workstream 'railiance-platform-railiance-wp-0005@retired-20260826' (id=2731fece\u2026, status=finished) has no backing workplan file", + "file_path": "", + "db_id": "2731fece-6c49-45b8-ab8a-4ea6c04ac603", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "INFO", + "check_id": "C-08", + "message": "Closed DB workstream 'railiance-platform-railiance-wp-0006@retired-20260826' (id=96c8a93d\u2026, status=finished) has no backing workplan file", + "file_path": "", + "db_id": "96c8a93d-7a5a-4fa9-8f7b-865119551da3", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "INFO", + "check_id": "C-08", + "message": "Closed DB workstream 'railiance-platform-railiance-wp-0007@retired-20260826' (id=4d7ce243\u2026, status=finished) has no backing workplan file", + "file_path": "", + "db_id": "4d7ce243-f40a-4249-a46a-a24f75d6fe4c", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "INFO", + "check_id": "C-08", + "message": "Closed DB workstream 'railiance-platform-railiance-wp-0008@retired-20260826' (id=671898ef\u2026, status=finished) has no backing workplan file", + "file_path": "", + "db_id": "671898ef-2378-4814-b8f6-066148cdad46", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "INFO", + "check_id": "C-08", + "message": "Closed DB workstream 'railiance-platform-railiance-wp-0009@retired-20260826' (id=b059c81d\u2026, status=finished) has no backing workplan file", + "file_path": "", + "db_id": "b059c81d-96f1-451f-896f-a05cd73744a1", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "INFO", + "check_id": "C-08", + "message": "Closed DB workstream 'railiance-platform-railiance-wp-0010@retired-20260826' (id=f364d405\u2026, status=finished) has no backing workplan file", + "file_path": "", + "db_id": "f364d405-a85d-4b89-b600-1964ab436cad", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "FAIL", + "check_id": "C-07", + "message": "Non-closed DB workstream 'railiance-wp-0029@retired-20260826' (id=038bc3c0\u2026) has no backing workplan file \u2014 ADR-001 violation", + "file_path": "", + "db_id": "038bc3c0-4492-5b91-95eb-ae515ca205df", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "FAIL", + "check_id": "C-07", + "message": "Non-closed DB workstream 'railiance-wp-0024@retired-20260826' (id=88c4ef7f\u2026) has no backing workplan file \u2014 ADR-001 violation", + "file_path": "", + "db_id": "88c4ef7f-0af8-580e-90dc-a2bae2675a4d", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "INFO", + "check_id": "C-08", + "message": "Closed DB workstream 'railiance-wp-0025@retired-20260826' (id=2422d4e7\u2026, status=finished) has no backing workplan file", + "file_path": "", + "db_id": "2422d4e7-2125-591e-8e95-80ecc6e09da0", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "INFO", + "check_id": "C-08", + "message": "Closed DB workstream 'railiance-wp-0022@retired-20260826' (id=a7977cbf\u2026, status=finished) has no backing workplan file", + "file_path": "", + "db_id": "a7977cbf-ab43-56b7-b7a9-ceb52382b341", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "INFO", + "check_id": "C-08", + "message": "Closed DB workstream 'railiance-wp-0028@retired-20260826' (id=022dda1f\u2026, status=finished) has no backing workplan file", + "file_path": "", + "db_id": "022dda1f-8772-57ad-862e-672924455f11", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "INFO", + "check_id": "C-08", + "message": "Closed DB workstream 'railiance-wp-0015@retired-20260826' (id=1c73af72\u2026, status=finished) has no backing workplan file", + "file_path": "", + "db_id": "1c73af72-fd4b-5ab6-8ff7-a3c302bf55a5", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "FAIL", + "check_id": "C-07", + "message": "Non-closed DB workstream 'railiance-wp-0027@retired-20260826' (id=6f8a6cbc\u2026) has no backing workplan file \u2014 ADR-001 violation", + "file_path": "", + "db_id": "6f8a6cbc-c076-5f0a-ade2-281a7ec71360", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "INFO", + "check_id": "C-08", + "message": "Closed DB workstream 'railiance-wp-0017@retired-20260826' (id=16e8f234\u2026, status=finished) has no backing workplan file", + "file_path": "", + "db_id": "16e8f234-9305-5ff3-af82-4639215a0c54", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "INFO", + "check_id": "C-08", + "message": "Closed DB workstream 'railiance-wp-0026@retired-20260826' (id=73878f8d\u2026, status=finished) has no backing workplan file", + "file_path": "", + "db_id": "73878f8d-d8bb-5845-8a5c-91cdd83c1066", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "INFO", + "check_id": "C-08", + "message": "Closed DB workstream 'railiance-wp-0016@retired-20260826' (id=857ca302\u2026, status=finished) has no backing workplan file", + "file_path": "", + "db_id": "857ca302-bb94-5d41-a649-1aa966368df4", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "INFO", + "check_id": "C-08", + "message": "Closed DB workstream 'railiance-platform-railiance-wp-0011@retired-20260826' (id=3f9fd8de\u2026, status=finished) has no backing workplan file", + "file_path": "", + "db_id": "3f9fd8de-7235-4486-aaa7-634dba2bb6fa", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "INFO", + "check_id": "C-08", + "message": "Closed DB workstream 'railiance-wp-0023@retired-20260826' (id=ec52fbe6\u2026, status=finished) has no backing workplan file", + "file_path": "", + "db_id": "ec52fbe6-571b-570e-884b-c7a32ff7bcc8", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-26", + "message": "Workplan id 'RAIL-PL-WP-0002' uses prefix 'RAIL-PL-WP' but repo canonical prefix is 'RPF-WP' \u2014 new plans must conform", + "file_path": "workplans/archived/260702-RAIL-PL-WP-0002-openbao-platform-secrets-service.md", + "db_id": "", + "file_value": "RAIL-PL-WP-0002", + "db_value": "RPF-WP", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-26", + "message": "Workplan id 'RAIL-PL-WP-0001' uses prefix 'RAIL-PL-WP' but repo canonical prefix is 'RPF-WP' \u2014 new plans must conform", + "file_path": "workplans/archived/RAIL-PL-WP-0001-platform-baseline.md", + "db_id": "", + "file_value": "RAIL-PL-WP-0001", + "db_value": "RPF-WP", + "fixable": false + } + ], + "fixes_applied": [ + "bindings: synced 59/59", + "C-17 cleared: pushed 1 backlogged commit(s)", + "C-22 fixed: task 8f6966fa\u2026 description updated", + "push: pushed" + ], + "summary": { + "fail": 3, + "automation_error": 0, + "warn": 19, + "info": 17 + }, + "result": "fail" +} diff --git a/docs/evidence/2026-10-10-security-consolidation/jwt-source-preparation-consistency/platform-journal-v4-source-consistency.json b/docs/evidence/2026-10-10-security-consolidation/jwt-source-preparation-consistency/platform-journal-v4-source-consistency.json new file mode 100644 index 00000000..38c92dcb --- /dev/null +++ b/docs/evidence/2026-10-10-security-consolidation/jwt-source-preparation-consistency/platform-journal-v4-source-consistency.json @@ -0,0 +1,409 @@ +{ + "repo_slug": "railiance-platform", + "repo_path": "/home/worsch/railiance-platform", + "issues": [ + { + "severity": "WARN", + "check_id": "C-35", + "message": "Repo Manager missing: README.md: README.md is required for flavor tooling", + "file_path": "README.md", + "db_id": "", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-22", + "message": "Task description drift 'RPF-WP-0035-T13': file content differs from DB (file wins)", + "file_path": "workplans/RPF-WP-0035-credential-lane-implementation.md#RPF-WP-0035-T13", + "db_id": "8f6966fa-6e9a-58b2-8b40-c47340ec19d1", + "file_value": "2026-10-11: Platform agent loaded its owner instructions/INTENT and RPF35-T02,\nactual applied CCR38, exact native role/p", + "db_value": "2026-10-11: Platform agent loaded its owner instructions/INTENT and RPF35-T02,\nactual applied CCR38, exact native role/p", + "fixable": true + }, + { + "severity": "WARN", + "check_id": "C-23", + "message": "Lifecycle drift in 'rpf-wp-0053': workplan status 'proposed' has an active task \u2014 report only (ADR-007: do not auto-promote proposed)", + "file_path": "workplans/RPF-WP-0053-coulomb-paired-backup-admission.md", + "db_id": "cb55e474-c7a5-5c6f-bd72-ce65f853e3e3", + "file_value": "proposed", + "db_value": "proposed", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-20", + "message": "Workplan dependency target 'RAILIANCE-WP-0004' is not linked to State Hub", + "file_path": "workplans/archived/260702-RPF-WP-0023-workload-kv-access-lanes.md", + "db_id": "", + "file_value": "RAILIANCE-WP-0004", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-20", + "message": "Workplan dependency target 'RAILIANCE-WP-0005' is not linked to State Hub", + "file_path": "workplans/archived/260702-RPF-WP-0024-credential-change-approval-workflow.md", + "db_id": "", + "file_value": "RAILIANCE-WP-0005", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-20", + "message": "Workplan dependency target 'RAILIANCE-WP-0006' is not linked to State Hub", + "file_path": "workplans/archived/260702-RPF-WP-0024-credential-change-approval-workflow.md", + "db_id": "", + "file_value": "RAILIANCE-WP-0006", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-20", + "message": "Workplan dependency target 'RAILIANCE-WP-0005' is not linked to State Hub", + "file_path": "workplans/archived/260905-RPF-WP-0002-openbao-approved-automation-delegation.md", + "db_id": "", + "file_value": "RAILIANCE-WP-0005", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-20", + "message": "Workplan dependency target 'RAILIANCE-WP-0006' is not linked to State Hub", + "file_path": "workplans/archived/260905-RPF-WP-0002-openbao-approved-automation-delegation.md", + "db_id": "", + "file_value": "RAILIANCE-WP-0006", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-20", + "message": "Workplan dependency target 'RAILIANCE-WP-0007' is not linked to State Hub", + "file_path": "workplans/archived/260905-RPF-WP-0002-openbao-approved-automation-delegation.md", + "db_id": "", + "file_value": "RAILIANCE-WP-0007", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-20", + "message": "Workplan dependency target 'RAILIANCE-WP-0004' is not linked to State Hub", + "file_path": "workplans/archived/260905-RPF-WP-0003-issue-core-runtime-ingestion-key-lane.md", + "db_id": "", + "file_value": "RAILIANCE-WP-0004", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-20", + "message": "Workplan dependency target 'RAILIANCE-WP-0007' is not linked to State Hub", + "file_path": "workplans/archived/260905-RPF-WP-0003-issue-core-runtime-ingestion-key-lane.md", + "db_id": "", + "file_value": "RAILIANCE-WP-0007", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-20", + "message": "Workplan dependency target 'RAILIANCE-WP-0008' is not linked to State Hub", + "file_path": "workplans/archived/260905-RPF-WP-0003-issue-core-runtime-ingestion-key-lane.md", + "db_id": "", + "file_value": "RAILIANCE-WP-0008", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-20", + "message": "Workplan dependency target 'RAILIANCE-WP-0004' is not linked to State Hub", + "file_path": "workplans/archived/260905-RPF-WP-0004-llm-connect-openrouter-provider-key-lane.md", + "db_id": "", + "file_value": "RAILIANCE-WP-0004", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-20", + "message": "Workplan dependency target 'RAILIANCE-WP-0007' is not linked to State Hub", + "file_path": "workplans/archived/260905-RPF-WP-0004-llm-connect-openrouter-provider-key-lane.md", + "db_id": "", + "file_value": "RAILIANCE-WP-0007", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-20", + "message": "Workplan dependency target 'RAILIANCE-WP-0008' is not linked to State Hub", + "file_path": "workplans/archived/260905-RPF-WP-0004-llm-connect-openrouter-provider-key-lane.md", + "db_id": "", + "file_value": "RAILIANCE-WP-0008", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-20", + "message": "Workplan dependency target 'RAILIANCE-WP-0007' is not linked to State Hub", + "file_path": "workplans/archived/260905-RPF-WP-0005-reuse-surface-runtime-secrets-openbao-lane.md", + "db_id": "", + "file_value": "RAILIANCE-WP-0007", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-20", + "message": "Workplan dependency target 'RAILIANCE-WP-0008' is not linked to State Hub", + "file_path": "workplans/archived/260905-RPF-WP-0005-reuse-surface-runtime-secrets-openbao-lane.md", + "db_id": "", + "file_value": "RAILIANCE-WP-0008", + "db_value": "", + "fixable": false + }, + { + "severity": "INFO", + "check_id": "C-08", + "message": "Closed DB workstream 'railiance-wp-0003@retired-20260826' (id=665b3b9b\u2026, status=finished) has no backing workplan file", + "file_path": "", + "db_id": "665b3b9b-608a-4be4-84b6-dcb8261ff57b", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "INFO", + "check_id": "C-08", + "message": "Closed DB workstream 'railiance-platform-railiance-wp-0004@retired-20260826' (id=e57e487b\u2026, status=finished) has no backing workplan file", + "file_path": "", + "db_id": "e57e487b-8557-439d-8093-0457c73ede93", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "INFO", + "check_id": "C-08", + "message": "Closed DB workstream 'railiance-platform-railiance-wp-0005@retired-20260826' (id=2731fece\u2026, status=finished) has no backing workplan file", + "file_path": "", + "db_id": "2731fece-6c49-45b8-ab8a-4ea6c04ac603", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "INFO", + "check_id": "C-08", + "message": "Closed DB workstream 'railiance-platform-railiance-wp-0006@retired-20260826' (id=96c8a93d\u2026, status=finished) has no backing workplan file", + "file_path": "", + "db_id": "96c8a93d-7a5a-4fa9-8f7b-865119551da3", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "INFO", + "check_id": "C-08", + "message": "Closed DB workstream 'railiance-platform-railiance-wp-0007@retired-20260826' (id=4d7ce243\u2026, status=finished) has no backing workplan file", + "file_path": "", + "db_id": "4d7ce243-f40a-4249-a46a-a24f75d6fe4c", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "INFO", + "check_id": "C-08", + "message": "Closed DB workstream 'railiance-platform-railiance-wp-0008@retired-20260826' (id=671898ef\u2026, status=finished) has no backing workplan file", + "file_path": "", + "db_id": "671898ef-2378-4814-b8f6-066148cdad46", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "INFO", + "check_id": "C-08", + "message": "Closed DB workstream 'railiance-platform-railiance-wp-0009@retired-20260826' (id=b059c81d\u2026, status=finished) has no backing workplan file", + "file_path": "", + "db_id": "b059c81d-96f1-451f-896f-a05cd73744a1", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "INFO", + "check_id": "C-08", + "message": "Closed DB workstream 'railiance-platform-railiance-wp-0010@retired-20260826' (id=f364d405\u2026, status=finished) has no backing workplan file", + "file_path": "", + "db_id": "f364d405-a85d-4b89-b600-1964ab436cad", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "FAIL", + "check_id": "C-07", + "message": "Non-closed DB workstream 'railiance-wp-0029@retired-20260826' (id=038bc3c0\u2026) has no backing workplan file \u2014 ADR-001 violation", + "file_path": "", + "db_id": "038bc3c0-4492-5b91-95eb-ae515ca205df", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "FAIL", + "check_id": "C-07", + "message": "Non-closed DB workstream 'railiance-wp-0024@retired-20260826' (id=88c4ef7f\u2026) has no backing workplan file \u2014 ADR-001 violation", + "file_path": "", + "db_id": "88c4ef7f-0af8-580e-90dc-a2bae2675a4d", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "INFO", + "check_id": "C-08", + "message": "Closed DB workstream 'railiance-wp-0025@retired-20260826' (id=2422d4e7\u2026, status=finished) has no backing workplan file", + "file_path": "", + "db_id": "2422d4e7-2125-591e-8e95-80ecc6e09da0", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "INFO", + "check_id": "C-08", + "message": "Closed DB workstream 'railiance-wp-0022@retired-20260826' (id=a7977cbf\u2026, status=finished) has no backing workplan file", + "file_path": "", + "db_id": "a7977cbf-ab43-56b7-b7a9-ceb52382b341", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "INFO", + "check_id": "C-08", + "message": "Closed DB workstream 'railiance-wp-0028@retired-20260826' (id=022dda1f\u2026, status=finished) has no backing workplan file", + "file_path": "", + "db_id": "022dda1f-8772-57ad-862e-672924455f11", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "INFO", + "check_id": "C-08", + "message": "Closed DB workstream 'railiance-wp-0015@retired-20260826' (id=1c73af72\u2026, status=finished) has no backing workplan file", + "file_path": "", + "db_id": "1c73af72-fd4b-5ab6-8ff7-a3c302bf55a5", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "FAIL", + "check_id": "C-07", + "message": "Non-closed DB workstream 'railiance-wp-0027@retired-20260826' (id=6f8a6cbc\u2026) has no backing workplan file \u2014 ADR-001 violation", + "file_path": "", + "db_id": "6f8a6cbc-c076-5f0a-ade2-281a7ec71360", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "INFO", + "check_id": "C-08", + "message": "Closed DB workstream 'railiance-wp-0017@retired-20260826' (id=16e8f234\u2026, status=finished) has no backing workplan file", + "file_path": "", + "db_id": "16e8f234-9305-5ff3-af82-4639215a0c54", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "INFO", + "check_id": "C-08", + "message": "Closed DB workstream 'railiance-wp-0026@retired-20260826' (id=73878f8d\u2026, status=finished) has no backing workplan file", + "file_path": "", + "db_id": "73878f8d-d8bb-5845-8a5c-91cdd83c1066", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "INFO", + "check_id": "C-08", + "message": "Closed DB workstream 'railiance-wp-0016@retired-20260826' (id=857ca302\u2026, status=finished) has no backing workplan file", + "file_path": "", + "db_id": "857ca302-bb94-5d41-a649-1aa966368df4", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "INFO", + "check_id": "C-08", + "message": "Closed DB workstream 'railiance-platform-railiance-wp-0011@retired-20260826' (id=3f9fd8de\u2026, status=finished) has no backing workplan file", + "file_path": "", + "db_id": "3f9fd8de-7235-4486-aaa7-634dba2bb6fa", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "INFO", + "check_id": "C-08", + "message": "Closed DB workstream 'railiance-wp-0023@retired-20260826' (id=ec52fbe6\u2026, status=finished) has no backing workplan file", + "file_path": "", + "db_id": "ec52fbe6-571b-570e-884b-c7a32ff7bcc8", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-26", + "message": "Workplan id 'RAIL-PL-WP-0002' uses prefix 'RAIL-PL-WP' but repo canonical prefix is 'RPF-WP' \u2014 new plans must conform", + "file_path": "workplans/archived/260702-RAIL-PL-WP-0002-openbao-platform-secrets-service.md", + "db_id": "", + "file_value": "RAIL-PL-WP-0002", + "db_value": "RPF-WP", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-26", + "message": "Workplan id 'RAIL-PL-WP-0001' uses prefix 'RAIL-PL-WP' but repo canonical prefix is 'RPF-WP' \u2014 new plans must conform", + "file_path": "workplans/archived/RAIL-PL-WP-0001-platform-baseline.md", + "db_id": "", + "file_value": "RAIL-PL-WP-0001", + "db_value": "RPF-WP", + "fixable": false + } + ], + "fixes_applied": [ + "bindings: synced 59/59", + "C-17 cleared: pushed 1 backlogged commit(s)", + "C-22 fixed: task 8f6966fa\u2026 description updated", + "push: pushed" + ], + "summary": { + "fail": 3, + "automation_error": 0, + "warn": 19, + "info": 17 + }, + "result": "fail" +} diff --git a/docs/evidence/2026-10-10-security-consolidation/jwt-source-preparation-consistency/secrets-context-source-consistency.json b/docs/evidence/2026-10-10-security-consolidation/jwt-source-preparation-consistency/secrets-context-source-consistency.json new file mode 100644 index 00000000..21e9f4f9 --- /dev/null +++ b/docs/evidence/2026-10-10-security-consolidation/jwt-source-preparation-consistency/secrets-context-source-consistency.json @@ -0,0 +1,69 @@ +{ + "repo_slug": "secrets-engine", + "repo_path": "/home/worsch/secrets-engine", + "issues": [ + { + "severity": "WARN", + "check_id": "C-23", + "message": "Lifecycle drift in 'secrets-wp-0013': workplan status 'proposed' has an active task \u2014 report only (ADR-007: do not auto-promote proposed)", + "file_path": "workplans/SECRETS-WP-0013-task-scoped-openbao-execution.md", + "db_id": "5e38aecc-85ca-5f55-94c6-9fbb08604819", + "file_value": "proposed", + "db_value": "active", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-22", + "message": "Task description drift 'SECRETS-WP-0013-T01': file content differs from DB (file wins)", + "file_path": "workplans/SECRETS-WP-0013-task-scoped-openbao-execution.md#SECRETS-WP-0013-T01", + "db_id": "b2f0d462-a542-518b-a26b-b7ec07b3c7c1", + "file_value": "Design SECRETS-EXEC-20261011-v1 in docs/task-scoped-openbao-execution-contract.md\nbinds action, target, payload/source d", + "db_value": "Design SECRETS-EXEC-20261011-v1 in docs/task-scoped-openbao-execution-contract.md\nbinds action, target, payload/source d", + "fixable": true + }, + { + "severity": "INFO", + "check_id": "C-08", + "message": "Closed DB workstream 'secrets-wp-0002' (id=7929a2d1\u2026, status=finished) has no backing workplan file", + "file_path": "", + "db_id": "7929a2d1-3006-5d4b-85e4-c62da055ee9b", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-28", + "message": "2 unread inbox message(s) older than 3 day(s): the-custodian:23172cb2, the-custodian:51e9eace", + "file_path": "", + "db_id": "", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-28", + "message": "2 unread message(s) lack thread_id for supersession tracking: the-custodian:23172cb2, the-custodian:51e9eace", + "file_path": "", + "db_id": "", + "file_value": "", + "db_value": "", + "fixable": false + } + ], + "fixes_applied": [ + "bindings: synced 15/15", + "C-17 cleared: pushed 1 backlogged commit(s)", + "C-22 fixed: task b2f0d462\u2026 description updated", + "push: pushed" + ], + "summary": { + "fail": 0, + "automation_error": 0, + "warn": 4, + "info": 1 + }, + "result": "warn" +} diff --git a/docs/evidence/2026-10-10-security-consolidation/task-execution-journal-source-preparation.json b/docs/evidence/2026-10-10-security-consolidation/task-execution-journal-source-preparation.json new file mode 100644 index 00000000..befd241a --- /dev/null +++ b/docs/evidence/2026-10-10-security-consolidation/task-execution-journal-source-preparation.json @@ -0,0 +1,46 @@ +{ + "schema": "custodian-source-preparation/v1", + "scope": "RPF-WP-0035-T12 journal primitive preparation; design validation only", + "manifest_path": "/tmp/platform-execution-journal-stage-v2/manifest.json", + "manifest_sha256": "341cac1de945d2fbe8f516119909bd44fc37e85dccfb38b451981d4de2d402e7", + "source_applied": false, + "native_executed": false, + "owner_accepted": false, + "tests": { + "command": "PYTHONDONTWRITEBYTECODE=1 python3 -m unittest discover -s /tmp/platform-execution-journal-stage-v2/tests -p test_task_execution_journal.py -q", + "passed": 14, + "covers": [ + "actual four-process race admits once", + "reserved state survives abandonment without readmission", + "approval and operation uniqueness", + "pending external-call intent survives reopen", + "pending consume cannot become confirmed", + "wrong call digest/order and repeated confirmation refuse", + "terminal replay refuses", + "private directory/symlink/hardlink guards" + ] + }, + "files": [ + { + "repo": "railiance-platform", + "relative_path": "scripts/task_execution_journal.py", + "staged_path": "/tmp/platform-execution-journal-stage-v2/scripts/task_execution_journal.py", + "original_sha256": null, + "staged_sha256": "86b912e98eaedfa172de0f805ceb572b8c787565d4d9bbfc09b5836289a4dc3a" + }, + { + "repo": "railiance-platform", + "relative_path": "tests/test_task_execution_journal.py", + "staged_path": "/tmp/platform-execution-journal-stage-v2/tests/test_task_execution_journal.py", + "original_sha256": null, + "staged_sha256": "01075296e57592ff30702cb9252c8b10133b26afe7921a084d5314107f9346c2" + } + ], + "gaps": [ + "Native mediation, identity and claim/PDP/consume verification are not implemented", + "Exact owner body compiler and backend action dispatch are not implemented", + "TTL, fixed plan budget and caller authentication require mediator enforcement", + "Cleanup and reconciliation after unknown require an admitted independent owner recovery path", + "No deployment, native acceptance, existing task closure or default change" + ] +} diff --git a/docs/security-collaboration-review-2026-10-10.md b/docs/security-collaboration-review-2026-10-10.md index 69a1adf2..543abe5d 100644 --- a/docs/security-collaboration-review-2026-10-10.md +++ b/docs/security-collaboration-review-2026-10-10.md @@ -737,3 +737,66 @@ original error receipt is retained and a separate retry verifies publication (0FAIL/4WARN,38/38 bindings and two commits pushed). Custodian's final sync also encountered a State Hub timeout; its separate error receipt is retained. None of this source work changes native authority or scores a privileged trial. + +### Execution integration source continuation + +Secrets Engine `d8edd9e` implements the closed typed execution descriptor and +threads it through all four authorization/approval request builders. The new +descriptor is restricted to `execute-ccr`, prod/platform and human control; +generic apply semantics and the login-only readiness guard remain intact. +Access Engine's exact source agreement is `7687ac2`; maker, root and Access each +reproduced99 focused checks. The earlier draft instruction to reuse `apply` was +corrected. Shape/hash binding is not an authenticated initiator, owner body +compiler, distinct policy package or native execution grant. + +Root reproduced ApprovalHTTPClient following a cross-origin redirect and +forwarding its bearer header, using only local synthetic credentials. The +counterexample receipt is `approval-confirmation-transport-counterexample.json`. +Approval `2eb045b` persists completed source preparation before formal review; +`b428ffe` repairs default transport with a fixed isolated stdlib child, no +redirects/environment proxies, strict bounded JSON and a parent network deadline. +Root reproduced51 transport checks in the actual checkout; the maker's full +source suite passed270. The injected test opener is explicitly not an admitted +production transport. No provider deployment or mediator route admission occurs. + +Platform `4ed5050` adds the independently reviewed durable admission primitive: +actual multiprocess race, persisted intent, binding uniqueness and terminal +non-replay are tested. Root actual checkout passed15 checks; Platform passed20. +The rejected v2 ordinal-coercion confirmation remains in its owner review before +v3 source acceptance. The primitive is unintegrated: it does not authenticate, +authorize, compile bodies, dispatch or perform owner recovery. Platform `4e8fa6e` +adds the independently accepted v4 provider-format refinement, preserving exact +canonical `sha256:` request digests. Raw file/receipt SHA256 hashes have a distinct +representation. Root actual15 checks and Platform30 checks pass for v4. + +Source syncs pushed all these changes: Secrets0FAIL/4WARN/1INFO, Access0FAIL/3WARN, +Approval0FAIL/6WARN. Platform pushed with the same three historical C07 failures +(3FAIL/19WARN/17INFO). Finished-ad-hoc task-binding skips remain explicit in the +CLI receipts rather than being reported as created database tasks. + +The JWT node-route preparation exposed and corrected public-health sequencing +and then unbounded private stdin. Frozen v7 changes-requested reviews remain; +v8 has fresh KeyCape/Platform agreement for bounded health/input/native-action +gates only. The proposed private producer itself was rejected for missing +child-ready acknowledgment, stdout descriptor aliases and an overstated atomic +unlink guarantee. Its correction and trusted founder launcher are separate live +preparation, not new authority. Coding-agent custody/client admission, actual +node route/plugin/leeway/readiness evidence, exact founder go and native proof +remain open. Current inventory remains47 open plans/103 unfinished tasks. + +NetKingdom `bf6a44d` publishes the reviewed v8 route/input corrections and prior +owner histories; root actual71 discovered tests pass. KeyCape `f60e741` records +the v7 refusal and exact bounded-v8 acknowledgment. Net sync returned0FAIL/ +13WARN/5INFO, Key sync0FAIL/4WARN/1INFO, with both commits pushed. Platform's +v4 refinement was also pushed with its same three retained historical failures. +Root additionally passed36 actual Approval legacy/confirmation compatibility +checks alongside the51 transport cases. No staged source test is promoted to +native proof. + +The next paired v9 ready-marker/node-wrapper and private producer preparations +remain uninstalled and unadmitted. Independent reviews reproduced dropped remote +uncertainty after delivery timeout and an unbounded FIFO contract read; immutable +refinements are underway. The proposed founder SSH profile must be separately +admitted and is incompatible with the existing warden silent-child lane. A +ready marker cannot grant authority, authenticate founder disposition or establish +runtime isolation. It must be carried by the reviewed authenticated owner path.