ops-warden triage: 6/7 CUST-IN findings were stale, close as absorbed
Checked all 7 WARDEN-WP-0012-origin findings against ops-warden's live catalog before any hand-off. 6 were already shipped weeks before this migration (2026-07-21) -- the source suggestions just never got closed: - CUST-IN-0001 -> issue-core-ingestion-api-key: active since 2026-07-02 (CCR-2026-0002/RAILIANCE-WP-0009, audit-verified) - CUST-IN-0002 -> activity-core-issue-sink: active since 2026-06-18 - CUST-IN-0003 -> openrouter-llm-connect: active since 2026-07-02 (CCR-2026-0003/RAILIANCE-WP-0010, audit-verified) - CUST-IN-0005 -> key-cape-oidc-login: active since 2026-06-27 (used directly this session, 2026-07-20, to fetch the forgejo-admin-api-token) - CUST-IN-0006 -> flex-auth-policy-check: active since 2026-06-18 - CUST-IN-0007 -> railiance-infra-principals: active since 2026-06-18 All 6 closed outcome: absorbed, file + hub in sync, pointing at the shipped catalog entry. No Forgejo issue opened for these -- the fleet doesn't use Forgejo issue tracking as a coordination mechanism (retired 2026-07-20), and this file is exactly the sanctioned equivalent. CUST-IN-0004 (object-storage-sts) is the one real item: routed, not closed. Its own ops-warden playbook is explicit -- "ops-warden does not vend object-storage credentials" / "do not ask ops-warden" -- and its tracking workplan (WARDEN-WP-0012, finished 2026-06-27) already scoped correctly: T04 delivered the pointer playbook only, not the vending path. Real owners per that workplan's own table: net-kingdom (architecture), flex-auth (policy decision), railiance-platform (OpenBao broker), artifact-store (consumer, ARTIFACT-STORE-WP-0007). References NK-WP-0007. Left routed with full context for one of those four repos' owners to pick up -- not implemented here, not ops-warden's to do. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This commit is contained in:
codex
parent
87dece7e79
commit
76242dcb96
2 changed files with 79 additions and 30 deletions
|
|
@ -392,13 +392,13 @@
|
|||
| task | CUST-WP-0061-T04 | done | — | workplans/CUST-WP-0061-work-record-stage3-intake-promotion-index.md |
|
||||
| task | CUST-WP-0061-T05 | done | — | workplans/CUST-WP-0061-work-record-stage3-intake-promotion-index.md |
|
||||
| task | CUST-WP-0061-T06 | done | — | workplans/CUST-WP-0061-work-record-stage3-intake-promotion-index.md |
|
||||
| intake | CUST-IN-0001 | open | green | intake-legacy-suggestions-migration.md |
|
||||
| intake | CUST-IN-0002 | open | green | intake-legacy-suggestions-migration.md |
|
||||
| intake | CUST-IN-0003 | open | green | intake-legacy-suggestions-migration.md |
|
||||
| intake | CUST-IN-0004 | open | green | intake-legacy-suggestions-migration.md |
|
||||
| intake | CUST-IN-0005 | open | green | intake-legacy-suggestions-migration.md |
|
||||
| intake | CUST-IN-0006 | open | green | intake-legacy-suggestions-migration.md |
|
||||
| intake | CUST-IN-0007 | open | green | intake-legacy-suggestions-migration.md |
|
||||
| intake | CUST-IN-0001 | closed | green | intake-legacy-suggestions-migration.md |
|
||||
| intake | CUST-IN-0002 | closed | green | intake-legacy-suggestions-migration.md |
|
||||
| intake | CUST-IN-0003 | closed | green | intake-legacy-suggestions-migration.md |
|
||||
| intake | CUST-IN-0004 | routed | green | intake-legacy-suggestions-migration.md |
|
||||
| intake | CUST-IN-0005 | closed | green | intake-legacy-suggestions-migration.md |
|
||||
| intake | CUST-IN-0006 | closed | green | intake-legacy-suggestions-migration.md |
|
||||
| intake | CUST-IN-0007 | closed | green | intake-legacy-suggestions-migration.md |
|
||||
| intake | CUST-IN-0008 | open | blue | intake-legacy-suggestions-migration.md |
|
||||
| intake | CUST-IN-0009 | open | blue | intake-legacy-suggestions-migration.md |
|
||||
| intake | CUST-IN-0010 | open | green | intake-legacy-suggestions-migration.md |
|
||||
|
|
|
|||
|
|
@ -21,17 +21,34 @@
|
|||
> preserved). **If you own one of these domains, pick up the finding**:
|
||||
> vet it, route it, and promote it into a proper workplan/task in the
|
||||
> right repo — that's the whole point of the mechanism this repo now has.
|
||||
>
|
||||
> **ops-warden triage, 2026-07-21:** the 7 `WARDEN-WP-0012` findings
|
||||
> (`CUST-IN-0001`–`0007`) were checked against ops-warden's live catalog
|
||||
> before any hand-off. 6 were stale — their catalog entries had already
|
||||
> been promoted to `status: active` weeks before this migration (policy +
|
||||
> OIDC applied, ExternalSecrets synced, audit-verified) and the source
|
||||
> suggestions just never got closed. Closed here as `outcome: absorbed`
|
||||
> with a pointer to the shipped catalog entry, no Forgejo issue opened
|
||||
> (the fleet doesn't use Forgejo issue tracking as a coordination
|
||||
> mechanism — this file is the sanctioned equivalent). Only
|
||||
> `CUST-IN-0004` (object-storage-sts) is genuinely still open; it is
|
||||
> explicitly **not** ops-warden's to implement (its own playbook: *"do
|
||||
> not ask ops-warden"*) — routed with the real owners named in its block.
|
||||
|
||||
```yaml
|
||||
id: CUST-IN-0001
|
||||
title: "Issue-core ingestion API key OpenBao path"
|
||||
lane: green
|
||||
status: open
|
||||
status: closed
|
||||
outcome: absorbed
|
||||
origin: "legacy-suggestion:256e94f0-833f-4502-a927-70873c3b5a1b"
|
||||
origin_ref: "issue-core-ingestion-api-key"
|
||||
notes: "Gated routing scenario from WARDEN-WP-0012. Owner path not yet
|
||||
shipped; accrued relevance=1 in the legacy suggestions table before
|
||||
migration (2026-07-21)."
|
||||
notes: "Gated routing scenario from WARDEN-WP-0012. Was stale: ops-warden's
|
||||
catalog entry issue-core-ingestion-api-key was already promoted to
|
||||
status: active on 2026-07-02 (railiance-platform CCR-2026-0002 /
|
||||
RAILIANCE-WP-0009 — policy + OIDC role applied, ExternalSecret
|
||||
SecretSynced, access verified with OpenBao audit evidence) -- weeks
|
||||
before this migration (2026-07-21). Absorbed, no action needed."
|
||||
state_hub_intake_id: "019f81e5-ab50-716d-8d69-680d46001856"
|
||||
```
|
||||
|
||||
|
|
@ -39,12 +56,14 @@ state_hub_intake_id: "019f81e5-ab50-716d-8d69-680d46001856"
|
|||
id: CUST-IN-0002
|
||||
title: "Activity-core issue sink consumer key custody"
|
||||
lane: green
|
||||
status: open
|
||||
status: closed
|
||||
outcome: absorbed
|
||||
origin: "legacy-suggestion:a1a08013-1c5c-4471-8dc6-7bf0b2acb591"
|
||||
origin_ref: "activity-core-issue-sink"
|
||||
notes: "Gated routing scenario from WARDEN-WP-0012. Owner path not yet
|
||||
shipped; accrued relevance=1 in the legacy suggestions table before
|
||||
migration (2026-07-21)."
|
||||
notes: "Gated routing scenario from WARDEN-WP-0012. Was stale: ops-warden's
|
||||
catalog entry activity-core-issue-sink was already status: active
|
||||
(reviewed 2026-06-18) -- over a month before this migration
|
||||
(2026-07-21). Absorbed, no action needed."
|
||||
state_hub_intake_id: "019f81e5-b404-7e7f-87a9-c92196351216"
|
||||
```
|
||||
|
||||
|
|
@ -52,11 +71,16 @@ state_hub_intake_id: "019f81e5-b404-7e7f-87a9-c92196351216"
|
|||
id: CUST-IN-0003
|
||||
title: "OpenRouter llm-connect OpenBao -> K8s Secret path"
|
||||
lane: green
|
||||
status: open
|
||||
status: closed
|
||||
outcome: absorbed
|
||||
origin: "legacy-suggestion:b431df3a-3a0d-4ce9-abf9-d931dff58523"
|
||||
origin_ref: "openrouter-llm-connect"
|
||||
notes: "Gated routing scenario from WARDEN-WP-0012. Owner path not yet
|
||||
shipped; migrated 2026-07-21."
|
||||
notes: "Gated routing scenario from WARDEN-WP-0012. Was stale: ops-warden's
|
||||
catalog entry openrouter-llm-connect was already promoted to
|
||||
status: active on 2026-07-02 (railiance-platform CCR-2026-0003 /
|
||||
RAILIANCE-WP-0010 -- policy + OIDC role applied, ExternalSecret
|
||||
SecretSynced, llm-connect rolled out on the value, access verified) --
|
||||
weeks before this migration (2026-07-21). Absorbed, no action needed."
|
||||
state_hub_intake_id: "019f81e5-be9a-733b-b8ea-711b220d4177"
|
||||
```
|
||||
|
||||
|
|
@ -64,11 +88,26 @@ state_hub_intake_id: "019f81e5-be9a-733b-b8ea-711b220d4177"
|
|||
id: CUST-IN-0004
|
||||
title: "Object storage STS vending path (NK-WP-0007)"
|
||||
lane: green
|
||||
status: open
|
||||
status: routed
|
||||
origin: "legacy-suggestion:1fc77948-951a-43be-a3c9-8caebfc9243d"
|
||||
origin_ref: "object-storage-sts"
|
||||
notes: "Gated routing scenario from WARDEN-WP-0012, references net-kingdom
|
||||
NK-WP-0007. Owner path not yet shipped; migrated 2026-07-21."
|
||||
routed_note: "Genuinely still open (2026-07-21 verification), unlike its 6
|
||||
siblings. ops-warden's catalog entry object-storage-sts is status: draft
|
||||
and its own playbook (ops-warden/wiki/playbooks/object-storage-sts.md)
|
||||
is explicit: 'ops-warden does not vend object-storage credentials' /
|
||||
'Do not ask ops-warden.' ops-warden's own tracking workplan
|
||||
(WARDEN-WP-0012, finished 2026-06-27) already scoped this correctly --
|
||||
its T04 delivered the pointer playbook only; the vending path itself is
|
||||
out of its scope. Real owners per that workplan's own table and the
|
||||
playbook: net-kingdom (architecture/trust boundaries,
|
||||
docs/object-storage-sts-credential-vending.md), flex-auth (policy
|
||||
decision: may this principal access bucket/prefix), railiance-platform
|
||||
(OpenBao broker config, audit, bootstrap parent creds), artifact-store
|
||||
(S3 client refresh/consumer, ARTIFACT-STORE-WP-0007). References
|
||||
net-kingdom NK-WP-0007. Routed here rather than closed or
|
||||
implemented -- promotion into a workplan is for one of those four repos'
|
||||
owners to do, not the-custodian or ops-warden."
|
||||
notes: "Gated routing scenario from WARDEN-WP-0012."
|
||||
state_hub_intake_id: "019f81e5-d422-7e78-9b5a-8b4635fec15d"
|
||||
```
|
||||
|
||||
|
|
@ -76,11 +115,15 @@ state_hub_intake_id: "019f81e5-d422-7e78-9b5a-8b4635fec15d"
|
|||
id: CUST-IN-0005
|
||||
title: "Human OIDC login via key-cape / Keycloak"
|
||||
lane: green
|
||||
status: open
|
||||
status: closed
|
||||
outcome: absorbed
|
||||
origin: "legacy-suggestion:b3b59fbe-6932-4934-b960-e9f3f244eeb1"
|
||||
origin_ref: "human-oidc-login"
|
||||
notes: "Gated routing scenario from WARDEN-WP-0012. Owner path not yet
|
||||
shipped; migrated 2026-07-21."
|
||||
notes: "Gated routing scenario from WARDEN-WP-0012. Was stale: covered by
|
||||
ops-warden catalog entry key-cape-oidc-login (status: active, reviewed
|
||||
2026-06-27) -- 'Login lane (WP-0014 T4), interactive auth bootstrap.'
|
||||
Used directly this session (2026-07-20) to fetch the forgejo-admin-api-token
|
||||
credential via bao login -method=oidc. Absorbed, no action needed."
|
||||
state_hub_intake_id: "019f81e5-f82b-70c8-8948-8fc07e1879e0"
|
||||
```
|
||||
|
||||
|
|
@ -88,11 +131,14 @@ state_hub_intake_id: "019f81e5-f82b-70c8-8948-8fc07e1879e0"
|
|||
id: CUST-IN-0006
|
||||
title: "flex-auth policy decision before sensitive action"
|
||||
lane: green
|
||||
status: open
|
||||
status: closed
|
||||
outcome: absorbed
|
||||
origin: "legacy-suggestion:1e152a52-88a7-455c-b35b-36ef9a24beeb"
|
||||
origin_ref: "flex-auth-resource-check"
|
||||
notes: "Gated routing scenario from WARDEN-WP-0012. Owner path not yet
|
||||
shipped; migrated 2026-07-21."
|
||||
notes: "Gated routing scenario from WARDEN-WP-0012. Was stale: covered by
|
||||
ops-warden catalog entry flex-auth-policy-check (status: active,
|
||||
reviewed 2026-06-18) -- 'Authorization decision: may this actor perform
|
||||
this action.' Absorbed, no action needed."
|
||||
state_hub_intake_id: "019f81e6-06f1-7718-bac1-c93ee29265b9"
|
||||
```
|
||||
|
||||
|
|
@ -100,11 +146,14 @@ state_hub_intake_id: "019f81e6-06f1-7718-bac1-c93ee29265b9"
|
|||
id: CUST-IN-0007
|
||||
title: "auth_principals sync for host principal deploy"
|
||||
lane: green
|
||||
status: open
|
||||
status: closed
|
||||
outcome: absorbed
|
||||
origin: "legacy-suggestion:0ddbfc0c-469a-4d73-a20f-06071b7114a0"
|
||||
origin_ref: "host-principal-deploy"
|
||||
notes: "Gated routing scenario from WARDEN-WP-0012. Owner path not yet
|
||||
shipped; migrated 2026-07-21."
|
||||
notes: "Gated routing scenario from WARDEN-WP-0012. Was stale: covered by
|
||||
ops-warden catalog entry railiance-infra-principals (status: active,
|
||||
reviewed 2026-06-18) -- 'Host SSH principal file or force-command
|
||||
deployment,' owner_repo railiance-infra. Absorbed, no action needed."
|
||||
state_hub_intake_id: "019f81e6-1149-78aa-97d2-635c75622e9e"
|
||||
```
|
||||
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue