diff --git a/WORK-RECORDS.md b/WORK-RECORDS.md index 82d1507..4d75ff2 100644 --- a/WORK-RECORDS.md +++ b/WORK-RECORDS.md @@ -392,13 +392,13 @@ | task | CUST-WP-0061-T04 | done | — | workplans/CUST-WP-0061-work-record-stage3-intake-promotion-index.md | | task | CUST-WP-0061-T05 | done | — | workplans/CUST-WP-0061-work-record-stage3-intake-promotion-index.md | | task | CUST-WP-0061-T06 | done | — | workplans/CUST-WP-0061-work-record-stage3-intake-promotion-index.md | -| intake | CUST-IN-0001 | open | green | intake-legacy-suggestions-migration.md | -| intake | CUST-IN-0002 | open | green | intake-legacy-suggestions-migration.md | -| intake | CUST-IN-0003 | open | green | intake-legacy-suggestions-migration.md | -| intake | CUST-IN-0004 | open | green | intake-legacy-suggestions-migration.md | -| intake | CUST-IN-0005 | open | green | intake-legacy-suggestions-migration.md | -| intake | CUST-IN-0006 | open | green | intake-legacy-suggestions-migration.md | -| intake | CUST-IN-0007 | open | green | intake-legacy-suggestions-migration.md | +| intake | CUST-IN-0001 | closed | green | intake-legacy-suggestions-migration.md | +| intake | CUST-IN-0002 | closed | green | intake-legacy-suggestions-migration.md | +| intake | CUST-IN-0003 | closed | green | intake-legacy-suggestions-migration.md | +| intake | CUST-IN-0004 | routed | green | intake-legacy-suggestions-migration.md | +| intake | CUST-IN-0005 | closed | green | intake-legacy-suggestions-migration.md | +| intake | CUST-IN-0006 | closed | green | intake-legacy-suggestions-migration.md | +| intake | CUST-IN-0007 | closed | green | intake-legacy-suggestions-migration.md | | intake | CUST-IN-0008 | open | blue | intake-legacy-suggestions-migration.md | | intake | CUST-IN-0009 | open | blue | intake-legacy-suggestions-migration.md | | intake | CUST-IN-0010 | open | green | intake-legacy-suggestions-migration.md | diff --git a/intake-legacy-suggestions-migration.md b/intake-legacy-suggestions-migration.md index e005ace..a1b9369 100644 --- a/intake-legacy-suggestions-migration.md +++ b/intake-legacy-suggestions-migration.md @@ -21,17 +21,34 @@ > preserved). **If you own one of these domains, pick up the finding**: > vet it, route it, and promote it into a proper workplan/task in the > right repo — that's the whole point of the mechanism this repo now has. +> +> **ops-warden triage, 2026-07-21:** the 7 `WARDEN-WP-0012` findings +> (`CUST-IN-0001`–`0007`) were checked against ops-warden's live catalog +> before any hand-off. 6 were stale — their catalog entries had already +> been promoted to `status: active` weeks before this migration (policy + +> OIDC applied, ExternalSecrets synced, audit-verified) and the source +> suggestions just never got closed. Closed here as `outcome: absorbed` +> with a pointer to the shipped catalog entry, no Forgejo issue opened +> (the fleet doesn't use Forgejo issue tracking as a coordination +> mechanism — this file is the sanctioned equivalent). Only +> `CUST-IN-0004` (object-storage-sts) is genuinely still open; it is +> explicitly **not** ops-warden's to implement (its own playbook: *"do +> not ask ops-warden"*) — routed with the real owners named in its block. ```yaml id: CUST-IN-0001 title: "Issue-core ingestion API key OpenBao path" lane: green -status: open +status: closed +outcome: absorbed origin: "legacy-suggestion:256e94f0-833f-4502-a927-70873c3b5a1b" origin_ref: "issue-core-ingestion-api-key" -notes: "Gated routing scenario from WARDEN-WP-0012. Owner path not yet - shipped; accrued relevance=1 in the legacy suggestions table before - migration (2026-07-21)." +notes: "Gated routing scenario from WARDEN-WP-0012. Was stale: ops-warden's + catalog entry issue-core-ingestion-api-key was already promoted to + status: active on 2026-07-02 (railiance-platform CCR-2026-0002 / + RAILIANCE-WP-0009 — policy + OIDC role applied, ExternalSecret + SecretSynced, access verified with OpenBao audit evidence) -- weeks + before this migration (2026-07-21). Absorbed, no action needed." state_hub_intake_id: "019f81e5-ab50-716d-8d69-680d46001856" ``` @@ -39,12 +56,14 @@ state_hub_intake_id: "019f81e5-ab50-716d-8d69-680d46001856" id: CUST-IN-0002 title: "Activity-core issue sink consumer key custody" lane: green -status: open +status: closed +outcome: absorbed origin: "legacy-suggestion:a1a08013-1c5c-4471-8dc6-7bf0b2acb591" origin_ref: "activity-core-issue-sink" -notes: "Gated routing scenario from WARDEN-WP-0012. Owner path not yet - shipped; accrued relevance=1 in the legacy suggestions table before - migration (2026-07-21)." +notes: "Gated routing scenario from WARDEN-WP-0012. Was stale: ops-warden's + catalog entry activity-core-issue-sink was already status: active + (reviewed 2026-06-18) -- over a month before this migration + (2026-07-21). Absorbed, no action needed." state_hub_intake_id: "019f81e5-b404-7e7f-87a9-c92196351216" ``` @@ -52,11 +71,16 @@ state_hub_intake_id: "019f81e5-b404-7e7f-87a9-c92196351216" id: CUST-IN-0003 title: "OpenRouter llm-connect OpenBao -> K8s Secret path" lane: green -status: open +status: closed +outcome: absorbed origin: "legacy-suggestion:b431df3a-3a0d-4ce9-abf9-d931dff58523" origin_ref: "openrouter-llm-connect" -notes: "Gated routing scenario from WARDEN-WP-0012. Owner path not yet - shipped; migrated 2026-07-21." +notes: "Gated routing scenario from WARDEN-WP-0012. Was stale: ops-warden's + catalog entry openrouter-llm-connect was already promoted to + status: active on 2026-07-02 (railiance-platform CCR-2026-0003 / + RAILIANCE-WP-0010 -- policy + OIDC role applied, ExternalSecret + SecretSynced, llm-connect rolled out on the value, access verified) -- + weeks before this migration (2026-07-21). Absorbed, no action needed." state_hub_intake_id: "019f81e5-be9a-733b-b8ea-711b220d4177" ``` @@ -64,11 +88,26 @@ state_hub_intake_id: "019f81e5-be9a-733b-b8ea-711b220d4177" id: CUST-IN-0004 title: "Object storage STS vending path (NK-WP-0007)" lane: green -status: open +status: routed origin: "legacy-suggestion:1fc77948-951a-43be-a3c9-8caebfc9243d" origin_ref: "object-storage-sts" -notes: "Gated routing scenario from WARDEN-WP-0012, references net-kingdom - NK-WP-0007. Owner path not yet shipped; migrated 2026-07-21." +routed_note: "Genuinely still open (2026-07-21 verification), unlike its 6 + siblings. ops-warden's catalog entry object-storage-sts is status: draft + and its own playbook (ops-warden/wiki/playbooks/object-storage-sts.md) + is explicit: 'ops-warden does not vend object-storage credentials' / + 'Do not ask ops-warden.' ops-warden's own tracking workplan + (WARDEN-WP-0012, finished 2026-06-27) already scoped this correctly -- + its T04 delivered the pointer playbook only; the vending path itself is + out of its scope. Real owners per that workplan's own table and the + playbook: net-kingdom (architecture/trust boundaries, + docs/object-storage-sts-credential-vending.md), flex-auth (policy + decision: may this principal access bucket/prefix), railiance-platform + (OpenBao broker config, audit, bootstrap parent creds), artifact-store + (S3 client refresh/consumer, ARTIFACT-STORE-WP-0007). References + net-kingdom NK-WP-0007. Routed here rather than closed or + implemented -- promotion into a workplan is for one of those four repos' + owners to do, not the-custodian or ops-warden." +notes: "Gated routing scenario from WARDEN-WP-0012." state_hub_intake_id: "019f81e5-d422-7e78-9b5a-8b4635fec15d" ``` @@ -76,11 +115,15 @@ state_hub_intake_id: "019f81e5-d422-7e78-9b5a-8b4635fec15d" id: CUST-IN-0005 title: "Human OIDC login via key-cape / Keycloak" lane: green -status: open +status: closed +outcome: absorbed origin: "legacy-suggestion:b3b59fbe-6932-4934-b960-e9f3f244eeb1" origin_ref: "human-oidc-login" -notes: "Gated routing scenario from WARDEN-WP-0012. Owner path not yet - shipped; migrated 2026-07-21." +notes: "Gated routing scenario from WARDEN-WP-0012. Was stale: covered by + ops-warden catalog entry key-cape-oidc-login (status: active, reviewed + 2026-06-27) -- 'Login lane (WP-0014 T4), interactive auth bootstrap.' + Used directly this session (2026-07-20) to fetch the forgejo-admin-api-token + credential via bao login -method=oidc. Absorbed, no action needed." state_hub_intake_id: "019f81e5-f82b-70c8-8948-8fc07e1879e0" ``` @@ -88,11 +131,14 @@ state_hub_intake_id: "019f81e5-f82b-70c8-8948-8fc07e1879e0" id: CUST-IN-0006 title: "flex-auth policy decision before sensitive action" lane: green -status: open +status: closed +outcome: absorbed origin: "legacy-suggestion:1e152a52-88a7-455c-b35b-36ef9a24beeb" origin_ref: "flex-auth-resource-check" -notes: "Gated routing scenario from WARDEN-WP-0012. Owner path not yet - shipped; migrated 2026-07-21." +notes: "Gated routing scenario from WARDEN-WP-0012. Was stale: covered by + ops-warden catalog entry flex-auth-policy-check (status: active, + reviewed 2026-06-18) -- 'Authorization decision: may this actor perform + this action.' Absorbed, no action needed." state_hub_intake_id: "019f81e6-06f1-7718-bac1-c93ee29265b9" ``` @@ -100,11 +146,14 @@ state_hub_intake_id: "019f81e6-06f1-7718-bac1-c93ee29265b9" id: CUST-IN-0007 title: "auth_principals sync for host principal deploy" lane: green -status: open +status: closed +outcome: absorbed origin: "legacy-suggestion:0ddbfc0c-469a-4d73-a20f-06071b7114a0" origin_ref: "host-principal-deploy" -notes: "Gated routing scenario from WARDEN-WP-0012. Owner path not yet - shipped; migrated 2026-07-21." +notes: "Gated routing scenario from WARDEN-WP-0012. Was stale: covered by + ops-warden catalog entry railiance-infra-principals (status: active, + reviewed 2026-06-18) -- 'Host SSH principal file or force-command + deployment,' owner_repo railiance-infra. Absorbed, no action needed." state_hub_intake_id: "019f81e6-1149-78aa-97d2-635c75622e9e" ```