Record clean provider fleet adoption and owner brief renderer
This commit is contained in:
codex
parent
02e69269c8
commit
b2effc84d7
4 changed files with 115 additions and 23 deletions
|
|
@ -2,25 +2,29 @@
|
|||
# Custodian Brief — the-custodian
|
||||
|
||||
**Domain:** infotech
|
||||
**Last synced:** 2026-10-13 20:02 UTC
|
||||
**Last synced:** 2026-10-19 10:44 UTC
|
||||
**State Hub:** http://127.0.0.1:8000 *(adjust if running on a remote machine)*
|
||||
|
||||
## Active Workstreams
|
||||
|
||||
### NetKingdom security blueprint and SEC-DSM gap closure
|
||||
Progress: 2/5 done | workplan_id: `dfadb19b-445e-59c6-bcd6-48e87b912c52`
|
||||
### Deterministic security flow: standing authorizations, flow report, and agent re-engagement
|
||||
Progress: 3/7 done | workplan_id: `ab288f92-d364-5c24-9362-aee451f266c3`
|
||||
|
||||
**Open tasks:**
|
||||
- ► Close source defects and reconcile uncovered lifecycle gaps `87637402`
|
||||
- ► Coordinate self-service Playwright identity delivery `ed8b909a`
|
||||
- · Verify native closure against every requirement `82378b0f`
|
||||
- ! Schedule the flow report and decision sync `1be0569c`
|
||||
*(wait: Activity Core accepted the schedule in ACTIVITY-WP-0047. Await claiming rein workstation/hub acceptance, owner activation and the first unassisted fire with report/checkpoint evidence.)*
|
||||
- ! Encode the standing change rule as a policy-nexus guardrail `5dd52156`
|
||||
*(wait: policy-nexus owns guardrail publication; handoff written as PNEX-WP-0006.)*
|
||||
- ! Attended window #1 `e3da807f`
|
||||
*(wait: Owner source rechecked 2026-10-19: RPF-WP-0044-T08 is done and KEY-WP-0040-T01 preview is done. Remaining attended acts are USER-WP-0026-T03 positive readback, USER-WP-0028-T03 U08 recovery, and RPF-WP-0044-T04 OpenBao OIDC/MFA login; completed preview does not authorize factor mutation.)*
|
||||
- ► Stop agent-authored index and sync commits `8a3dc219`
|
||||
|
||||
### Separate agent credentials and establish supervised privileged execution
|
||||
Progress: 2/5 done | workplan_id: `a98a9f34-83b4-5c8c-8107-e05f7806d50d`
|
||||
|
||||
**Open tasks:**
|
||||
- ! Build and hand out the agent identity `4b88b0b7`
|
||||
*(wait: Await GLAS-WP-0012 (glas-harness) production acceptance of the local supervised profile; then railiance-platform RBAC, railiance-enablement k3s config, railiance-infra principal mapping and ops-warden certificate issuance.)*
|
||||
*(wait: Await GLAS-WP-0012 (glas-harness) production acceptance of the local supervised profile; then railiance-platform RBAC, railiance-cluster persistent k3s config, railiance-infra principal/account mapping and ops-warden certificate issuance.)*
|
||||
- ! Fleet guidance and harness guards `90725511`
|
||||
*(wait: Await CUST-WP-0073-T02: the verified agent identity and execution path must exist before it can be documented; Codex/Grok read-denial guard needs glas-harness or harness-owner delivery.)*
|
||||
- ! Rotate what was exposed `1b41b532`
|
||||
|
|
@ -39,19 +43,6 @@ Progress: 1/5 done | workplan_id: `2249bddb-7524-5add-bd5c-c4163a6ca0f3`
|
|||
- ! Establish the regular weekly workload-demand and allocation assessment `20ddd4d7`
|
||||
*(wait: Await the repeatable observation and accepted sizing/review procedure.)*
|
||||
|
||||
### Deterministic security flow: standing authorizations, flow report, and agent re-engagement
|
||||
Progress: 3/7 done | workplan_id: `ab288f92-d364-5c24-9362-aee451f266c3`
|
||||
|
||||
**Open tasks:**
|
||||
- ! Schedule the flow report and decision sync `1be0569c`
|
||||
*(wait: Activity Core accepted the schedule in ACTIVITY-WP-0047. Await claiming rein workstation/hub acceptance, owner activation and the first unassisted fire with report/checkpoint evidence.)*
|
||||
- ! Encode the standing change rule as a policy-nexus guardrail `5dd52156`
|
||||
*(wait: policy-nexus owns guardrail publication; handoff written as PNEX-WP-0006.)*
|
||||
- ! Stop agent-authored index and sync commits `8a3dc219`
|
||||
*(wait: Local guard and repeatable shared-hook installation are implemented. Fleet generator adoption and the required full week of clean history remain unverified; repo-manager owner acceptance is needed.)*
|
||||
- ! Attended window #1 `e3da807f`
|
||||
*(wait: Partly done 2026-10-11: list cut from 14 to 3; U05-U07 accepted, U08 waits on KEY-WP-0040-T01. Remaining founder acts: USER-WP-0026-T03 readback, RPF-WP-0044-T08 coulombcore check, the U08 re-run, and Sol's added RPF-WP-0044-T04 issuer login.)*
|
||||
|
||||
---
|
||||
## MCP Orientation (when available)
|
||||
|
||||
|
|
|
|||
2
SCOPE.md
2
SCOPE.md
|
|
@ -218,7 +218,7 @@ keywords: [git, generated, hooks, work-records, validation]
|
|||
```capability
|
||||
type: tool
|
||||
title: Staged work-record index generation
|
||||
description: make generated-work-records reuses the State Hub renderer on staged Markdown, with explicit repository identity, and stages only WORK-RECORDS.md while refusing unstaged generated-file edits. make generated-work-records-check is read-only. Source adapter and tests are implemented; the shared/local hook supports explicit per-repo adoption, with activity-core, policy-nexus and repo-manager committed. Remaining fleet and other index adoption are still open. See docs/staged-work-record-generation.md.
|
||||
description: make generated-work-records reuses the State Hub renderer on staged Markdown, with explicit repository identity, and stages only WORK-RECORDS.md while refusing unstaged generated-file edits. make generated-work-records-check is read-only. Source adapter and tests are implemented; the shared/local hook supports explicit per-repo adoption, with provider adoption and exact commit receipts tracked in CUST-WP-0079. Other artifact families still need owner automation. See docs/staged-work-record-generation.md.
|
||||
keywords: [git, generated, work-records, staged-sources, validation]
|
||||
```
|
||||
|
||||
|
|
|
|||
|
|
@ -62,4 +62,12 @@ python3 scripts/install_shared_generated_guard.py --repo . --install --enable-ge
|
|||
Unknown hook compositions are refused; existing other hooks and routing remain
|
||||
unchanged. The option does not opt any repository into generation on its own. Source inventories and publication indexes
|
||||
retain their respective owner generators; this adapter generates only the
|
||||
work-record index. Fleet adoption remains an open CUST-WP-0079-T05 obligation.
|
||||
work-record index. Provider adoption receipts are recorded in CUST-WP-0079-T05; other artifact families remain open.
|
||||
|
||||
|
||||
The State Hub owner also exposes `scripts/generate_custodian_brief.py` and
|
||||
`make brief-generate` / `brief-check` with explicit repository path and slug.
|
||||
This separate command reads the current hub projection, performs no Git operations,
|
||||
and preserves the existing brief on unavailable or malformed endpoint reads. It
|
||||
is not part of the staged Markdown hook: it cannot represent unprojected source.
|
||||
Keep historical timestamps when a fresh render fails; do not claim a fresh snapshot.
|
||||
|
|
|
|||
|
|
@ -114,7 +114,7 @@ Canon source written 2026-10-11: `canon/standards/build-mode-change-authorizatio
|
|||
```task
|
||||
id: CUST-WP-0079-T05
|
||||
status: progress
|
||||
blocking_reason: "Staged WORK-RECORDS generation adopted in activity-core, policy-nexus and repo-manager with Custodian activation underway. Remaining security fleet adoption and other owner index generators are still open; the 498-commit local seven-day history check passed."
|
||||
blocking_reason: "Staged WORK-RECORDS generation is adopted across the default security estate and relevant providers. Other artifact families and recurring brief/source-inventory/coordination-frame automation remain open; the 498-commit local seven-day history check passed."
|
||||
priority: medium
|
||||
state_hub_task_id: "8a3dc219-8982-5903-9407-e1b549d4544c"
|
||||
```
|
||||
|
|
@ -292,3 +292,96 @@ coordination-frame receiver through `tools/coordination-frame/render.py`.
|
|||
Historic evidence inventories are not recurring generator outputs. T05 stays
|
||||
open until those applicable owner generation paths and fleet acceptance are
|
||||
verified; the independent schedule, publication and attended gates remain open.
|
||||
|
||||
|
||||
### Fleet WORK-RECORDS adoption and source cleanup — 2026-10-19
|
||||
|
||||
The staged WORK-RECORDS lane is now adopted across every repository in the
|
||||
15-repository default security report estate, plus the relevant implementation
|
||||
providers. Each adopted repository declares its canonical slug, isolated Make
|
||||
recipe and SCOPE boundary. Real commit hooks checked/rendered the staged index;
|
||||
shared generated-only rejection and existing exact-scope secret scans remained
|
||||
in force. No native runtime, credentials, public policy or schedule activation
|
||||
was performed by this adoption.
|
||||
|
||||
Current provider source revisions at clean-checkout verification:
|
||||
|
||||
| Repository | Commit |
|
||||
| --- | --- |
|
||||
| net-kingdom | `4c7f32a` |
|
||||
| railiance-platform | `b06d1f0` |
|
||||
| access-engine | `7eb4e22` |
|
||||
| secrets-engine | `510d292` |
|
||||
| ops-mason | `3457ecf` |
|
||||
| key-cape | `5defa33` |
|
||||
| user-engine | `db05c13` |
|
||||
| tenant-engine | `f94bb5d` |
|
||||
| gate-house | `c7d47f8` |
|
||||
| kings-guard | `5e4942f` |
|
||||
| rapp-policy-nexus | `ff41754` |
|
||||
| activity-core | `7490eb8` |
|
||||
| policy-nexus | `c89364d` |
|
||||
| repo-manager | `05046fb` |
|
||||
| ops-warden | `6ed0e9e` |
|
||||
| railiance-cluster | `4604faf` |
|
||||
| railiance-forge | `9aa2ac6` |
|
||||
| railiance-apps | `a6fe0ab` |
|
||||
| resource-framework (`resource-control`) | `0754009` |
|
||||
| rapp-telemetry | `6015b54` |
|
||||
| railiance-telemetry | `d089325` |
|
||||
| vergabe-watch (`vergabe-teilnahme`) | `17429f8` |
|
||||
| railiance-infra | `5094c30` |
|
||||
| glas-harness | `579cefd` |
|
||||
| rein-codex (`rein-aharness`) | `fb14c38` |
|
||||
|
||||
The first fifteen provider rows were rechecked directly after the final commit;
|
||||
the additional sizing/isolation rows carry their worker completion receipts and
|
||||
root's independent checkout verification. Custodian's own source adoption was
|
||||
committed separately and uses its reviewed local scanner-hook composition.
|
||||
|
||||
Dirty generated indexes were inspected and original snapshots retained under
|
||||
`/tmp/cust79-fleet-adoption/<repo>/`. Platform, Access and King's Guard originals
|
||||
matched the staged owner renderer exactly. NetKingdom and Secrets originals
|
||||
were stale row subsets of current source; regeneration added the missing source
|
||||
records. User Engine's original reflected its pending source handoff, which was
|
||||
reviewed and committed with the derived index rather than discarded.
|
||||
|
||||
Existing unfinished source was inspected and retained: Ops Mason's lock matched
|
||||
its current pyproject (`uv lock --check --offline`) and all 260 tests passed;
|
||||
its lock is now committed. Rapp Policy Nexus passed its nine packaging tests and
|
||||
Helm lint. USER-WP-0035-T02's pending owner handoff was checked against current
|
||||
caller/receiver/provider/portal code and retained with dated source hashes.
|
||||
EMAIL-IN-0001 is durable in email-connect `994db7d` (clean), and NET-IN-0005 is
|
||||
included in `4c7f32a`. Both remain owner preparation requests; they do not prove
|
||||
setup-mail capability or runtime delivery. NetKingdom's pending cadence capture
|
||||
receipts were preserved (3 events, 3 receipts, 588 inventory observations); their
|
||||
record still says independent receiver readback is pending. No current process
|
||||
or cadence acceptance is inferred from those historical files.
|
||||
|
||||
User Engine's typo-suffixed `.claude/settings.local.json.` was inspected and
|
||||
preserved inactive at
|
||||
`/home/worsch/.local/state/custodian-preserved/user-engine/settings.local.json.inactive-2026-10-19`,
|
||||
SHA256 `b70496e3978a7e45304ad6e2042f81953bc8d6ac518aa82fcab36c4e5c754243`.
|
||||
It was not renamed to active settings or used to grant permissions; the location
|
||||
and hash receipt is committed with the source reconciliation.
|
||||
|
||||
State Hub supplied a separate strict rendering-only brief CLI in `09803dc`,
|
||||
with identifier follow-up `f8f9cd9` verified in publication/projection and
|
||||
published capability declaration `eac38b7`. Owner
|
||||
validation passed 17 focused tests and 168 consistency tests on rerun; initial
|
||||
combined-suite database teardown errors are retained in the owner/root report.
|
||||
The CLI does not perform Git operations or Hub writes. Attempts to refresh the
|
||||
five pending security briefs failed closed at `/repo-goals` or `/repos/<slug>`;
|
||||
no replacement snapshot was written. Their existing generated deltas were
|
||||
reviewed against source, retained with their original October 15–18 timestamps,
|
||||
and committed alongside meaningful adoption source. They are historical
|
||||
orientation, not fresh Hub readback. Originals remain in the preservation
|
||||
snapshot. The brief's deliberate Markdown hard-break whitespace was retained.
|
||||
|
||||
T05 remains progress: WORK-RECORDS adoption does not establish automation for
|
||||
hub-derived briefs, Policy Nexus source inventory, or NetKingdom's generated
|
||||
coordination-frame receiver. Those owner generator families and recurring
|
||||
execution remain to be implemented/verified without changing authored source
|
||||
inventory dispositions. T03, T04 and T06 retain their independent schedule,
|
||||
publication and attended acceptance gates. No new owner acceptance is inferred
|
||||
from clean checkouts or the earlier clean seven-day Git window.
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue