docs: preserve reviewed NetKingdom session artifacts
This commit is contained in:
codex
parent
403e218dec
commit
c7bd0a17dd
50 changed files with 4566 additions and 0 deletions
|
|
@ -0,0 +1,71 @@
|
|||
#!/usr/bin/env python3
|
||||
"""Deterministic public-runtime transfer; no runtime launch or network access."""
|
||||
import argparse
|
||||
import gzip
|
||||
import hashlib
|
||||
import importlib.util
|
||||
import io
|
||||
import json
|
||||
import os
|
||||
from pathlib import Path
|
||||
import stat
|
||||
import tarfile
|
||||
|
||||
ROOT = Path('/tmp/netkingdom-runtime-canonical-20261016/runtime')
|
||||
EXPECTED = 'f59959b605a51abd2901becde14e7abd852c2bd3f848004b51d250d1cb81af6d'
|
||||
HERE = Path(__file__).resolve().parent
|
||||
|
||||
|
||||
class CountingHash:
|
||||
def __init__(self, target=None):
|
||||
self.target, self.hash, self.size = target, hashlib.sha256(), 0
|
||||
def write(self, value):
|
||||
self.hash.update(value); self.size += len(value)
|
||||
if self.target: self.target.write(value)
|
||||
return len(value)
|
||||
def flush(self):
|
||||
if self.target: self.target.flush()
|
||||
|
||||
|
||||
def runtime_module():
|
||||
p = HERE/'runtime.py'
|
||||
spec = importlib.util.spec_from_file_location('reviewed_runtime_digest', p)
|
||||
module = importlib.util.module_from_spec(spec); spec.loader.exec_module(module)
|
||||
return module
|
||||
|
||||
|
||||
def build(target=None):
|
||||
if runtime_module().runtime_digest(ROOT) != EXPECTED:
|
||||
raise ValueError('source_runtime_changed')
|
||||
result = CountingHash(target); logical = 0; members = 0
|
||||
with gzip.GzipFile(filename='', mode='wb', compresslevel=6, mtime=0, fileobj=result) as stream:
|
||||
with tarfile.open(fileobj=stream, mode='w|', format=tarfile.PAX_FORMAT) as archive:
|
||||
for p in [ROOT, *sorted(ROOT.rglob('*'))]:
|
||||
s=p.lstat(); name='runtime' + ('/'+p.relative_to(ROOT).as_posix() if p!=ROOT else '')
|
||||
info=tarfile.TarInfo(name);info.uid=1000;info.gid=1000;info.mtime=0;info.mode=stat.S_IMODE(s.st_mode)
|
||||
if stat.S_ISDIR(s.st_mode):info.type=tarfile.DIRTYPE
|
||||
elif stat.S_ISLNK(s.st_mode):
|
||||
info.type=tarfile.SYMTYPE; info.linkname=os.readlink(p)
|
||||
if Path(info.linkname).is_absolute() or not p.resolve(strict=True).is_relative_to(ROOT):
|
||||
raise ValueError('unsafe_runtime_symlink')
|
||||
elif stat.S_ISREG(s.st_mode):info.type=tarfile.REGTYPE; info.size=s.st_size; logical += s.st_size
|
||||
else:raise ValueError('runtime_special_file')
|
||||
with p.open('rb') if stat.S_ISREG(s.st_mode) else io.BytesIO() as data:
|
||||
archive.addfile(info,data if stat.S_ISREG(s.st_mode) else None)
|
||||
members+=1
|
||||
if runtime_module().runtime_digest(ROOT) != EXPECTED:
|
||||
raise ValueError('source_runtime_changed_during_archive')
|
||||
return {'sha256':'sha256:'+result.hash.hexdigest(),'bytes':result.size,'logical_file_bytes':logical,'members':members,
|
||||
'format':'gzip mtime0; PAX tar; sorted tree; root runtime; UID/GID1000; modes and relative symlinks retained'}
|
||||
|
||||
|
||||
def main():
|
||||
parser=argparse.ArgumentParser(description=__doc__);parser.add_argument('--output',type=Path)
|
||||
args=parser.parse_args()
|
||||
if args.output:
|
||||
with args.output.open('xb') as stream:result=build(stream)
|
||||
else:result=build()
|
||||
print(json.dumps(result,sort_keys=True))
|
||||
|
||||
|
||||
if __name__=='__main__':main()
|
||||
|
|
@ -0,0 +1,31 @@
|
|||
#!/usr/bin/env python3
|
||||
"""Conditional cleanup only when the durable receipt proves exec never started."""
|
||||
import argparse,json,shlex,subprocess
|
||||
from pathlib import Path
|
||||
HERE=Path(__file__).resolve().parent
|
||||
|
||||
def main():
|
||||
p=argparse.ArgumentParser(description=__doc__);p.add_argument('--apply',action='store_true');args=p.parse_args()
|
||||
receipt=json.loads((HERE/'execution-receipt.json').read_text())
|
||||
if not (receipt.get('status')=='staging_created' and receipt.get('phase')=='before_transfer'
|
||||
and receipt.get('proposal_id')=='REINAH-WP-0008-T07-install-f599-r1'):
|
||||
raise ValueError('not_a_preexecution_upload_failure')
|
||||
inode=receipt['staging_identity']['inode']
|
||||
if not args.apply:
|
||||
print(json.dumps({'status':'conditional_cleanup_review','inode':inode,'native_mutations':0}));return 0
|
||||
code=r'''import json,os,shutil,stat,sys
|
||||
from pathlib import Path
|
||||
p=Path('/home/tegwick/.helixforge-factory/runtime-install-f599-r1-20261017');s=p.lstat()
|
||||
assert os.getuid()==1000 and os.getgid()==1000 and stat.S_ISDIR(s.st_mode) and s.st_uid==1000 and s.st_gid==1000 and stat.S_IMODE(s.st_mode)==0o700 and s.st_dev==2049 and s.st_ino==int(sys.argv[1])
|
||||
assert {f.name for f in p.iterdir()} <= {'runtime.tar.gz','runtime.py','install-verified.py'}
|
||||
for f in p.iterdir():
|
||||
s=f.lstat();assert stat.S_ISREG(s.st_mode) and s.st_uid==1000 and not stat.S_ISLNK(s.st_mode)
|
||||
shutil.rmtree(p);print(json.dumps({'status':'owned_upload_staging_removed','absent':not p.exists()}))'''
|
||||
cp=subprocess.run(['ssh','-o','BatchMode=yes','-o','ConnectTimeout=15','railiance01','/usr/bin/python3 -I -B -c '+shlex.quote(code)+' '+shlex.quote(str(inode))],capture_output=True,text=True,timeout=30)
|
||||
if cp.returncode:raise RuntimeError('conditional_cleanup_refused_or_uncertain')
|
||||
result=json.loads(cp.stdout);(HERE/'upload-cleanup-receipt.json').write_text(json.dumps(result,indent=2)+'\n');print(json.dumps(result));return 0
|
||||
|
||||
if __name__=='__main__':
|
||||
try:raise SystemExit(main())
|
||||
except Exception as exc:
|
||||
print(json.dumps({'status':'cleanup_refused_or_uncertain','failure_type':type(exc).__name__}));raise SystemExit(1) from None
|
||||
|
|
@ -0,0 +1 @@
|
|||
{"sample_seconds": 0.5, "cpu_busy_fraction": 0.9949748743718593}
|
||||
|
|
@ -0,0 +1 @@
|
|||
{"python_executable": "/usr/bin/python3", "kubectl": "/usr/local/bin/kubectl", "bwrap": "/usr/bin/bwrap", "system_python_resolved": "/usr/bin/python3.12"}
|
||||
|
|
@ -0,0 +1,155 @@
|
|||
#!/usr/bin/env python3
|
||||
"""Install-only orchestration. Default is read-only; --apply requires founder go."""
|
||||
import argparse
|
||||
from datetime import datetime, timezone
|
||||
import hashlib
|
||||
import importlib.util
|
||||
import json
|
||||
import os
|
||||
from pathlib import Path
|
||||
import shlex
|
||||
import subprocess
|
||||
import sys
|
||||
import tempfile
|
||||
|
||||
HERE=Path(__file__).resolve().parent
|
||||
DIGEST='f59959b605a51abd2901becde14e7abd852c2bd3f848004b51d250d1cb81af6d'
|
||||
STAGE='/home/tegwick/.helixforge-factory/runtime-install-f599-r1-20261017'
|
||||
STORE='/home/tegwick/.helixforge-factory/runtimes'
|
||||
SOURCE=Path('/tmp/netkingdom-runtime-canonical-20261016/runtime')
|
||||
|
||||
READ_TARGET=r'''import json,os,pwd,stat,subprocess,shutil,time
|
||||
from pathlib import Path
|
||||
store=Path('/home/tegwick/.helixforge-factory/runtimes'); stage=Path('/home/tegwick/.helixforge-factory/runtime-install-f599-r1-20261017');digest='f59959b605a51abd2901becde14e7abd852c2bd3f848004b51d250d1cb81af6d'
|
||||
def meta(p):
|
||||
try:
|
||||
s=p.lstat();return {'uid':s.st_uid,'gid':s.st_gid,'mode':oct(stat.S_IMODE(s.st_mode)),'device':s.st_dev,'inode':s.st_ino,'directory':stat.S_ISDIR(s.st_mode),'symlink':stat.S_ISLNK(s.st_mode)}
|
||||
except FileNotFoundError:return None
|
||||
cp=subprocess.run(['/usr/local/bin/kubectl','get','nodes','-o','json'],capture_output=True,timeout=20)
|
||||
assert cp.returncode==0
|
||||
nodes=json.loads(cp.stdout)['items'];assert len(nodes)==1
|
||||
mem=dict(x.split(':',1) for x in Path('/proc/meminfo').read_text().splitlines())
|
||||
read_cpu=lambda:[int(x) for x in Path('/proc/stat').read_text().splitlines()[0].split()[1:9]]
|
||||
a=read_cpu();time.sleep(1);b=read_cpu();d=[y-x for x,y in zip(a,b)];busy=1-(d[3]+d[4])/sum(d)
|
||||
print(json.dumps({'account':pwd.getpwuid(os.getuid()).pw_name,'uid':os.getuid(),'gid':os.getgid(),'store':meta(store),'destination':meta(store/digest),'stage':meta(stage),'memory_available_bytes':int(mem['MemAvailable'].split()[0])*1024,'disk_free_bytes':shutil.disk_usage(store).free,'load_average':list(os.getloadavg()),'cpu_count':os.cpu_count(),'cpu_busy_fraction':busy,'cpu_sample_seconds':1,'node_addresses':nodes[0]['status']['addresses'],'node_ready':any(c['type']=='Ready' and c['status']=='True' for c in nodes[0]['status']['conditions'])}))'''
|
||||
|
||||
|
||||
def sha(path):
|
||||
with path.open('rb') as stream:return 'sha256:'+hashlib.file_digest(stream,'sha256').hexdigest()
|
||||
|
||||
|
||||
def command(argv,timeout=60):
|
||||
cp=subprocess.run(argv,stdout=subprocess.PIPE,stderr=subprocess.DEVNULL,timeout=timeout)
|
||||
if cp.returncode:raise RuntimeError('command_failed')
|
||||
return cp.stdout
|
||||
|
||||
|
||||
def ssh(code,args=(),timeout=60):
|
||||
remote='/usr/bin/python3 -I -B -c '+shlex.quote(code)
|
||||
if args:remote+=' '+' '.join(shlex.quote(str(x)) for x in args)
|
||||
return json.loads(command(['ssh','-o','BatchMode=yes','-o','ConnectTimeout=15','railiance01',remote],timeout))
|
||||
|
||||
|
||||
def module(name,path):
|
||||
spec=importlib.util.spec_from_file_location(name,path)
|
||||
result=importlib.util.module_from_spec(spec);spec.loader.exec_module(result);return result
|
||||
|
||||
|
||||
def preflight():
|
||||
inputs=json.loads((HERE/'action-inputs.json').read_text())
|
||||
for name,expected in inputs['helper_hashes'].items():
|
||||
if sha(HERE/name)!=expected:raise ValueError('helper_changed')
|
||||
if module('reviewed_runtime_reader',HERE/'runtime.py').runtime_digest(SOURCE)!=DIGEST:
|
||||
raise ValueError('source_changed')
|
||||
observation=ssh(READ_TARGET)
|
||||
store=observation['store']
|
||||
expected=json.loads((HERE/'target-readonly-observation.json').read_text())['paths'][STORE]
|
||||
checks={
|
||||
'account':observation['account']=='tegwick' and observation['uid']==1000 and observation['gid']==1000,
|
||||
'protected_store':store['uid']==1000 and store['gid']==1000 and store['mode']=='0o700' and store['directory'] and not store['symlink'] and store['device']==expected['device'] and store['inode']==expected['inode'],
|
||||
'destination_absent':observation['destination'] is None,
|
||||
'staging_absent':observation['stage'] is None,
|
||||
'exact_ready_node':observation['node_ready'] and any(x['address']=='92.205.62.239' for x in observation['node_addresses']),
|
||||
'disk_headroom':observation['disk_free_bytes']>=2*1024**3,
|
||||
'memory_headroom':observation['memory_available_bytes']>=1024**3,
|
||||
'load_headroom':observation['load_average'][0]<=2*observation['cpu_count'],
|
||||
'cpu_headroom':observation['cpu_busy_fraction']<=0.85,
|
||||
}
|
||||
observation['checks']=checks
|
||||
return inputs,observation
|
||||
|
||||
|
||||
def save(path,value):
|
||||
fd=os.open(path,os.O_WRONLY|os.O_CREAT|os.O_EXCL|os.O_NOFOLLOW,0o600)
|
||||
with os.fdopen(fd,'w') as stream:json.dump(value,stream,indent=2);stream.write('\n')
|
||||
|
||||
|
||||
def main():
|
||||
parser=argparse.ArgumentParser(description=__doc__)
|
||||
parser.add_argument('--apply',action='store_true');parser.add_argument('--dry-run',action='store_true')
|
||||
args=parser.parse_args()
|
||||
if args.apply and args.dry_run:raise ValueError('conflicting_modes')
|
||||
inputs,observation=preflight()
|
||||
if not args.apply:
|
||||
report={'status':'read_only_dry_run_passed' if all(observation['checks'].values()) else 'read_only_dry_run_blocked','proposal_id':inputs['proposal_id'],'revision':1,
|
||||
'observed_at':datetime.now(timezone.utc).isoformat(),'target':observation,
|
||||
'source_runtime_complete_digest_verified':True,'archive':inputs['archive'],
|
||||
'remote_mutations':0,'provider_calls':0,'private_configuration_reads':False,
|
||||
'next_exact_command':'python3 -I -B '+str(HERE/'execute-install.py')+' --apply'}
|
||||
print(json.dumps(report,sort_keys=True));return 0 if all(observation['checks'].values()) else 2
|
||||
if not all(observation['checks'].values()):raise ValueError('target_headroom_or_identity_refused')
|
||||
receipt=HERE/'execution-receipt.json'
|
||||
if receipt.exists():raise ValueError('prior_attempt_requires_reconciliation')
|
||||
save(receipt,{'status':'intent_recorded','proposal_id':inputs['proposal_id'],'revision':1,
|
||||
'automatic_retry':False,'observed_at':datetime.now(timezone.utc).isoformat()})
|
||||
# No native attempt is retried by this helper. Intent survives an SSH loss.
|
||||
with tempfile.TemporaryDirectory(prefix='nk-runtime-install-r1-') as temporary:
|
||||
archive=Path(temporary)/'runtime.tar.gz'
|
||||
with archive.open('xb') as stream:built=module('reviewed_transfer',HERE/'build-transfer.py').build(stream)
|
||||
if built!=inputs['archive']:raise ValueError('archive_changed')
|
||||
archive.chmod(0o600)
|
||||
create=r'''import json,os,stat,time
|
||||
from pathlib import Path
|
||||
assert os.getuid()==1000 and os.getgid()==1000
|
||||
store=Path('/home/tegwick/.helixforge-factory/runtimes');s=store.lstat()
|
||||
assert stat.S_ISDIR(s.st_mode) and s.st_uid==1000 and stat.S_IMODE(s.st_mode)==0o700 and s.st_ino==4751222 and s.st_dev==2049
|
||||
assert not (store/'f59959b605a51abd2901becde14e7abd852c2bd3f848004b51d250d1cb81af6d').exists()
|
||||
read_cpu=lambda:[int(x) for x in Path('/proc/stat').read_text().splitlines()[0].split()[1:9]]
|
||||
a=read_cpu();time.sleep(1);b=read_cpu();d=[y-x for x,y in zip(a,b)];assert 1-(d[3]+d[4])/sum(d)<=0.85
|
||||
stage=Path('/home/tegwick/.helixforge-factory/runtime-install-f599-r1-20261017');stage.mkdir(mode=0o700)
|
||||
s=stage.lstat();print(json.dumps({'inode':s.st_ino,'device':s.st_dev}))'''
|
||||
created=ssh(create)
|
||||
receipt.write_text(json.dumps({'status':'staging_created','phase':'before_transfer','proposal_id':inputs['proposal_id'],'revision':1,'automatic_retry':False,'staging_identity':created,'staging_path':STAGE},indent=2)+'\n')
|
||||
command(['scp','-q',str(archive),str(HERE/'runtime.py'),str(HERE/'install-verified.py'),'railiance01:'+STAGE+'/'],120)
|
||||
execute=r'''import hashlib,json,os,stat,sys
|
||||
from pathlib import Path
|
||||
stage=Path('/home/tegwick/.helixforge-factory/runtime-install-f599-r1-20261017');s=stage.lstat()
|
||||
assert stat.S_ISDIR(s.st_mode) and s.st_uid==1000 and stat.S_IMODE(s.st_mode)==0o700 and s.st_ino==int(sys.argv[1]) and s.st_dev==2049
|
||||
expected=json.loads(sys.argv[2]);assert {p.name for p in stage.iterdir()}==set(expected)
|
||||
for name,want in expected.items():
|
||||
p=stage/name;s=p.lstat();assert stat.S_ISREG(s.st_mode) and s.st_uid==1000 and not stat.S_ISLNK(s.st_mode)
|
||||
with p.open('rb') as stream:assert hashlib.file_digest(stream,'sha256').hexdigest()==want
|
||||
p.chmod(0o600)
|
||||
os.execve('/usr/bin/python3',['python3','-I','-B',str(stage/'install-verified.py'),'--stage-inode',sys.argv[1]],{'HOME':'/home/tegwick','PATH':'/usr/bin:/bin','LANG':'C.UTF-8','PYTHONDONTWRITEBYTECODE':'1'})'''
|
||||
hashes={'runtime.tar.gz':inputs['archive']['sha256'].removeprefix('sha256:'),
|
||||
'runtime.py':inputs['helper_hashes']['runtime.py'].removeprefix('sha256:'),
|
||||
'install-verified.py':inputs['helper_hashes']['install-verified.py'].removeprefix('sha256:')}
|
||||
# Parse the structured final helper return even when its action failed.
|
||||
remote='/usr/bin/python3 -I -B -c '+shlex.quote(execute)+' '+shlex.quote(str(created['inode']))+' '+shlex.quote(json.dumps(hashes,separators=(',',':')))
|
||||
receipt.write_text(json.dumps({'status':'remote_execution_started','proposal_id':inputs['proposal_id'],'revision':1,'automatic_retry':False,'staging_identity':created,'staging_path':STAGE},indent=2)+'\n')
|
||||
cp=subprocess.run(['ssh','-o','BatchMode=yes','-o','ConnectTimeout=15','railiance01',remote],stdout=subprocess.PIPE,stderr=subprocess.DEVNULL,timeout=600)
|
||||
try:result=json.loads(cp.stdout)
|
||||
except Exception:raise RuntimeError('remote_outcome_uncertain') from None
|
||||
result['ssh_exit_code']=cp.returncode;result['staging_identity']=created
|
||||
# Replace only our exact local intent receipt, never a previous attempt.
|
||||
receipt.write_text(json.dumps(result,indent=2)+'\n');receipt.chmod(0o600)
|
||||
print(json.dumps(result,sort_keys=True))
|
||||
return 0 if cp.returncode==0 and result.get('status')=='installed_and_offline_rehearsal_verified' else 1
|
||||
|
||||
|
||||
if __name__=='__main__':
|
||||
try:raise SystemExit(main())
|
||||
except Exception as exc:
|
||||
print(json.dumps({'status':'failed_or_uncertain','failure_type':type(exc).__name__,
|
||||
'automatic_retry':False,'private_diagnostics_suppressed':True}))
|
||||
raise SystemExit(1) from None
|
||||
|
|
@ -0,0 +1,71 @@
|
|||
{
|
||||
"archive": {
|
||||
"bytes": 109931109,
|
||||
"format": "gzip mtime0; PAX tar; sorted tree; root runtime; UID/GID1000; modes and relative symlinks retained",
|
||||
"logical_file_bytes": 260668241,
|
||||
"members": 1448,
|
||||
"sha256": "sha256:4c55b2740e759175d645705518fc33db30b26b4611f68e052a4ca909173084c7"
|
||||
},
|
||||
"next_exact_command": "python3 -I -B /home/worsch/the-custodian/docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r1/execute-install.py --apply",
|
||||
"observed_at": "2026-10-17T02:35:19.659916+00:00",
|
||||
"private_configuration_reads": false,
|
||||
"process_exit_code": 0,
|
||||
"proposal_id": "REINAH-WP-0008-T07-install-f599-r1",
|
||||
"provider_calls": 0,
|
||||
"remote_mutations": 0,
|
||||
"revision": 1,
|
||||
"source_runtime_complete_digest_verified": true,
|
||||
"status": "read_only_dry_run_passed",
|
||||
"target": {
|
||||
"account": "tegwick",
|
||||
"checks": {
|
||||
"account": true,
|
||||
"cpu_headroom": true,
|
||||
"destination_absent": true,
|
||||
"disk_headroom": true,
|
||||
"exact_ready_node": true,
|
||||
"load_headroom": true,
|
||||
"memory_headroom": true,
|
||||
"protected_store": true,
|
||||
"staging_absent": true
|
||||
},
|
||||
"cpu_busy_fraction": 0.5852417302798982,
|
||||
"cpu_count": 4,
|
||||
"cpu_sample_seconds": 1,
|
||||
"destination": null,
|
||||
"disk_free_bytes": 124211384320,
|
||||
"gid": 1000,
|
||||
"load_average": [
|
||||
5.0595703125,
|
||||
6.404296875,
|
||||
5.111328125
|
||||
],
|
||||
"memory_available_bytes": 7645528064,
|
||||
"node_addresses": [
|
||||
{
|
||||
"address": "92.205.62.239",
|
||||
"type": "InternalIP"
|
||||
},
|
||||
{
|
||||
"address": "2a00:1169:111:6d70::",
|
||||
"type": "InternalIP"
|
||||
},
|
||||
{
|
||||
"address": "239.62.205.92.host.secureserver.net",
|
||||
"type": "Hostname"
|
||||
}
|
||||
],
|
||||
"node_ready": true,
|
||||
"stage": null,
|
||||
"store": {
|
||||
"device": 2049,
|
||||
"directory": true,
|
||||
"gid": 1000,
|
||||
"inode": 4751222,
|
||||
"mode": "0o700",
|
||||
"symlink": false,
|
||||
"uid": 1000
|
||||
},
|
||||
"uid": 1000
|
||||
}
|
||||
}
|
||||
|
|
@ -0,0 +1,213 @@
|
|||
#!/usr/bin/env python3
|
||||
"""Exact install-only action; execute remotely only after founder approval."""
|
||||
import argparse
|
||||
import hashlib
|
||||
import importlib.util
|
||||
import json
|
||||
import os
|
||||
from pathlib import Path, PurePosixPath
|
||||
import pwd
|
||||
import shutil
|
||||
import signal
|
||||
import stat
|
||||
import subprocess
|
||||
import sys
|
||||
import tarfile
|
||||
import time
|
||||
|
||||
DIGEST = 'f59959b605a51abd2901becde14e7abd852c2bd3f848004b51d250d1cb81af6d'
|
||||
ARCHIVE = '4c55b2740e759175d645705518fc33db30b26b4611f68e052a4ca909173084c7'
|
||||
RUNTIME_MODULE = '19b5fb687288bbc836978b0251599dc1e4d1593e8b5efee85a6abb6a7f388412'
|
||||
STORE_MODULE = 'c3d6ec09d08881611d3d02b8f55d68deed6ecfedaa1a809b6b11c57cc4ca97cf'
|
||||
REHEARSAL_MODULE = '192f654cad4a5f065c7faa5e35b03493297a472e8d7fe641be2c42c5fb00dcc3'
|
||||
STAGE = Path('/home/tegwick/.helixforge-factory/runtime-install-f599-r1-20261017')
|
||||
STORE = Path('/home/tegwick/.helixforge-factory/runtimes')
|
||||
DESTINATION = STORE/DIGEST
|
||||
LOGICAL_BYTES = 260668241
|
||||
ARCHIVE_BYTES = 109931109
|
||||
MEMBERS = 1448
|
||||
ENV = {'HOME':'/home/tegwick','PATH':'/usr/bin:/bin','LANG':'C.UTF-8','PYTHONDONTWRITEBYTECODE':'1'}
|
||||
|
||||
|
||||
def require(value, code):
|
||||
if not value: raise ValueError(code)
|
||||
|
||||
|
||||
def file_digest(path):
|
||||
with path.open('rb') as source:return hashlib.file_digest(source,'sha256').hexdigest()
|
||||
|
||||
|
||||
def protected(path, *, directory=False, mode=None):
|
||||
s=path.lstat()
|
||||
require(not stat.S_ISLNK(s.st_mode) and s.st_uid==1000 and s.st_gid==1000,'path_ownership')
|
||||
require(stat.S_ISDIR(s.st_mode) if directory else stat.S_ISREG(s.st_mode),'path_type')
|
||||
require(not stat.S_IMODE(s.st_mode)&0o022,'path_write_mode')
|
||||
if mode is not None:require(stat.S_IMODE(s.st_mode)==mode,'path_exact_mode')
|
||||
return s
|
||||
|
||||
|
||||
def identify():
|
||||
require(os.getuid()==1000 and os.getgid()==1000 and pwd.getpwuid(1000).pw_name=='tegwick','account_identity')
|
||||
for p in (Path('/home/tegwick'),Path('/home/tegwick/.helixforge-factory'),STORE):
|
||||
protected(p,directory=True,mode=0o700 if p!=Path('/home/tegwick') else 0o750)
|
||||
protected(STORE/'.install.lock',mode=0o600)
|
||||
cp=subprocess.run(['/usr/local/bin/kubectl','get','nodes','-o','json'],stdout=subprocess.PIPE,stderr=subprocess.DEVNULL,timeout=20,env=ENV)
|
||||
require(cp.returncode==0,'node_readback')
|
||||
nodes=json.loads(cp.stdout)['items']
|
||||
require(len(nodes)==1 and any(a['address']=='92.205.62.239' for a in nodes[0]['status']['addresses'])
|
||||
and any(c['type']=='Ready' and c['status']=='True' for c in nodes[0]['status']['conditions']),'node_identity')
|
||||
require(shutil.disk_usage(STORE).free >= 2*1024**3,'disk_headroom')
|
||||
mem=dict(x.split(':',1) for x in Path('/proc/meminfo').read_text().splitlines())
|
||||
require(int(mem['MemAvailable'].split()[0])*1024>=1024**3,'memory_headroom')
|
||||
require(os.getloadavg()[0]<=2*(os.cpu_count() or 1),'load_headroom')
|
||||
read_cpu=lambda:[int(x) for x in Path('/proc/stat').read_text().splitlines()[0].split()[1:9]]
|
||||
a=read_cpu();time.sleep(1);b=read_cpu();d=[y-x for x,y in zip(a,b)]
|
||||
require(1-(d[3]+d[4])/sum(d)<=0.85,'cpu_headroom')
|
||||
|
||||
|
||||
def runtime_reader():
|
||||
p=STAGE/'runtime.py';protected(p,mode=0o600)
|
||||
require(file_digest(p)==RUNTIME_MODULE,'runtime_reader_pin')
|
||||
spec=importlib.util.spec_from_file_location('approved_runtime_reader',p)
|
||||
module=importlib.util.module_from_spec(spec);spec.loader.exec_module(module)
|
||||
return module
|
||||
|
||||
|
||||
def extract():
|
||||
archive=STAGE/'runtime.tar.gz';protected(archive,mode=0o600)
|
||||
require(archive.stat().st_size==ARCHIVE_BYTES and file_digest(archive)==ARCHIVE,'archive_pin')
|
||||
root=STAGE/'runtime';require(not root.exists() and not root.is_symlink(),'extraction_already_present')
|
||||
with tarfile.open(archive,mode='r:gz') as tf:
|
||||
members=tf.getmembers();require(len(members)==MEMBERS,'archive_member_count')
|
||||
seen=set(); logical=0
|
||||
for info in members:
|
||||
name=PurePosixPath(info.name)
|
||||
require(not name.is_absolute() and name.parts and name.parts[0]=='runtime'
|
||||
and all(x not in ('','..','.') for x in name.parts),'archive_name')
|
||||
require(info.name not in seen,'archive_duplicate');seen.add(info.name)
|
||||
require(info.uid==1000 and info.gid==1000 and (info.issym() or not info.mode&0o7022),'archive_modes')
|
||||
require(info.isdir() or info.isfile() or info.issym(),'archive_special_member')
|
||||
if info.isfile():logical+=info.size
|
||||
if info.issym():require(not PurePosixPath(info.linkname).is_absolute(),'archive_absolute_symlink')
|
||||
require(logical==LOGICAL_BYTES,'archive_size')
|
||||
# Populate directories and files before any symlink; never traverse an
|
||||
# archive-created symlink while extracting a later member.
|
||||
dirs=[]
|
||||
for info in members:
|
||||
if not info.isdir():continue
|
||||
p=STAGE/info.name;p.mkdir(mode=0o700);dirs.append((p,info.mode))
|
||||
for info in members:
|
||||
if not info.isfile():continue
|
||||
p=STAGE/info.name
|
||||
require(all(not x.is_symlink() for x in (p.parent,*p.parent.parents)),'archive_parent_alias')
|
||||
fd=os.open(p,os.O_WRONLY|os.O_CREAT|os.O_EXCL|os.O_NOFOLLOW,0o600)
|
||||
with os.fdopen(fd,'wb') as target, tf.extractfile(info) as source:
|
||||
shutil.copyfileobj(source,target,1024*1024)
|
||||
p.chmod(info.mode)
|
||||
for info in members:
|
||||
if info.issym():
|
||||
p=STAGE/info.name;p.symlink_to(info.linkname)
|
||||
require(p.resolve(strict=True).is_relative_to(root),'archive_symlink_escape')
|
||||
for p,mode in reversed(dirs):p.chmod(mode)
|
||||
require(runtime_reader().runtime_digest(root)==DIGEST,'extracted_complete_digest')
|
||||
return root
|
||||
|
||||
|
||||
def expired(signum, frame):
|
||||
raise TimeoutError('bounded_stage_deadline')
|
||||
|
||||
|
||||
def install_phase():
|
||||
from sandboxer.extensions import runtime_store, runtime
|
||||
source=STAGE/'runtime'
|
||||
require(Path(runtime_store.__file__).resolve().is_relative_to(source)
|
||||
and file_digest(Path(runtime_store.__file__))==STORE_MODULE,'installer_source_pin')
|
||||
require(Path(runtime.__file__).resolve().is_relative_to(source)
|
||||
and file_digest(Path(runtime.__file__))==RUNTIME_MODULE,'installed_digest_source_pin')
|
||||
require(not DESTINATION.exists() and not DESTINATION.is_symlink(),'destination_not_absent')
|
||||
signal.signal(signal.SIGALRM,expired);signal.alarm(180)
|
||||
try:result=runtime_store.install_runtime(source,STORE,DIGEST)
|
||||
finally:signal.alarm(0)
|
||||
require(result['runtime']['path']==str(DESTINATION) and not result['reused']
|
||||
and result['profile_activated'] is False and result['credential_delivery_configured'] is False,'installer_result')
|
||||
print(json.dumps({'status':'installed','result':result},sort_keys=True))
|
||||
|
||||
|
||||
def rehearse_phase():
|
||||
from rein_aharness import owner_rehearsal
|
||||
require(Path(owner_rehearsal.__file__).resolve().is_relative_to(DESTINATION)
|
||||
and file_digest(Path(owner_rehearsal.__file__))==REHEARSAL_MODULE,'rehearsal_source_pin')
|
||||
signal.signal(signal.SIGALRM,expired);signal.alarm(240)
|
||||
try:steps=owner_rehearsal.rehearse(DESTINATION)
|
||||
finally:signal.alarm(0)
|
||||
require([x.name for x in steps]==['rein-aharness','glas-harness','claude'],'rehearsal_steps')
|
||||
report={x.name:x.exit_code for x in steps}
|
||||
print(json.dumps({'status':'rehearsed' if all(x.ok for x in steps) else 'rehearsal_failed','steps':report,
|
||||
'model_calls':0,'credential_reads':False,'owner_configuration_read':False},sort_keys=True))
|
||||
return 0 if all(x.ok for x in steps) else 1
|
||||
|
||||
|
||||
def phase(argv, timeout):
|
||||
p=subprocess.run(argv,env=ENV,stdin=subprocess.DEVNULL,stdout=subprocess.PIPE,
|
||||
stderr=subprocess.DEVNULL,timeout=timeout)
|
||||
require(len(p.stdout)<=65536,'phase_output_bound')
|
||||
try:result=json.loads(p.stdout)
|
||||
except Exception:raise ValueError('phase_receipt_unavailable') from None
|
||||
return p.returncode,result
|
||||
|
||||
|
||||
def main():
|
||||
parser=argparse.ArgumentParser(description=__doc__)
|
||||
parser.add_argument('--stage-inode',type=int)
|
||||
parser.add_argument('--phase',choices=('install','rehearse'))
|
||||
args=parser.parse_args()
|
||||
if args.phase=='install':install_phase();return 0
|
||||
if args.phase=='rehearse':return rehearse_phase()
|
||||
receipt={'proposal_id':'REINAH-WP-0008-T07-install-f599-r1','revision':1,'status':'failed',
|
||||
'model_calls':0,'credential_reads':False,'owner_configuration_read':False,
|
||||
'renewal_or_catalog_or_queue_mutation':False,'destination':str(DESTINATION)}
|
||||
identity=None
|
||||
try:
|
||||
observed=protected(STAGE,directory=True,mode=0o700)
|
||||
require(observed.st_ino==args.stage_inode and observed.st_dev==2049,'stage_identity')
|
||||
identity=observed
|
||||
identify()
|
||||
require(not DESTINATION.exists() and not DESTINATION.is_symlink(),'destination_not_absent')
|
||||
require({p.name for p in STAGE.iterdir()}=={'runtime.tar.gz','runtime.py','install-verified.py'},'stage_inventory')
|
||||
os.nice(19)
|
||||
receipt['phase']='extract_and_verify';source=extract()
|
||||
receipt['extracted_complete_digest_verified']=True
|
||||
receipt['phase']='install'
|
||||
code,result=phase([str(source/'bin/python3'),'-I','-B',str(STAGE/'install-verified.py'),'--phase','install'],200)
|
||||
receipt['installation']=result;require(code==0 and result['status']=='installed','installation_failed')
|
||||
require(runtime_reader().runtime_digest(DESTINATION)==DIGEST,'installed_complete_digest')
|
||||
receipt['installed_complete_digest_verified']=True
|
||||
receipt['phase']='offline_rehearsal'
|
||||
code,result=phase([str(DESTINATION/'bin/python3'),'-I','-B',str(STAGE/'install-verified.py'),'--phase','rehearse'],260)
|
||||
receipt['rehearsal']=result;require(code==0 and result['status']=='rehearsed','rehearsal_failed')
|
||||
require(runtime_reader().runtime_digest(DESTINATION)==DIGEST,'post_rehearsal_complete_digest')
|
||||
receipt['post_rehearsal_complete_digest_verified']=True
|
||||
receipt['status']='installed_and_offline_rehearsal_verified'
|
||||
except Exception as exc:
|
||||
receipt['failure_type']=type(exc).__name__
|
||||
if isinstance(exc,ValueError) and str(exc).replace('_','').isalnum():receipt['failure_code']=str(exc)
|
||||
finally:
|
||||
receipt['destination_exists']=DESTINATION.exists() or DESTINATION.is_symlink()
|
||||
if identity is not None:
|
||||
try:
|
||||
current=protected(STAGE,directory=True,mode=0o700)
|
||||
require((current.st_dev,current.st_ino)==(identity.st_dev,identity.st_ino),'cleanup_stage_identity')
|
||||
require({p.name for p in STAGE.iterdir()} <= {'runtime.tar.gz','runtime.py','install-verified.py','runtime'},'cleanup_unexpected_stage_member')
|
||||
shutil.rmtree(STAGE)
|
||||
receipt['owned_staging_removed']=not STAGE.exists() and not STAGE.is_symlink()
|
||||
except Exception:receipt['owned_staging_removed']=False;receipt['status']='failed'
|
||||
else:receipt['owned_staging_removed']=False
|
||||
print(json.dumps(receipt,sort_keys=True))
|
||||
return 0 if receipt['status']=='installed_and_offline_rehearsal_verified' else 1
|
||||
|
||||
|
||||
if __name__=='__main__':
|
||||
try:raise SystemExit(main())
|
||||
except Exception as exc:
|
||||
print(json.dumps({'status':'failed','failure_type':type(exc).__name__,'private_diagnostics_suppressed':True}))
|
||||
raise SystemExit(1) from None
|
||||
|
|
@ -0,0 +1,28 @@
|
|||
#!/usr/bin/env python3
|
||||
"""Local archive roundtrip only; no native execution or runtime launch."""
|
||||
import importlib.util,json,shutil,tempfile
|
||||
from pathlib import Path
|
||||
HERE=Path(__file__).resolve().parent
|
||||
|
||||
def load(name,path):
|
||||
s=importlib.util.spec_from_file_location(name,path);m=importlib.util.module_from_spec(s);s.loader.exec_module(m);return m
|
||||
|
||||
def main():
|
||||
builder=load('transfer_builder',HERE/'build-transfer.py')
|
||||
verifier=load('remote_install_code_review',HERE/'install-verified.py')
|
||||
with tempfile.TemporaryDirectory(prefix='nk-runtime-transfer-check-') as directory:
|
||||
p=Path(directory); archive=p/'runtime.tar.gz'
|
||||
with archive.open('xb') as target:built=builder.build(target)
|
||||
assert built==json.loads((HERE/'transfer-archive.json').read_text())
|
||||
archive.chmod(0o600);shutil.copyfile(HERE/'runtime.py',p/'runtime.py');(p/'runtime.py').chmod(0o600)
|
||||
verifier.STAGE=p
|
||||
extracted=verifier.extract()
|
||||
result={'scope':'local temporary archive roundtrip only','archive_sha256':built['sha256'],
|
||||
'archive_bytes':built['bytes'],'member_count':built['members'],
|
||||
'complete_extracted_digest':verifier.runtime_reader().runtime_digest(extracted),
|
||||
'modes_and_internal_symlinks_preserved':True,'native_actions':0,'runtime_launches':0}
|
||||
assert not p.exists();result['local_temporary_tree_removed']=True
|
||||
(HERE/'local-transfer-verification.json').write_text(json.dumps(result,indent=2)+'\n')
|
||||
print(json.dumps(result))
|
||||
|
||||
if __name__=='__main__':main()
|
||||
|
|
@ -0,0 +1,12 @@
|
|||
{
|
||||
"scope": "local archive extraction function roundtrip; no remote installer or runtime launch",
|
||||
"archive_sha256": "sha256:4c55b2740e759175d645705518fc33db30b26b4611f68e052a4ca909173084c7",
|
||||
"archive_bytes": 109931109,
|
||||
"member_count": 1448,
|
||||
"complete_extracted_digest": "f59959b605a51abd2901becde14e7abd852c2bd3f848004b51d250d1cb81af6d",
|
||||
"modes_and_internal_symlinks_preserved": true,
|
||||
"native_actions": 0,
|
||||
"runtime_launches": 0,
|
||||
"local_temporary_tree_removed": true,
|
||||
"tested_extract_function_sha256": "sha256:6671d4a0d03860e4ed4dd860c5f9405aefdb342f51eb39b6bce7c59bf18c6321"
|
||||
}
|
||||
|
|
@ -0,0 +1,71 @@
|
|||
{
|
||||
"archive": {
|
||||
"bytes": 109931109,
|
||||
"format": "gzip mtime0; PAX tar; sorted tree; root runtime; UID/GID1000; modes and relative symlinks retained",
|
||||
"logical_file_bytes": 260668241,
|
||||
"members": 1448,
|
||||
"sha256": "sha256:4c55b2740e759175d645705518fc33db30b26b4611f68e052a4ca909173084c7"
|
||||
},
|
||||
"next_exact_command": "python3 -I -B /home/worsch/the-custodian/docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r1/execute-install.py --apply",
|
||||
"observed_at": "2026-10-17T02:33:46.370722+00:00",
|
||||
"private_configuration_reads": false,
|
||||
"process_exit_code": 0,
|
||||
"proposal_id": "REINAH-WP-0008-T07-install-f599-r1",
|
||||
"provider_calls": 0,
|
||||
"remote_mutations": 0,
|
||||
"revision": 1,
|
||||
"source_runtime_complete_digest_verified": true,
|
||||
"status": "read_only_dry_run_passed",
|
||||
"target": {
|
||||
"account": "tegwick",
|
||||
"checks": {
|
||||
"account": true,
|
||||
"cpu_headroom": true,
|
||||
"destination_absent": true,
|
||||
"disk_headroom": true,
|
||||
"exact_ready_node": true,
|
||||
"load_headroom": true,
|
||||
"memory_headroom": true,
|
||||
"protected_store": true,
|
||||
"staging_absent": true
|
||||
},
|
||||
"cpu_busy_fraction": 0.3913043478260869,
|
||||
"cpu_count": 4,
|
||||
"cpu_sample_seconds": 1,
|
||||
"destination": null,
|
||||
"disk_free_bytes": 124223250432,
|
||||
"gid": 1000,
|
||||
"load_average": [
|
||||
7.2421875,
|
||||
6.92138671875,
|
||||
5.1103515625
|
||||
],
|
||||
"memory_available_bytes": 7817695232,
|
||||
"node_addresses": [
|
||||
{
|
||||
"address": "92.205.62.239",
|
||||
"type": "InternalIP"
|
||||
},
|
||||
{
|
||||
"address": "2a00:1169:111:6d70::",
|
||||
"type": "InternalIP"
|
||||
},
|
||||
{
|
||||
"address": "239.62.205.92.host.secureserver.net",
|
||||
"type": "Hostname"
|
||||
}
|
||||
],
|
||||
"node_ready": true,
|
||||
"stage": null,
|
||||
"store": {
|
||||
"device": 2049,
|
||||
"directory": true,
|
||||
"gid": 1000,
|
||||
"inode": 4751222,
|
||||
"mode": "0o700",
|
||||
"symlink": false,
|
||||
"uid": 1000
|
||||
},
|
||||
"uid": 1000
|
||||
}
|
||||
}
|
||||
|
|
@ -0,0 +1,20 @@
|
|||
{
|
||||
"source": "actual pre-freeze read-only dry-run tool return retained from session",
|
||||
"observed_at": "2026-10-17T02:32:39.125837+00:00",
|
||||
"status": "read_only_dry_run_blocked",
|
||||
"one_second_cpu_busy_fraction": 0.850632911392405,
|
||||
"load_average": [
|
||||
12.60107421875,
|
||||
7.4990234375,
|
||||
5.14306640625
|
||||
],
|
||||
"cpu_count": 4,
|
||||
"refused_guards": [
|
||||
"cpu_headroom",
|
||||
"load_headroom"
|
||||
],
|
||||
"all_identity_store_absence_disk_memory_guards": true,
|
||||
"remote_mutations": 0,
|
||||
"provider_calls": 0,
|
||||
"later_return": "final-readonly-dry-run.json; does not erase this refusal"
|
||||
}
|
||||
|
|
@ -0,0 +1,52 @@
|
|||
"""Digest-pinned, owner-configured Python runtimes for bwrap."""
|
||||
|
||||
from __future__ import annotations
|
||||
|
||||
import hashlib
|
||||
import json
|
||||
import os
|
||||
import stat
|
||||
from pathlib import Path
|
||||
|
||||
RUNTIME_MOUNT = "/opt/sandboxer/runtime"
|
||||
|
||||
|
||||
def runtime_digest(root: Path) -> str:
|
||||
"""Hash the complete artifact, including modes and internal symlink targets."""
|
||||
if not root.is_absolute() or root.resolve(strict=True) != root or not root.is_dir():
|
||||
raise ValueError("runtime path must be a canonical absolute directory")
|
||||
records = []
|
||||
for path in sorted(root.rglob("*")):
|
||||
mode = path.lstat().st_mode
|
||||
if stat.S_ISLNK(mode):
|
||||
target = os.readlink(path)
|
||||
if Path(target).is_absolute() or not path.resolve(strict=True).is_relative_to(root):
|
||||
raise ValueError("runtime symlink escapes the artifact")
|
||||
value = ["symlink", target]
|
||||
elif stat.S_ISREG(mode):
|
||||
with path.open("rb") as stream:
|
||||
value = ["file", hashlib.file_digest(stream, "sha256").hexdigest()]
|
||||
elif stat.S_ISDIR(mode):
|
||||
value = ["directory"]
|
||||
else:
|
||||
raise ValueError("runtime contains an unsupported special file")
|
||||
records.append([path.relative_to(root).as_posix(), stat.S_IMODE(mode), *value])
|
||||
return hashlib.sha256(json.dumps(records, separators=(",", ":")).encode()).hexdigest()
|
||||
|
||||
|
||||
def verified_runtime(config: dict) -> Path | None:
|
||||
"""Only owner extension configuration can select a runtime artifact."""
|
||||
runtime = config.get("runtime")
|
||||
if runtime is None:
|
||||
return None
|
||||
if not isinstance(runtime, dict) or set(runtime) != {"path", "sha256"}:
|
||||
raise ValueError("runtime requires exactly path and sha256")
|
||||
if not isinstance(runtime["path"], str) or not isinstance(runtime["sha256"], str):
|
||||
raise ValueError("runtime path and sha256 must be strings")
|
||||
root = Path(runtime["path"])
|
||||
if (not (root / "pyvenv.cfg").is_file() or not (root / "bin/python3").is_file()
|
||||
or (root / ".git").exists()):
|
||||
raise ValueError("runtime must be a standalone Python environment, not a checkout")
|
||||
if runtime_digest(root) != runtime["sha256"]:
|
||||
raise ValueError("runtime artifact digest does not match owner configuration")
|
||||
return root
|
||||
|
|
@ -0,0 +1 @@
|
|||
{"python": "3.12.3", "stage_path": "/home/tegwick/.helixforge-factory/runtime-install-f599-r1-20261017", "stage_exists": false}
|
||||
|
|
@ -0,0 +1,125 @@
|
|||
{
|
||||
"account": "tegwick",
|
||||
"bwrap": "/usr/bin/bwrap",
|
||||
"cpu_count": 4,
|
||||
"disk_bytes": {
|
||||
"free": 124361916416,
|
||||
"total": 206900281344,
|
||||
"used": 82521587712
|
||||
},
|
||||
"gid": 1000,
|
||||
"home": "/home/tegwick",
|
||||
"hostname": "239.62.205.92.host.secureserver.net",
|
||||
"load_average": [
|
||||
3.326171875,
|
||||
3.8720703125,
|
||||
3.53125
|
||||
],
|
||||
"memory_bytes": {
|
||||
"MemAvailable": 7864901632,
|
||||
"MemTotal": 16770080768,
|
||||
"SwapFree": 3914285056,
|
||||
"SwapTotal": 4294963200
|
||||
},
|
||||
"nodes": [
|
||||
{
|
||||
"addresses": [
|
||||
{
|
||||
"address": "92.205.62.239",
|
||||
"type": "InternalIP"
|
||||
},
|
||||
{
|
||||
"address": "2a00:1169:111:6d70::",
|
||||
"type": "InternalIP"
|
||||
},
|
||||
{
|
||||
"address": "239.62.205.92.host.secureserver.net",
|
||||
"type": "Hostname"
|
||||
}
|
||||
],
|
||||
"name": "239.62.205.92.host.secureserver.net",
|
||||
"ready": "True"
|
||||
}
|
||||
],
|
||||
"paths": {
|
||||
"/home/tegwick": {
|
||||
"device": 2049,
|
||||
"directory": true,
|
||||
"exists": true,
|
||||
"gid": 1000,
|
||||
"inode": 529950,
|
||||
"mode": "0o750",
|
||||
"regular": false,
|
||||
"symlink": false,
|
||||
"uid": 1000
|
||||
},
|
||||
"/home/tegwick/.helixforge-factory": {
|
||||
"device": 2049,
|
||||
"directory": true,
|
||||
"exists": true,
|
||||
"gid": 1000,
|
||||
"inode": 4751221,
|
||||
"mode": "0o700",
|
||||
"regular": false,
|
||||
"symlink": false,
|
||||
"uid": 1000
|
||||
},
|
||||
"/home/tegwick/.helixforge-factory/runtimes": {
|
||||
"device": 2049,
|
||||
"directory": true,
|
||||
"exists": true,
|
||||
"gid": 1000,
|
||||
"inode": 4751222,
|
||||
"mode": "0o700",
|
||||
"regular": false,
|
||||
"symlink": false,
|
||||
"uid": 1000
|
||||
},
|
||||
"/home/tegwick/.helixforge-factory/runtimes/.install.lock": {
|
||||
"device": 2049,
|
||||
"directory": false,
|
||||
"exists": true,
|
||||
"gid": 1000,
|
||||
"inode": 4751223,
|
||||
"mode": "0o600",
|
||||
"regular": true,
|
||||
"symlink": false,
|
||||
"uid": 1000
|
||||
},
|
||||
"/home/tegwick/.helixforge-factory/runtimes/f59959b605a51abd2901becde14e7abd852c2bd3f848004b51d250d1cb81af6d": {
|
||||
"exists": false
|
||||
},
|
||||
"/run/user/1000": {
|
||||
"device": 47,
|
||||
"directory": true,
|
||||
"exists": true,
|
||||
"gid": 1000,
|
||||
"inode": 1,
|
||||
"mode": "0o700",
|
||||
"regular": false,
|
||||
"symlink": false,
|
||||
"uid": 1000
|
||||
}
|
||||
},
|
||||
"public_sources": {
|
||||
"/home/tegwick/rein-aharness/rein_aharness/owner_rehearsal.py": {
|
||||
"exists": false
|
||||
},
|
||||
"/home/tegwick/sand-boxer/scripts/install-bwrap-runtime.py": {
|
||||
"exists": false
|
||||
},
|
||||
"/home/tegwick/sand-boxer/src/sandboxer/extensions/runtime.py": {
|
||||
"exists": false
|
||||
},
|
||||
"/home/tegwick/sand-boxer/src/sandboxer/extensions/runtime_store.py": {
|
||||
"exists": false
|
||||
}
|
||||
},
|
||||
"store_digest_directories": [
|
||||
"2cfc7b5f5c03318820ed279ab8269a741067ded66a768dcf83565986dd9dfa80",
|
||||
"5371156d2027dde6e8f140cc0a1833c4e90b8c75b3bec862e05f06a957f5fd34",
|
||||
"95c9edb1241788dacdb8471c0bd0f34170ce565e097a455befb57f61ff1272ea",
|
||||
"b6e4e8a429393d68831c996a65c0489664205df969ac9882e581983ec2da4969"
|
||||
],
|
||||
"uid": 1000
|
||||
}
|
||||
|
|
@ -0,0 +1,7 @@
|
|||
{
|
||||
"sha256": "sha256:4c55b2740e759175d645705518fc33db30b26b4611f68e052a4ca909173084c7",
|
||||
"bytes": 109931109,
|
||||
"logical_file_bytes": 260668241,
|
||||
"members": 1448,
|
||||
"format": "gzip mtime0; PAX tar; sorted tree; root runtime; UID/GID1000; modes and relative symlinks retained"
|
||||
}
|
||||
|
|
@ -0,0 +1,14 @@
|
|||
{
|
||||
"status": "read_only_dry_run_passed",
|
||||
"observed_at": "2026-10-17T08:34:38.132187+00:00",
|
||||
"source": "actual root --dry-run tool return",
|
||||
"revision": 2,
|
||||
"source_runtime_complete_digest_verified": true,
|
||||
"all_identity_absence_resource_and_supervision_checks_passed": true,
|
||||
"cpu_busy_fraction": 0.7473958333333333,
|
||||
"load_average_1m": 2.46337890625,
|
||||
"disk_free_bytes": 123358224384,
|
||||
"memory_available_bytes": 7780913152,
|
||||
"remote_mutations": 0,
|
||||
"provider_calls": 0
|
||||
}
|
||||
|
|
@ -0,0 +1,7 @@
|
|||
{
|
||||
"id": "b6abb6ab-b182-4b4f-9f84-79ddc5ad91f3",
|
||||
"status": "open",
|
||||
"decision_type": "pending",
|
||||
"title": "Approve exact install-only runtime f599 proposal revision 2",
|
||||
"proposal_sha256": "44b17589c323e1a966caf6c1b1def123092ee289b929c8ea014bc84109103b1d"
|
||||
}
|
||||
|
|
@ -0,0 +1,23 @@
|
|||
{
|
||||
"schema": "custodian.runtime-install-root-review.v1",
|
||||
"observed_at": "2026-10-17T06:52:15.521924+00:00",
|
||||
"proposal_id": "REINAH-WP-0008-T07-install-f599-r1",
|
||||
"revision": 2,
|
||||
"status": "accepted_for_submission_not_approved",
|
||||
"proposal_sha256": "44b17589c323e1a966caf6c1b1def123092ee289b929c8ea014bc84109103b1d",
|
||||
"manifest_sha256": "aea5dbfe0742fe0bb6c36a41ca7b0d70473683b2731f92cc279d43929e5c35c9",
|
||||
"r1_frozen_and_verified": true,
|
||||
"all_r1_r2_manifest_files_verified": true,
|
||||
"independent_checks": {
|
||||
"command": "python3 -B test_process_supervision.py ProcessSupervisionTests.test_timeout_reaps_session_escaped_descendant_and_retains_sibling ProcessSupervisionTests.test_hard_controller_loss_reaps_descendant_and_retains_stage",
|
||||
"tests": 2,
|
||||
"exit_code": 0,
|
||||
"scope": "actual disposable process trees, no runtime/SSH/bwrap/provider launches"
|
||||
},
|
||||
"source_review": "Existing owner installer and rehearsal callback retained; exact runtime unchanged. Runner bounds descendant ownership through private subreaper/pidfds and parent-death behavior; positive quiescence is required before staging deletion, uncertainty retains staging. Exact proposed helper/argv/archive and existing store guards reviewed.",
|
||||
"runtime_enforcement_or_autopilot_granted": false,
|
||||
"supervision_before_sha256": "4a4b0e61df23f1499916c04d85e61c558df810f43f485abf84792acfbbb66016",
|
||||
"supervision_after_sha256": "d144ae59f67f91639d5c9c9f1b0247af7250abcef2e54fa2b563779924e3f5bf",
|
||||
"fresh_founder_approval_required": true,
|
||||
"native_executed": false
|
||||
}
|
||||
|
|
@ -0,0 +1,29 @@
|
|||
"""Read-only verification of the approved R2 partial install; never launches it."""
|
||||
from pathlib import Path
|
||||
import hashlib
|
||||
import json
|
||||
import shlex
|
||||
import subprocess
|
||||
|
||||
HERE = Path(__file__).resolve().parent
|
||||
R2 = HERE.parent / 'native-runtime-install-r2'
|
||||
reader = (R2 / 'runtime.py').read_text()
|
||||
assert hashlib.sha256(reader.encode()).hexdigest() == '19b5fb687288bbc836978b0251599dc1e4d1593e8b5efee85a6abb6a7f388412'
|
||||
code = reader + '''
|
||||
import pwd
|
||||
digest='f59959b605a51abd2901becde14e7abd852c2bd3f848004b51d250d1cb81af6d'
|
||||
store=Path('/home/tegwick/.helixforge-factory/runtimes');s=store.lstat()
|
||||
assert os.getuid()==1000 and os.getgid()==1000 and pwd.getpwuid(1000).pw_name=='tegwick'
|
||||
assert stat.S_ISDIR(s.st_mode) and s.st_uid==1000 and s.st_gid==1000 and stat.S_IMODE(s.st_mode)==0o700 and s.st_dev==2049 and s.st_ino==4751222
|
||||
destination=store/digest
|
||||
actual=runtime_digest(destination)
|
||||
stage=Path('/home/tegwick/.helixforge-factory/runtime-install-f599-r2-20261017')
|
||||
assert actual==digest and not stage.exists() and not stage.is_symlink()
|
||||
print(json.dumps({'status':'partial_install_verified_read_only','runtime_sha256':actual,'installed_complete_digest_verified':True,'owned_stage_absent':True,'store_uid':s.st_uid,'store_gid':s.st_gid,'store_mode':oct(stat.S_IMODE(s.st_mode)),'runtime_launched':False,'private_configuration_read':False,'profile_or_queue_or_owner_state_changed':False,'native_launcher_acceptance':'unverified_after_failed_R2','model_calls':0}))
|
||||
'''
|
||||
result = subprocess.run(['ssh', '-o', 'BatchMode=yes', '-o', 'ConnectTimeout=15', 'railiance01',
|
||||
'/usr/bin/python3 -I -B -c ' + shlex.quote(code)], capture_output=True, timeout=120)
|
||||
assert result.returncode == 0, 'read-only verification failed; raw diagnostics suppressed'
|
||||
value = json.loads(result.stdout)
|
||||
(HERE / 'installed-partial-verification.json').write_text(json.dumps(value, indent=2) + '\n')
|
||||
print(json.dumps(value))
|
||||
|
|
@ -0,0 +1,14 @@
|
|||
{
|
||||
"workplan_id": "dfadb19b-445e-59c6-bcd6-48e87b912c52",
|
||||
"id": "34d6ec9e-6b78-407b-9053-38dabe3288ef",
|
||||
"topic_id": null,
|
||||
"task_id": null,
|
||||
"decision_id": "bec667cc-15ea-4f87-ae16-111f08562e48",
|
||||
"event_type": "note",
|
||||
"summary": "Founder approved exact verification-only R3 SHA2567d5741ab...5d6b2d30. Fresh read-only preflight verified installed f599 and all other checks but refused CPU headroom: busy0.992481 vs0.85 limit. Zero R3 remote mutations/launcher calls, no execution receipt and no automatic polling/retry. Same-trial completed R2 outcome remains failed/partial; independent readback proves full installed digest and owned staging absence, while the R2 watchdog receipt reports process quiescence (no independent retrospective process classification). User steered active goal to inspect KEY-WP0039 and infrastructure reviews for possible finalization; source approvals/old registration go preserved, actual negative/cleanup acceptance still under review.",
|
||||
"detail": null,
|
||||
"author": "codex",
|
||||
"session_id": null,
|
||||
"created_at": "2026-10-17T11:02:21.658442Z",
|
||||
"workstream_id": "dfadb19b-445e-59c6-bcd6-48e87b912c52"
|
||||
}
|
||||
|
|
@ -0,0 +1,14 @@
|
|||
{
|
||||
"workplan_id": "dfadb19b-445e-59c6-bcd6-48e87b912c52",
|
||||
"id": "80f70ad2-f202-4f42-aede-b0a6a4f7ad4a",
|
||||
"topic_id": null,
|
||||
"task_id": null,
|
||||
"decision_id": "bec667cc-15ea-4f87-ae16-111f08562e48",
|
||||
"event_type": "note",
|
||||
"summary": "Completed exact founder-approved R3 offline verification once after major source publication checks finished and one fresh preflight passedCPU0.6633; originalCPU0.9925read-onlyrefusal retained. All3original empty-egress launchers rein-aharness/glas-harness/claude exit0; f599before/postcompletehashverified. Actualpublicjournal records3deadadoptedzombies reaped and positivequiescence, durable0600nativeprecleanupcheckpoint preserved beforeownedstageremoval. Independentread-onlynativeverification matches checkpointSHA8e6468c2cbb89f1a6feb038d2f53e888d14b1bf4c64f93386e39802cf7916282 to exactlocalprecleanupreconstruction, recheckscompletef599 andstageabsence. Same supervisedtrial succeedsafterrefinement; failedR2receipt/history/nativecauseuncertainty preserved, no unchangedsuccesscredit/autopilot. Zero reinstall/model/provider calls, credential/profile/catalog/queue changes or native16gateclosure. KEY39source tasksdone but T02stillwait: actualdenials/cleanupabsent, KEY38andcodingcustodyprerequisitesopen. Exactcaafe4beHubreadback covers originalKEY37secretsclientonly, not newprobe/codingcustody; standingattendedrule separate. Finalownerbindingauditpendingfinalsourceclarificationsync.",
|
||||
"detail": null,
|
||||
"author": "codex",
|
||||
"session_id": null,
|
||||
"created_at": "2026-10-17T11:41:11.826896Z",
|
||||
"workstream_id": "dfadb19b-445e-59c6-bcd6-48e87b912c52"
|
||||
}
|
||||
File diff suppressed because it is too large
Load diff
File diff suppressed because it is too large
Load diff
|
|
@ -0,0 +1,22 @@
|
|||
{
|
||||
"agent_id": "custodian-codex",
|
||||
"scope": "CUST-WP-0071 and CUST-WP-0073 preparation and founder-authorized Railiance changes",
|
||||
"mode": "supervised",
|
||||
"counts": {
|
||||
"unscored": 12,
|
||||
"total": 23,
|
||||
"outcome_failed": 4,
|
||||
"refinement_or_rescue": 12,
|
||||
"outcome_succeeded": 17,
|
||||
"accepted_unchanged": 8,
|
||||
"adjudicated": 11,
|
||||
"verified_executions": 10,
|
||||
"unchanged_successes": 4,
|
||||
"outcome_not_executed": 2,
|
||||
"accepted_revised": 3
|
||||
},
|
||||
"unchanged_acceptance_rate": 0.7272727272727273,
|
||||
"unchanged_execution_success_rate": 0.4,
|
||||
"authority_granted": false,
|
||||
"note": "Descriptive evidence only; null rates mean no eligible sample. Never promotes an agent."
|
||||
}
|
||||
|
|
@ -0,0 +1,31 @@
|
|||
{
|
||||
"exit_code": 0,
|
||||
"commit": "275e034883882199dca585e4cd3dc34d173270da",
|
||||
"parent": "ceaeef1ee79eeba37e7cacf73ba8aed3357a5e7c",
|
||||
"paths": [
|
||||
"docs/changes/netkingdom-target-2026-10-17/native-gates-r1/native-gate-audit.json",
|
||||
"docs/changes/netkingdom-target-2026-10-17/native-identity-r1/README.md",
|
||||
"docs/changes/netkingdom-target-2026-10-17/native-identity-r1/consumer-proof-plan.md",
|
||||
"docs/changes/netkingdom-target-2026-10-17/native-identity-r1/focused-regressions.stderr.txt",
|
||||
"docs/changes/netkingdom-target-2026-10-17/native-identity-r1/focused-regressions.stdout.txt",
|
||||
"docs/changes/netkingdom-target-2026-10-17/native-identity-r1/hub-readback.json",
|
||||
"docs/changes/netkingdom-target-2026-10-17/native-identity-r1/manifest.json",
|
||||
"docs/changes/netkingdom-target-2026-10-17/native-identity-r1/next-attempt-proposal.json",
|
||||
"docs/changes/netkingdom-target-2026-10-17/native-identity-r1/original-behavior-regression.txt",
|
||||
"docs/changes/netkingdom-target-2026-10-17/native-identity-r1/owner-declaration.template.json",
|
||||
"docs/changes/netkingdom-target-2026-10-17/native-identity-r1/owner-source.patch",
|
||||
"docs/changes/netkingdom-target-2026-10-17/native-identity-r1/postimages/tests/isolated-keycape-native-fixture-manifest.json",
|
||||
"docs/changes/netkingdom-target-2026-10-17/native-identity-r1/postimages/tests/test_isolated_keycape_recovery.py",
|
||||
"docs/changes/netkingdom-target-2026-10-17/native-identity-r1/postimages/tools/bootstrap-recovery/isolated-keycape.py",
|
||||
"docs/changes/netkingdom-target-2026-10-17/native-identity-r1/postimages/workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md",
|
||||
"docs/changes/netkingdom-target-2026-10-17/native-identity-r1/preimages/tests/isolated-keycape-native-fixture-manifest.json",
|
||||
"docs/changes/netkingdom-target-2026-10-17/native-identity-r1/preimages/tests/test_isolated_keycape_recovery.py",
|
||||
"docs/changes/netkingdom-target-2026-10-17/native-identity-r1/preimages/tools/bootstrap-recovery/isolated-keycape.py"
|
||||
],
|
||||
"stdout": "[main 275e034] Record native security preparation and owner checkpoints (1/7)\n 18 files changed, 7262 insertions(+)\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-gates-r1/native-gate-audit.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-identity-r1/README.md\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-identity-r1/consumer-proof-plan.md\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-identity-r1/focused-regressions.stderr.txt\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-identity-r1/focused-regressions.stdout.txt\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-identity-r1/hub-readback.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-identity-r1/manifest.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-identity-r1/next-attempt-proposal.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-identity-r1/original-behavior-regression.txt\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-identity-r1/owner-declaration.template.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-identity-r1/owner-source.patch\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-identity-r1/postimages/tests/isolated-keycape-native-fixture-manifest.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-identity-r1/postimages/tests/test_isolated_keycape_recovery.py\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-identity-r1/postimages/tools/bootstrap-recovery/isolated-keycape.py\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-identity-r1/postimages/workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-identity-r1/preimages/tests/isolated-keycape-native-fixture-manifest.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-identity-r1/preimages/tests/test_isolated_keycape_recovery.py\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-identity-r1/preimages/tools/bootstrap-recovery/isolated-keycape.py\n",
|
||||
"stderr": "{\"blocked_blob_ids\": [], \"scanned_blobs\": 18, \"scanner_sha256\": \"88f91962aa2f93ac6ab281d553b9e125f5197bbbce38f9f2437f7299c32e5509\", \"scanner_version\": \"8.30.1\", \"scope\": \"changed-staged-blobs\", \"status\": \"clean\"}\n",
|
||||
"push_exit_code": 0,
|
||||
"push_stdout": "",
|
||||
"push_stderr": "remote: {\"status\":\"clean\",\"scope\":\"introduced-reachable-git-objects-and-updated-ref-names\",\"scanned_objects\":33,\"scanned_refs\":1,\"scanner_version\":\"8.30.1\"} \nTo forgejo-remote:coulomb/the-custodian.git\n ceaeef1..275e034 main -> main\n",
|
||||
"remote_exact": true
|
||||
}
|
||||
|
|
@ -0,0 +1,31 @@
|
|||
{
|
||||
"exit_code": 0,
|
||||
"commit": "a6eee04d420eb993660c914594f3ceab83b3f567",
|
||||
"parent": "275e034883882199dca585e4cd3dc34d173270da",
|
||||
"paths": [
|
||||
"docs/changes/netkingdom-target-2026-10-17/native-identity-r1/preimages/workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md",
|
||||
"docs/changes/netkingdom-target-2026-10-17/native-identity-r1/refinement-r2/NK-WP-0049.postimage.md",
|
||||
"docs/changes/netkingdom-target-2026-10-17/native-identity-r1/refinement-r2/NK-WP-0049.preimage.md",
|
||||
"docs/changes/netkingdom-target-2026-10-17/native-identity-r1/refinement-r2/manifest.json",
|
||||
"docs/changes/netkingdom-target-2026-10-17/native-identity-r1/refinement-r2/task-refinement.patch",
|
||||
"docs/changes/netkingdom-target-2026-10-17/native-identity-r1/refinement-r2/updated-owner-source.patch",
|
||||
"docs/changes/netkingdom-target-2026-10-17/native-identity-r1/routing-discovery.json",
|
||||
"docs/changes/netkingdom-target-2026-10-17/native-identity-r1/selector-preflight.json",
|
||||
"docs/changes/netkingdom-target-2026-10-17/native-identity-r1/selector-uniqueness.patch",
|
||||
"docs/changes/netkingdom-target-2026-10-17/native-identity-r1/source-references.json",
|
||||
"docs/changes/netkingdom-target-2026-10-17/native-identity-r1/verification.json",
|
||||
"docs/changes/netkingdom-target-2026-10-17/native-registration-r1/assemble_review.py",
|
||||
"docs/changes/netkingdom-target-2026-10-17/native-registration-r1/descriptor-composition.json",
|
||||
"docs/changes/netkingdom-target-2026-10-17/native-registration-r1/manifest.json",
|
||||
"docs/changes/netkingdom-target-2026-10-17/native-registration-r1/original-attempt-review.json",
|
||||
"docs/changes/netkingdom-target-2026-10-17/native-registration-r1/register-client.proposed-descriptor.json",
|
||||
"docs/changes/netkingdom-target-2026-10-17/native-registration-r1/source-manifest.json",
|
||||
"docs/changes/netkingdom-target-2026-10-17/native-registration-r1/source-verification.json"
|
||||
],
|
||||
"stdout": "[main a6eee04] Record native security preparation and owner checkpoints (2/7)\n 18 files changed, 5770 insertions(+)\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-identity-r1/preimages/workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-identity-r1/refinement-r2/NK-WP-0049.postimage.md\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-identity-r1/refinement-r2/NK-WP-0049.preimage.md\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-identity-r1/refinement-r2/manifest.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-identity-r1/refinement-r2/task-refinement.patch\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-identity-r1/refinement-r2/updated-owner-source.patch\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-identity-r1/routing-discovery.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-identity-r1/selector-preflight.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-identity-r1/selector-uniqueness.patch\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-identity-r1/source-references.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-identity-r1/verification.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-registration-r1/assemble_review.py\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-registration-r1/descriptor-composition.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-registration-r1/manifest.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-registration-r1/original-attempt-review.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-registration-r1/register-client.proposed-descriptor.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-registration-r1/source-manifest.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-registration-r1/source-verification.json\n",
|
||||
"stderr": "{\"blocked_blob_ids\": [], \"scanned_blobs\": 18, \"scanner_sha256\": \"88f91962aa2f93ac6ab281d553b9e125f5197bbbce38f9f2437f7299c32e5509\", \"scanner_version\": \"8.30.1\", \"scope\": \"changed-staged-blobs\", \"status\": \"clean\"}\n",
|
||||
"push_exit_code": 0,
|
||||
"push_stdout": "",
|
||||
"push_stderr": "remote: {\"status\":\"clean\",\"scope\":\"introduced-reachable-git-objects-and-updated-ref-names\",\"scanned_objects\":27,\"scanned_refs\":1,\"scanner_version\":\"8.30.1\"} \nTo forgejo-remote:coulomb/the-custodian.git\n 275e034..a6eee04 main -> main\n",
|
||||
"remote_exact": true
|
||||
}
|
||||
|
|
@ -0,0 +1,31 @@
|
|||
{
|
||||
"exit_code": 0,
|
||||
"commit": "b5c80ce59565d2107c4f8eeca8171ce325f53e47",
|
||||
"parent": "a6eee04d420eb993660c914594f3ceab83b3f567",
|
||||
"paths": [
|
||||
"docs/changes/netkingdom-target-2026-10-17/native-registration-r1/summary.json",
|
||||
"docs/changes/netkingdom-target-2026-10-17/native-registration-r1/work-record-proposal.json",
|
||||
"docs/changes/netkingdom-target-2026-10-17/native-registration-refinement-r2/manifest.json",
|
||||
"docs/changes/netkingdom-target-2026-10-17/native-registration-refinement-r2/postimage.md",
|
||||
"docs/changes/netkingdom-target-2026-10-17/native-registration-refinement-r2/preimage.md",
|
||||
"docs/changes/netkingdom-target-2026-10-17/native-registration-refinement-r2/t22-applied-intermediate.md",
|
||||
"docs/changes/netkingdom-target-2026-10-17/native-registration-refinement-r2/workplan.patch",
|
||||
"docs/changes/netkingdom-target-2026-10-17/native-storage-r1/OWNER-REVIEW.md",
|
||||
"docs/changes/netkingdom-target-2026-10-17/native-storage-r1/artifact-manifest.json",
|
||||
"docs/changes/netkingdom-target-2026-10-17/native-storage-r1/identity-provisioner.consumer.PROPOSED.yaml",
|
||||
"docs/changes/netkingdom-target-2026-10-17/native-storage-r1/rapp-identity-provisioner.PROPOSED.yaml",
|
||||
"docs/changes/netkingdom-target-2026-10-17/native-storage-r1/rendered/identity-provisioner.sql",
|
||||
"docs/changes/netkingdom-target-2026-10-17/native-storage-r1/rendered/identity-provisioner.yaml",
|
||||
"docs/changes/netkingdom-target-2026-10-17/native-storage-r1/source-references.json",
|
||||
"docs/changes/netkingdom-target-2026-10-17/native-storage-r1/source-validation.json",
|
||||
"docs/changes/netkingdom-target-2026-10-17/native-runtime-r1/FINAL-PROPOSAL.md",
|
||||
"docs/changes/netkingdom-target-2026-10-17/native-runtime-r1/artifact-manifest.json",
|
||||
"docs/changes/netkingdom-target-2026-10-17/native-runtime-r1/exec-owner.REVIEW.json"
|
||||
],
|
||||
"stdout": "[main b5c80ce] Record native security preparation and owner checkpoints (3/7)\n 18 files changed, 4823 insertions(+)\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-registration-r1/summary.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-registration-r1/work-record-proposal.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-registration-refinement-r2/manifest.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-registration-refinement-r2/postimage.md\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-registration-refinement-r2/preimage.md\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-registration-refinement-r2/t22-applied-intermediate.md\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-registration-refinement-r2/workplan.patch\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-runtime-r1/FINAL-PROPOSAL.md\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-runtime-r1/artifact-manifest.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-runtime-r1/exec-owner.REVIEW.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-storage-r1/OWNER-REVIEW.md\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-storage-r1/artifact-manifest.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-storage-r1/identity-provisioner.consumer.PROPOSED.yaml\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-storage-r1/rapp-identity-provisioner.PROPOSED.yaml\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-storage-r1/rendered/identity-provisioner.sql\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-storage-r1/rendered/identity-provisioner.yaml\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-storage-r1/source-references.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-storage-r1/source-validation.json\n",
|
||||
"stderr": "{\"blocked_blob_ids\": [], \"scanned_blobs\": 18, \"scanner_sha256\": \"88f91962aa2f93ac6ab281d553b9e125f5197bbbce38f9f2437f7299c32e5509\", \"scanner_version\": \"8.30.1\", \"scope\": \"changed-staged-blobs\", \"status\": \"clean\"}\n",
|
||||
"push_exit_code": 0,
|
||||
"push_stdout": "",
|
||||
"push_stderr": "remote: {\"status\":\"clean\",\"scope\":\"introduced-reachable-git-objects-and-updated-ref-names\",\"scanned_objects\":28,\"scanned_refs\":1,\"scanner_version\":\"8.30.1\"} \nTo forgejo-remote:coulomb/the-custodian.git\n a6eee04..b5c80ce main -> main\n",
|
||||
"remote_exact": true
|
||||
}
|
||||
|
|
@ -0,0 +1,31 @@
|
|||
{
|
||||
"exit_code": 0,
|
||||
"commit": "43f88d5f7329c9f8e4554efdacca43f5ca67ce98",
|
||||
"parent": "b5c80ce59565d2107c4f8eeca8171ce325f53e47",
|
||||
"paths": [
|
||||
"docs/changes/netkingdom-target-2026-10-17/native-runtime-r1/one-task.REVIEW.json",
|
||||
"docs/changes/netkingdom-target-2026-10-17/native-runtime-r1/pricing-observation.json",
|
||||
"docs/changes/netkingdom-target-2026-10-17/native-runtime-r1/runtime-pins.json",
|
||||
"docs/changes/netkingdom-target-2026-10-17/native-runtime-r1/source-references.json",
|
||||
"docs/changes/netkingdom-target-2026-10-17/native-runtime-r1/source-review.json",
|
||||
"docs/changes/netkingdom-target-2026-10-17/storage-share-tls-r1/access-need.json",
|
||||
"docs/changes/netkingdom-target-2026-10-17/storage-share-tls-r1/capabilities-evidence.json",
|
||||
"docs/changes/netkingdom-target-2026-10-17/storage-share-tls-r1/findings.json",
|
||||
"docs/changes/netkingdom-target-2026-10-17/storage-share-tls-r1/manifest.json",
|
||||
"docs/changes/netkingdom-target-2026-10-17/storage-share-tls-r1/routing-evidence.json",
|
||||
"docs/changes/netkingdom-target-2026-10-17/storage-share-tls-r1/source-history-followthrough-r2.json",
|
||||
"docs/changes/netkingdom-target-2026-10-17/storage-share-tls-r1/source-references.json",
|
||||
"docs/changes/netkingdom-target-2026-10-17/scanner-response-r1/README.md",
|
||||
"docs/changes/netkingdom-target-2026-10-17/scanner-response-r1/hub-readback.json",
|
||||
"docs/changes/netkingdom-target-2026-10-17/scanner-response-r1/manifest.json",
|
||||
"docs/changes/netkingdom-target-2026-10-17/scanner-response-r1/metadata-handoff.template.json",
|
||||
"docs/changes/netkingdom-target-2026-10-17/scanner-response-r1/rehearsal-cases.json",
|
||||
"docs/changes/netkingdom-target-2026-10-17/scanner-response-r1/review.json"
|
||||
],
|
||||
"stdout": "[main 43f88d5] Record native security preparation and owner checkpoints (4/7)\n 18 files changed, 1068 insertions(+)\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-runtime-r1/one-task.REVIEW.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-runtime-r1/pricing-observation.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-runtime-r1/runtime-pins.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-runtime-r1/source-references.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-runtime-r1/source-review.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/scanner-response-r1/README.md\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/scanner-response-r1/hub-readback.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/scanner-response-r1/manifest.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/scanner-response-r1/metadata-handoff.template.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/scanner-response-r1/rehearsal-cases.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/scanner-response-r1/review.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/storage-share-tls-r1/access-need.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/storage-share-tls-r1/capabilities-evidence.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/storage-share-tls-r1/findings.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/storage-share-tls-r1/manifest.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/storage-share-tls-r1/routing-evidence.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/storage-share-tls-r1/source-history-followthrough-r2.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/storage-share-tls-r1/source-references.json\n",
|
||||
"stderr": "{\"blocked_blob_ids\": [], \"scanned_blobs\": 18, \"scanner_sha256\": \"88f91962aa2f93ac6ab281d553b9e125f5197bbbce38f9f2437f7299c32e5509\", \"scanner_version\": \"8.30.1\", \"scope\": \"changed-staged-blobs\", \"status\": \"clean\"}\n",
|
||||
"push_exit_code": 0,
|
||||
"push_stdout": "",
|
||||
"push_stderr": "remote: {\"status\":\"clean\",\"scope\":\"introduced-reachable-git-objects-and-updated-ref-names\",\"scanned_objects\":26,\"scanned_refs\":1,\"scanner_version\":\"8.30.1\"} \nTo forgejo-remote:coulomb/the-custodian.git\n b5c80ce..43f88d5 main -> main\n",
|
||||
"remote_exact": true
|
||||
}
|
||||
|
|
@ -0,0 +1,31 @@
|
|||
{
|
||||
"exit_code": 0,
|
||||
"commit": "ae055669d0e623040ce4f9ea843e834efa515e91",
|
||||
"parent": "43f88d5f7329c9f8e4554efdacca43f5ca67ce98",
|
||||
"paths": [
|
||||
"docs/changes/netkingdom-target-2026-10-17/scanner-response-r1/source-references.json",
|
||||
"docs/changes/netkingdom-target-2026-10-17/consumer-outage-r1/OWNER-PLAN.md",
|
||||
"docs/changes/netkingdom-target-2026-10-17/consumer-outage-r1/artifact-manifest.json",
|
||||
"docs/changes/netkingdom-target-2026-10-17/consumer-outage-r1/consumer-proof-interface.json",
|
||||
"docs/changes/netkingdom-target-2026-10-17/consumer-outage-r1/consumer-source-manifest.json",
|
||||
"docs/changes/netkingdom-target-2026-10-17/consumer-outage-r1/consumer_contract_observer.py",
|
||||
"docs/changes/netkingdom-target-2026-10-17/consumer-outage-r1/existing-selector-preflight.json",
|
||||
"docs/changes/netkingdom-target-2026-10-17/consumer-outage-r1/source-checks.json",
|
||||
"docs/changes/netkingdom-target-2026-10-17/consumer-outage-r1/source-references.json",
|
||||
"docs/changes/netkingdom-target-2026-10-17/consumer-outage-r1/test_consumer_contract_observer.py",
|
||||
"docs/changes/netkingdom-target-2026-10-17/consumer-outage-owner-followthrough-r1/artifact-manifest.json",
|
||||
"docs/changes/netkingdom-target-2026-10-17/consumer-outage-owner-followthrough-r1/integration-manifest.json",
|
||||
"docs/changes/netkingdom-target-2026-10-17/consumer-outage-owner-followthrough-r1/integration-result.json",
|
||||
"docs/changes/netkingdom-target-2026-10-17/consumer-outage-owner-followthrough-r1/owner-plan.post.md",
|
||||
"docs/changes/netkingdom-target-2026-10-17/consumer-outage-owner-followthrough-r1/publish_owner.py",
|
||||
"docs/changes/netkingdom-target-2026-10-17/consumer-outage-owner-followthrough-r1/secrets-engine-commit.json",
|
||||
"docs/changes/netkingdom-target-2026-10-17/consumer-outage-owner-followthrough-r1/secrets-engine-consistency.json",
|
||||
"docs/changes/netkingdom-target-2026-10-17/consumer-outage-owner-followthrough-r1/secrets-engine-consistency.stderr.txt"
|
||||
],
|
||||
"stdout": "[main ae05566] Record native security preparation and owner checkpoints (5/7)\n 18 files changed, 1278 insertions(+)\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/consumer-outage-owner-followthrough-r1/artifact-manifest.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/consumer-outage-owner-followthrough-r1/integration-manifest.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/consumer-outage-owner-followthrough-r1/integration-result.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/consumer-outage-owner-followthrough-r1/owner-plan.post.md\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/consumer-outage-owner-followthrough-r1/publish_owner.py\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/consumer-outage-owner-followthrough-r1/secrets-engine-commit.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/consumer-outage-owner-followthrough-r1/secrets-engine-consistency.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/consumer-outage-owner-followthrough-r1/secrets-engine-consistency.stderr.txt\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/consumer-outage-r1/OWNER-PLAN.md\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/consumer-outage-r1/artifact-manifest.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/consumer-outage-r1/consumer-proof-interface.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/consumer-outage-r1/consumer-source-manifest.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/consumer-outage-r1/consumer_contract_observer.py\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/consumer-outage-r1/existing-selector-preflight.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/consumer-outage-r1/source-checks.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/consumer-outage-r1/source-references.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/consumer-outage-r1/test_consumer_contract_observer.py\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/scanner-response-r1/source-references.json\n",
|
||||
"stderr": "{\"blocked_blob_ids\": [], \"scanned_blobs\": 18, \"scanner_sha256\": \"88f91962aa2f93ac6ab281d553b9e125f5197bbbce38f9f2437f7299c32e5509\", \"scanner_version\": \"8.30.1\", \"scope\": \"changed-staged-blobs\", \"status\": \"clean\"}\n",
|
||||
"push_exit_code": 0,
|
||||
"push_stdout": "",
|
||||
"push_stderr": "remote: {\"status\":\"clean\",\"scope\":\"introduced-reachable-git-objects-and-updated-ref-names\",\"scanned_objects\":26,\"scanned_refs\":1,\"scanner_version\":\"8.30.1\"} \nTo forgejo-remote:coulomb/the-custodian.git\n 43f88d5..ae05566 main -> main\n",
|
||||
"remote_exact": true
|
||||
}
|
||||
|
|
@ -0,0 +1,31 @@
|
|||
{
|
||||
"exit_code": 0,
|
||||
"commit": "a6d0e1ea3db297010c7cb6a2a05e90291929dcca",
|
||||
"parent": "ae055669d0e623040ce4f9ea843e834efa515e91",
|
||||
"paths": [
|
||||
"docs/changes/netkingdom-target-2026-10-17/consumer-outage-owner-followthrough-r1/secrets-engine-projection.json",
|
||||
"docs/changes/netkingdom-target-2026-10-17/consumer-outage-owner-followthrough-r1/secrets-engine-projection.stderr.txt",
|
||||
"docs/changes/netkingdom-target-2026-10-17/consumer-outage-owner-followthrough-r1/secrets-integration.json",
|
||||
"docs/changes/netkingdom-target-2026-10-17/consumer-outage-owner-followthrough-r1/source.patch",
|
||||
"docs/changes/netkingdom-target-2026-10-17/consumer-outage-owner-followthrough-r1/verification.json",
|
||||
"docs/changes/netkingdom-target-2026-10-17/consumer-outage-owner-followthrough-r1/verified-bindings.json",
|
||||
"docs/changes/netkingdom-target-2026-10-17/consumer-outage-owner-followthrough-r1/workplan.post.md",
|
||||
"docs/changes/netkingdom-target-2026-10-17/consumer-outage-owner-followthrough-r1/workplan.pre.md",
|
||||
"docs/changes/netkingdom-target-2026-10-17/native-source-publication-r1/checkpoint-progress.json",
|
||||
"docs/changes/netkingdom-target-2026-10-17/native-source-publication-r1/commit.json",
|
||||
"docs/changes/netkingdom-target-2026-10-17/native-source-publication-r1/commit.stderr.txt",
|
||||
"docs/changes/netkingdom-target-2026-10-17/native-source-publication-r1/commit.stdout.txt",
|
||||
"docs/changes/netkingdom-target-2026-10-17/native-source-publication-r1/consistency.json",
|
||||
"docs/changes/netkingdom-target-2026-10-17/native-source-publication-r1/consistency.stderr.txt",
|
||||
"docs/changes/netkingdom-target-2026-10-17/native-source-publication-r1/projection.json",
|
||||
"docs/changes/netkingdom-target-2026-10-17/native-source-publication-r1/projection.stderr.txt",
|
||||
"docs/changes/netkingdom-target-2026-10-17/native-source-publication-r1/publish-before-verifier-refinement.py",
|
||||
"docs/changes/netkingdom-target-2026-10-17/native-source-publication-r1/publish.py"
|
||||
],
|
||||
"stdout": "[main a6d0e1e] Record native security preparation and owner checkpoints (6/7)\n 18 files changed, 2334 insertions(+)\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/consumer-outage-owner-followthrough-r1/secrets-engine-projection.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/consumer-outage-owner-followthrough-r1/secrets-engine-projection.stderr.txt\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/consumer-outage-owner-followthrough-r1/secrets-integration.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/consumer-outage-owner-followthrough-r1/source.patch\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/consumer-outage-owner-followthrough-r1/verification.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/consumer-outage-owner-followthrough-r1/verified-bindings.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/consumer-outage-owner-followthrough-r1/workplan.post.md\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/consumer-outage-owner-followthrough-r1/workplan.pre.md\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-source-publication-r1/checkpoint-progress.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-source-publication-r1/commit.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-source-publication-r1/commit.stderr.txt\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-source-publication-r1/commit.stdout.txt\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-source-publication-r1/consistency.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-source-publication-r1/consistency.stderr.txt\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-source-publication-r1/projection.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-source-publication-r1/projection.stderr.txt\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-source-publication-r1/publish-before-verifier-refinement.py\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-source-publication-r1/publish.py\n",
|
||||
"stderr": "{\"blocked_blob_ids\": [], \"scanned_blobs\": 17, \"scanner_sha256\": \"88f91962aa2f93ac6ab281d553b9e125f5197bbbce38f9f2437f7299c32e5509\", \"scanner_version\": \"8.30.1\", \"scope\": \"changed-staged-blobs\", \"status\": \"clean\"}\n",
|
||||
"push_exit_code": 0,
|
||||
"push_stdout": "",
|
||||
"push_stderr": "remote: {\"status\":\"clean\",\"scope\":\"introduced-reachable-git-objects-and-updated-ref-names\",\"scanned_objects\":22,\"scanned_refs\":1,\"scanner_version\":\"8.30.1\"} \nTo forgejo-remote:coulomb/the-custodian.git\n ae05566..a6d0e1e main -> main\n",
|
||||
"remote_exact": true
|
||||
}
|
||||
|
|
@ -0,0 +1,20 @@
|
|||
{
|
||||
"exit_code": 0,
|
||||
"commit": "6f61224f12f0be060d2686f0466c80d7274f77cb",
|
||||
"parent": "a6d0e1ea3db297010c7cb6a2a05e90291929dcca",
|
||||
"paths": [
|
||||
"docs/changes/netkingdom-target-2026-10-17/native-source-publication-r1/publish_custodian.py",
|
||||
"docs/changes/netkingdom-target-2026-10-17/native-source-publication-r1/root-source-review.json",
|
||||
"docs/changes/netkingdom-target-2026-10-17/native-source-publication-r1/verification-refusals.json",
|
||||
"docs/changes/netkingdom-target-2026-10-17/native-source-publication-r1/verified-bindings.json",
|
||||
"docs/netkingdom-target-implementation.md",
|
||||
"workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md",
|
||||
"docs/changes/netkingdom-target-2026-10-17/native-source-publication-r1/custodian-publication-inputs.json"
|
||||
],
|
||||
"stdout": "[main 6f61224] Record native security preparation and owner checkpoints (7/7)\n 7 files changed, 1046 insertions(+)\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-source-publication-r1/custodian-publication-inputs.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-source-publication-r1/publish_custodian.py\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-source-publication-r1/root-source-review.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-source-publication-r1/verification-refusals.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-source-publication-r1/verified-bindings.json\n",
|
||||
"stderr": "{\"blocked_blob_ids\": [], \"scanned_blobs\": 7, \"scanner_sha256\": \"88f91962aa2f93ac6ab281d553b9e125f5197bbbce38f9f2437f7299c32e5509\", \"scanner_version\": \"8.30.1\", \"scope\": \"changed-staged-blobs\", \"status\": \"clean\"}\n",
|
||||
"push_exit_code": 0,
|
||||
"push_stdout": "",
|
||||
"push_stderr": "remote: {\"status\":\"clean\",\"scope\":\"introduced-reachable-git-objects-and-updated-ref-names\",\"scanned_objects\":14,\"scanned_refs\":1,\"scanner_version\":\"8.30.1\"} \nTo forgejo-remote:coulomb/the-custodian.git\n a6d0e1e..6f61224 main -> main\n",
|
||||
"remote_exact": true
|
||||
}
|
||||
|
|
@ -0,0 +1,130 @@
|
|||
{
|
||||
"repo_slug": "the-custodian",
|
||||
"repo_path": "/home/worsch/the-custodian",
|
||||
"source_revision": "6f61224f12f0be060d2686f0466c80d7274f77cb",
|
||||
"source_revision_reason": null,
|
||||
"issues": [
|
||||
{
|
||||
"severity": "WARN",
|
||||
"check_id": "C-35",
|
||||
"message": "Repo Manager warning: workplans/: repository uses more than one workplan prefix: ['CUST-WP', 'THE-WP']",
|
||||
"file_path": "workplans/",
|
||||
"db_id": "",
|
||||
"file_value": "",
|
||||
"db_value": "",
|
||||
"fixable": false
|
||||
},
|
||||
{
|
||||
"severity": "WARN",
|
||||
"check_id": "C-35",
|
||||
"message": "Repo Manager contradictory: workplans/ADHOC-2026-08-25-retired.md: workplan id 'CUST-WP-ADHOC-2026-08-25-RETIRED' is not accepted by the canon kind registry",
|
||||
"file_path": "workplans/ADHOC-2026-08-25-retired.md",
|
||||
"db_id": "",
|
||||
"file_value": "",
|
||||
"db_value": "",
|
||||
"fixable": false
|
||||
},
|
||||
{
|
||||
"severity": "WARN",
|
||||
"check_id": "C-05",
|
||||
"message": "Title drift in 'cust-wp-0010': file='Domain and Repository Goals' db='Workplan Lifecycle Documentation' (file wins)",
|
||||
"file_path": "workplans/CUST-WP-0010b-domain-and-repo-goals.md",
|
||||
"db_id": "def8455a-9de4-4891-a15a-5b09ca98ab1e",
|
||||
"file_value": "Domain and Repository Goals",
|
||||
"db_value": "Workplan Lifecycle Documentation",
|
||||
"fixable": true
|
||||
},
|
||||
{
|
||||
"severity": "WARN",
|
||||
"check_id": "C-20",
|
||||
"message": "Workplan dependency target 'STATE-WP-0092' is not linked to State Hub",
|
||||
"file_path": "workplans/CUST-WP-0072-fleet-flavor-and-depends-on-backfill.md",
|
||||
"db_id": "",
|
||||
"file_value": "STATE-WP-0092",
|
||||
"db_value": "",
|
||||
"fixable": false
|
||||
},
|
||||
{
|
||||
"severity": "WARN",
|
||||
"check_id": "C-40",
|
||||
"message": "blocker satisfied, task still wait: 'CUST-WP-0073-T05' in workplan 'CUST-WP-0073' \u2014 decision 1591daa1-6e85-4dfd-aadd-5a9fe1ef47fa is resolved",
|
||||
"file_path": "workplans/CUST-WP-0073-agent-credential-separation.md#CUST-WP-0073-T05",
|
||||
"db_id": "",
|
||||
"file_value": "1591daa1-6e85-4dfd-aadd-5a9fe1ef47fa",
|
||||
"db_value": "",
|
||||
"fixable": false
|
||||
},
|
||||
{
|
||||
"severity": "WARN",
|
||||
"check_id": "C-39",
|
||||
"message": "Human wait task 'CUST-WP-0079-T06' in workplan 'CUST-WP-0079' has needs_human: true without decision_id \u2014 unrouted human gate",
|
||||
"file_path": "workplans/CUST-WP-0079-deterministic-security-flow.md#CUST-WP-0079-T06",
|
||||
"db_id": "",
|
||||
"file_value": "needs_human: true",
|
||||
"db_value": "",
|
||||
"fixable": false
|
||||
},
|
||||
{
|
||||
"severity": "INFO",
|
||||
"check_id": "C-08",
|
||||
"message": "Closed DB workstream 'cust-wp-0010b' (id=416ff571\u2026, status=finished) has no backing workplan file",
|
||||
"file_path": "",
|
||||
"db_id": "416ff571-18cf-5cb2-9c8b-836f68a301b3",
|
||||
"file_value": "",
|
||||
"db_value": "",
|
||||
"fixable": false
|
||||
},
|
||||
{
|
||||
"severity": "INFO",
|
||||
"check_id": "C-08",
|
||||
"message": "Retired DB workstream 'interactive-the-custodian@retired-20260828' (id=370c2481\u2026, status=finished) has no backing workplan file \u2014 projection tombstone, not live work",
|
||||
"file_path": "",
|
||||
"db_id": "370c2481-6806-41eb-a917-f8874f03184f",
|
||||
"file_value": "",
|
||||
"db_value": "",
|
||||
"fixable": false
|
||||
},
|
||||
{
|
||||
"severity": "INFO",
|
||||
"check_id": "C-08",
|
||||
"message": "Retired DB workstream 'the-custodian-adhoc-2026-07-02@retired-20260827' (id=5c53733b\u2026, status=finished) has no backing workplan file \u2014 projection tombstone, not live work",
|
||||
"file_path": "",
|
||||
"db_id": "5c53733b-c077-4a93-be66-9c3af8f9b6fd",
|
||||
"file_value": "",
|
||||
"db_value": "",
|
||||
"fixable": false
|
||||
},
|
||||
{
|
||||
"severity": "INFO",
|
||||
"check_id": "C-08",
|
||||
"message": "Retired DB workstream 'adhoc-2026-05-02@retired-20260827' (id=3f54ce9c\u2026, status=finished) has no backing workplan file \u2014 projection tombstone, not live work",
|
||||
"file_path": "",
|
||||
"db_id": "3f54ce9c-1f95-42de-894f-0f81a52ba2e8",
|
||||
"file_value": "",
|
||||
"db_value": "",
|
||||
"fixable": false
|
||||
},
|
||||
{
|
||||
"severity": "WARN",
|
||||
"check_id": "C-26",
|
||||
"message": "Workplan id 'THE-WP-0001' uses prefix 'THE-WP' but repo canonical prefix is 'CUST-WP' \u2014 new plans must conform",
|
||||
"file_path": "workplans/THE-WP-0001-federation-interface.md",
|
||||
"db_id": "",
|
||||
"file_value": "THE-WP-0001",
|
||||
"db_value": "CUST-WP",
|
||||
"fixable": false
|
||||
}
|
||||
],
|
||||
"fixes_applied": [
|
||||
"bindings: synced 89/89",
|
||||
"C-05 fixed: workstream def8455a\u2026 title \u2192 'Domain and Repository Goals'",
|
||||
"push: pushed"
|
||||
],
|
||||
"summary": {
|
||||
"fail": 0,
|
||||
"automation_error": 0,
|
||||
"warn": 7,
|
||||
"info": 4
|
||||
},
|
||||
"result": "warn"
|
||||
}
|
||||
|
|
@ -0,0 +1 @@
|
|||
WARN: working-memory commit failed: Generated-only commits rejected: staged
|
||||
|
|
@ -0,0 +1,292 @@
|
|||
{
|
||||
"ok": true,
|
||||
"status": "applied",
|
||||
"repo_slug": "the-custodian",
|
||||
"commit": "6f61224f12f0be060d2686f0466c80d7274f77cb",
|
||||
"requests": 2,
|
||||
"elapsed_ms": 12228.0,
|
||||
"git": {
|
||||
"upstream": "origin/main",
|
||||
"behind": 0,
|
||||
"ahead": 0
|
||||
},
|
||||
"identifiers": {
|
||||
"schema": "repo-manager.identifier-assignment.v1",
|
||||
"ok": true,
|
||||
"executed": true,
|
||||
"repo": "the-custodian",
|
||||
"namespace": "helixforge",
|
||||
"assignments": [],
|
||||
"historical_invalid_identifiers": [
|
||||
{
|
||||
"kind": "workplan",
|
||||
"id": "CUST-WP-ADHOC-2026-08-25-RETIRED",
|
||||
"source": "workplans/ADHOC-2026-08-25-retired.md"
|
||||
}
|
||||
],
|
||||
"historical_identity_collisions": [],
|
||||
"files_changed": []
|
||||
},
|
||||
"receipt": {
|
||||
"schema": "state-hub.repository-projection-reconcile.v1",
|
||||
"instance_role": "primary",
|
||||
"instance_label": "railiance01",
|
||||
"expected_commit": "6f61224f12f0be060d2686f0466c80d7274f77cb",
|
||||
"derived_commit": "6f61224f12f0be060d2686f0466c80d7274f77cb",
|
||||
"outcome": {
|
||||
"schema": "state-hub.projection-reset.v1",
|
||||
"repo_slug": "the-custodian",
|
||||
"commit": "6f61224f12f0be060d2686f0466c80d7274f77cb",
|
||||
"status": "applied",
|
||||
"counts": {
|
||||
"created": 0,
|
||||
"updated": 88,
|
||||
"retired": 0,
|
||||
"refused": 0,
|
||||
"released": 0,
|
||||
"created_tasks": 0,
|
||||
"updated_tasks": 0,
|
||||
"cancelled_tasks": 0,
|
||||
"created_edges": 0,
|
||||
"removed_edges": 0,
|
||||
"unresolved_edges": 0,
|
||||
"external_edges": 13
|
||||
},
|
||||
"created": [],
|
||||
"updated": [
|
||||
"CUST-WP-0000",
|
||||
"CUST-WP-0000b",
|
||||
"CUST-WP-0000c",
|
||||
"CUST-WP-0001",
|
||||
"CUST-WP-0002",
|
||||
"CUST-WP-0004",
|
||||
"CUST-WP-0005",
|
||||
"CUST-WP-0006",
|
||||
"CUST-WP-0007",
|
||||
"CUST-WP-0008",
|
||||
"CUST-WP-0009",
|
||||
"CUST-WP-0010",
|
||||
"CUST-WP-0010b",
|
||||
"CUST-WP-0013",
|
||||
"CUST-WP-0014",
|
||||
"CUST-WP-0015",
|
||||
"CUST-WP-0016",
|
||||
"CUST-WP-0017",
|
||||
"CUST-WP-0017-LEGACY",
|
||||
"CUST-WP-0018",
|
||||
"CUST-WP-0019",
|
||||
"CUST-WP-0020",
|
||||
"CUST-WP-0021",
|
||||
"CUST-WP-0022",
|
||||
"CUST-WP-0023",
|
||||
"CUST-WP-0024",
|
||||
"CUST-WP-0025",
|
||||
"CUST-WP-0026",
|
||||
"CUST-WP-0027",
|
||||
"CUST-WP-0028",
|
||||
"CUST-WP-0029",
|
||||
"CUST-WP-0030",
|
||||
"CUST-WP-0031",
|
||||
"CUST-WP-0032",
|
||||
"CUST-WP-0033",
|
||||
"CUST-WP-0034",
|
||||
"CUST-WP-0035",
|
||||
"CUST-WP-0036",
|
||||
"CUST-WP-0037",
|
||||
"CUST-WP-0039",
|
||||
"CUST-WP-0040",
|
||||
"CUST-WP-0041",
|
||||
"CUST-WP-0043",
|
||||
"CUST-WP-0044",
|
||||
"CUST-WP-0045",
|
||||
"CUST-WP-0046",
|
||||
"CUST-WP-0047",
|
||||
"CUST-WP-0048",
|
||||
"CUST-WP-0049",
|
||||
"CUST-WP-0050",
|
||||
"CUST-WP-0051",
|
||||
"CUST-WP-0052",
|
||||
"CUST-WP-0053",
|
||||
"CUST-WP-0053-LEGACY",
|
||||
"CUST-WP-0054",
|
||||
"CUST-WP-0055",
|
||||
"CUST-WP-0056",
|
||||
"CUST-WP-0057",
|
||||
"CUST-WP-0058",
|
||||
"CUST-WP-0059",
|
||||
"CUST-WP-0060",
|
||||
"CUST-WP-0061",
|
||||
"CUST-WP-0062",
|
||||
"CUST-WP-0063",
|
||||
"CUST-WP-0064",
|
||||
"CUST-WP-0065",
|
||||
"CUST-WP-0066",
|
||||
"CUST-WP-0067",
|
||||
"CUST-WP-0068",
|
||||
"CUST-WP-0069",
|
||||
"CUST-WP-0070",
|
||||
"CUST-WP-0071",
|
||||
"CUST-WP-0072",
|
||||
"CUST-WP-0073",
|
||||
"CUST-WP-0074",
|
||||
"CUST-WP-0075",
|
||||
"CUST-WP-0076",
|
||||
"CUST-WP-0077",
|
||||
"CUST-WP-0078",
|
||||
"CUST-WP-0079",
|
||||
"CUST-WP-0080",
|
||||
"CUST-WP-0081",
|
||||
"CUST-WP-ADHOC-2026-03-29",
|
||||
"CUST-WP-ADHOC-2026-05-02",
|
||||
"CUST-WP-ADHOC-2026-07-02",
|
||||
"CUST-WP-ADHOC-2026-08-25",
|
||||
"CUST-WP-ADHOC-2026-09-06",
|
||||
"THE-WP-0001"
|
||||
],
|
||||
"retired": [],
|
||||
"released": [],
|
||||
"created_tasks": [],
|
||||
"updated_tasks": [],
|
||||
"cancelled_tasks": [],
|
||||
"created_edges": [],
|
||||
"removed_edges": [],
|
||||
"unresolved_edges": [],
|
||||
"external_edges": [
|
||||
{
|
||||
"workplan": "CUST-WP-0071",
|
||||
"from": "CUST-WP-0071-T05",
|
||||
"target": "CUST-WP-0071-T04",
|
||||
"relationship_type": "starts_after",
|
||||
"from_workplan_id": "2249bddb-7524-5add-bd5c-c4163a6ca0f3",
|
||||
"from_task_id": "20ddd4d7-d85d-5b95-bb0a-7b0ca8af76ca",
|
||||
"to_workplan_id": null,
|
||||
"to_task_id": "944f98e2-7e42-5894-925b-752423f3a1cc"
|
||||
},
|
||||
{
|
||||
"workplan": "CUST-WP-0071",
|
||||
"from": "CUST-WP-0071-T03",
|
||||
"target": "CUST-WP-0071-T01",
|
||||
"relationship_type": "starts_after",
|
||||
"from_workplan_id": "2249bddb-7524-5add-bd5c-c4163a6ca0f3",
|
||||
"from_task_id": "6dc67558-eb1e-5bb6-a667-986f884dd495",
|
||||
"to_workplan_id": null,
|
||||
"to_task_id": "4ae8eb8d-f8c5-5256-ae50-c323cfd73d7a"
|
||||
},
|
||||
{
|
||||
"workplan": "CUST-WP-0071",
|
||||
"from": "CUST-WP-0071-T03",
|
||||
"target": "CUST-WP-0071-T02",
|
||||
"relationship_type": "starts_after",
|
||||
"from_workplan_id": "2249bddb-7524-5add-bd5c-c4163a6ca0f3",
|
||||
"from_task_id": "6dc67558-eb1e-5bb6-a667-986f884dd495",
|
||||
"to_workplan_id": null,
|
||||
"to_task_id": "82192370-2fd7-5363-88d2-3c67889d3d68"
|
||||
},
|
||||
{
|
||||
"workplan": "CUST-WP-0071",
|
||||
"from": "CUST-WP-0071-T02",
|
||||
"target": "CUST-WP-0071-T01",
|
||||
"relationship_type": "starts_after",
|
||||
"from_workplan_id": "2249bddb-7524-5add-bd5c-c4163a6ca0f3",
|
||||
"from_task_id": "82192370-2fd7-5363-88d2-3c67889d3d68",
|
||||
"to_workplan_id": null,
|
||||
"to_task_id": "4ae8eb8d-f8c5-5256-ae50-c323cfd73d7a"
|
||||
},
|
||||
{
|
||||
"workplan": "CUST-WP-0071",
|
||||
"from": "CUST-WP-0071-T02",
|
||||
"target": "RAPPS-WP-0014-T03",
|
||||
"relationship_type": "starts_after",
|
||||
"from_workplan_id": "2249bddb-7524-5add-bd5c-c4163a6ca0f3",
|
||||
"from_task_id": "82192370-2fd7-5363-88d2-3c67889d3d68",
|
||||
"to_workplan_id": null,
|
||||
"to_task_id": "dd069c6d-fcc1-5bac-b233-976f2f0d5cd1"
|
||||
},
|
||||
{
|
||||
"workplan": "CUST-WP-0071",
|
||||
"from": "CUST-WP-0071-T04",
|
||||
"target": "CUST-WP-0071-T03",
|
||||
"relationship_type": "starts_after",
|
||||
"from_workplan_id": "2249bddb-7524-5add-bd5c-c4163a6ca0f3",
|
||||
"from_task_id": "944f98e2-7e42-5894-925b-752423f3a1cc",
|
||||
"to_workplan_id": null,
|
||||
"to_task_id": "6dc67558-eb1e-5bb6-a667-986f884dd495"
|
||||
},
|
||||
{
|
||||
"workplan": "CUST-WP-0073",
|
||||
"from": "CUST-WP-0073-T02",
|
||||
"target": "GLAS-WP-0012",
|
||||
"relationship_type": "blocks",
|
||||
"from_workplan_id": "a98a9f34-83b4-5c8c-8107-e05f7806d50d",
|
||||
"from_task_id": "4b88b0b7-dc7e-5612-aa5d-1a08f0530c35",
|
||||
"to_workplan_id": "170bf1ae-337f-5553-8d1e-03b07100e08f",
|
||||
"to_task_id": null
|
||||
},
|
||||
{
|
||||
"workplan": "CUST-WP-0073",
|
||||
"from": "CUST-WP-0073-T04",
|
||||
"target": "CUST-WP-0073-T02",
|
||||
"relationship_type": "starts_after",
|
||||
"from_workplan_id": "a98a9f34-83b4-5c8c-8107-e05f7806d50d",
|
||||
"from_task_id": "90725511-4e31-549f-b567-47feff1a9ca4",
|
||||
"to_workplan_id": null,
|
||||
"to_task_id": "4b88b0b7-dc7e-5612-aa5d-1a08f0530c35"
|
||||
},
|
||||
{
|
||||
"workplan": "CUST-WP-0079",
|
||||
"from": "CUST-WP-0079-T03",
|
||||
"target": "ACTIVITY-WP-0047",
|
||||
"relationship_type": "blocks",
|
||||
"from_workplan_id": "ab288f92-d364-5c24-9362-aee451f266c3",
|
||||
"from_task_id": "1be0569c-221d-5925-a0ff-fd2af88e52b1",
|
||||
"to_workplan_id": "ee97869b-dca2-54c9-aa18-0b479c244fb3",
|
||||
"to_task_id": null
|
||||
},
|
||||
{
|
||||
"workplan": "CUST-WP-0079",
|
||||
"from": "CUST-WP-0079-T04",
|
||||
"target": "PNEX-WP-0006",
|
||||
"relationship_type": "blocks",
|
||||
"from_workplan_id": "ab288f92-d364-5c24-9362-aee451f266c3",
|
||||
"from_task_id": "5dd52156-09a8-5781-b288-99ae822f59a6",
|
||||
"to_workplan_id": "774c5037-a3d0-5e65-893c-d18970acd66a",
|
||||
"to_task_id": null
|
||||
},
|
||||
{
|
||||
"workplan": "CUST-WP-0080",
|
||||
"from": "CUST-WP-0080-T04",
|
||||
"target": "CUST-WP-0080-T03",
|
||||
"relationship_type": "starts_after",
|
||||
"from_workplan_id": "dfadb19b-445e-59c6-bcd6-48e87b912c52",
|
||||
"from_task_id": "82378b0f-7004-5c2f-9683-b356a1227576",
|
||||
"to_workplan_id": null,
|
||||
"to_task_id": "87637402-02f1-57c1-8fbc-4141598af8e3"
|
||||
},
|
||||
{
|
||||
"workplan": "CUST-WP-0080",
|
||||
"from": "CUST-WP-0080-T05",
|
||||
"target": "RPF-WP-0056",
|
||||
"relationship_type": "blocks",
|
||||
"from_workplan_id": "dfadb19b-445e-59c6-bcd6-48e87b912c52",
|
||||
"from_task_id": "ed8b909a-23bf-5e5f-b600-e477fbae136b",
|
||||
"to_workplan_id": "31933d08-c877-5fda-aff9-6220c3705c92",
|
||||
"to_task_id": null
|
||||
},
|
||||
{
|
||||
"workplan": "CUST-WP-0080",
|
||||
"from": "CUST-WP-0080-T05",
|
||||
"target": "RAPP-PLAYWRIGHT-WP-0004",
|
||||
"relationship_type": "blocks",
|
||||
"from_workplan_id": "dfadb19b-445e-59c6-bcd6-48e87b912c52",
|
||||
"from_task_id": "ed8b909a-23bf-5e5f-b600-e477fbae136b",
|
||||
"to_workplan_id": "f9280c40-201e-59b5-a6f0-1aace8e0e2e2",
|
||||
"to_task_id": null
|
||||
}
|
||||
],
|
||||
"refused": [],
|
||||
"notes": [
|
||||
"Preserved bound historical row and task UUIDs: CUST-WP-ADHOC-2026-08-25-RETIRED"
|
||||
]
|
||||
}
|
||||
}
|
||||
}
|
||||
|
|
@ -0,0 +1,85 @@
|
|||
<!-- custodian-brief: generated by fix-consistency — do not edit manually -->
|
||||
# Custodian Brief — net-kingdom
|
||||
|
||||
**Domain:** infotech
|
||||
**Last synced:** 2026-10-16 19:19 UTC
|
||||
**State Hub:** http://127.0.0.1:8000 *(adjust if running on a remote machine)*
|
||||
|
||||
## Active Workstreams
|
||||
|
||||
### Publish the NetKingdom emission-cadence security profile
|
||||
Progress: 5/6 done | workplan_id: `04685f94-1991-5e62-80d2-5669913e99fc`
|
||||
|
||||
**Open tasks:**
|
||||
- ► Bind and hand off the published contract `e3fbc8b8`
|
||||
|
||||
### Register Playwright human and agent consumers through governed identity delivery
|
||||
Progress: 1/3 done | workplan_id: `06ba98d5-609e-5aaa-9bf7-4c4f4460e377`
|
||||
|
||||
**Open tasks:**
|
||||
- ! Verify issuer and real consumer acceptance `5a3aaf57`
|
||||
*(wait: Await owner-scoped registry/custody activation, native cluster authentication and individual transport, then real human and agent acceptance under CUST-WP-0080-T05.)*
|
||||
- ► Deliver custody integration and guarded registration activation `a9dadd07`
|
||||
|
||||
### Remove bootstrap secret output and verify separated recovery custody
|
||||
Progress: 22/31 done | workplan_id: `17d315f0-829e-57c7-85cc-3a7914152804`
|
||||
|
||||
**Open tasks:**
|
||||
- ! Accept remaining recovery and caller evidence and close the G08 handoff `d68cd4d3`
|
||||
*(wait: Await the separately tracked native service proofs, current/legacy caller dispositions and residual-scope decisions; archive recovery, backup activation, independent outage retrieval and guide publication are complete.)*
|
||||
- ! Resolve historical credential and configuration-preserving rotation dispositions `3ea6bf00`
|
||||
*(wait: Await the caller/consumer ledger, current replacement-lane acceptance and explicit credential-owner dispositions; existing exposure-rotation deferral is unchanged.)*
|
||||
- ! Verify current caller and provider admission at their actual boundaries `77aa42be`
|
||||
*(wait: Await the current-caller ledger and exact per-caller owner admission/test inputs; the backup credential grants do not admit unrelated callers.)*
|
||||
- ! Prove retained privacyIDEA token decryption and existing-token MFA `6f8af1a7`
|
||||
*(wait: LLDAP T16, token-material T31 and audit T20 passed; await the exact isolated MFA adapter and owner-selected retained-token/factor inputs.)*
|
||||
- ! Prove restored KeyCape issuer, policy and consumer continuity `141dd773`
|
||||
*(wait: LLDAP recovery T16 passed; await the exact isolated KeyCape adapter/procedure and retained-token MFA proof for the selected flow.)*
|
||||
- ! Prove restored Authelia storage and OIDC continuity `b47f9975`
|
||||
*(wait: LLDAP recovery T16 passed; await the exact isolated Authelia adapter/procedure and private authentication-flow inputs from T15.)*
|
||||
- ► Map current callers, owners and native acceptance gaps `479d6970`
|
||||
- … and 2 more open tasks
|
||||
|
||||
### Establish SecurityCaseTypes so that known security cases are light
|
||||
Progress: 7/9 done | workplan_id: `e31f3f9d-0748-5137-b0a3-7b3ca46a66eb`
|
||||
|
||||
**Open tasks:**
|
||||
- ! T05 — Acknowledge the type through informed-decision `d9b26bcf`
|
||||
*(wait: Type1.2 architecture has a confirmed source-only founder acknowledgment; canonical1.1 remains unchanged/default and the1.2 reference case stays proposed. Needs explicit version selection/reference-source integration without normal admission bypass, closed owner adapters plus global/native receipt verifier (WARDEN-WP-0044-T03), independently verified six-object structural materialization and CCR42 claims/created-only provenance, exact broker/case/source reconciliation, then separately authorized native mint/delivery and attended registry/consumer verification. Source acknowledgment, a bundle or local tests do not prove implemented/materialized/live status.)*
|
||||
- ! T06 — First KnownSecurityCase: Forgejo `c3c9c3ae`
|
||||
*(wait: The next types follow once the first one is proven end to end.)*
|
||||
|
||||
### Define an execution-attribution receipt for Railiance runs
|
||||
Progress: 1/2 done | workplan_id: `e2533f3a-aa43-59b3-bff3-8e64b6149487`
|
||||
|
||||
**Open tasks:**
|
||||
- ! Agree the evidence holder and schema with audit-core and Railiance `963120c1`
|
||||
*(wait: Audit-core accepted evidence custody and published field/admission requirements in AUDIT-WP-0014-T01. Still needs Railiance owner confirmation of exact emitter and wire binding before canonical schema/validator implementation, followed by actual emission/readback and attribution/clock/unknown-case acceptance.)*
|
||||
|
||||
### Enterprise Federation & SAML — Expanded-Mode Keycloak Identity Broker
|
||||
Progress: 1/9 done | workplan_id: `1075448f-d533-5f9e-94b7-c3adfe151a07`
|
||||
|
||||
**Open tasks:**
|
||||
- ! Admit the database consumer `2fe6f100`
|
||||
*(wait: ADR-0009 adoption trigger absent; then railiance-platform/rapp-postgres must admit the database consumer and return backup/restore evidence.)*
|
||||
- ! Package the broker deployment `32d1411b`
|
||||
*(wait: ADR-0009 adoption trigger and named package/runtime owner absent; requires T02 database admission and governed OpenBao/ESO role plus immutable issuer assignment.)*
|
||||
- ! Integrate an upstream identity provider `6697a994`
|
||||
*(wait: Named tenant/upstream IdP owner/federation need absent; requires admitted broker and owner-reviewed tenant-scoped claim mappings plus actual login evidence.)*
|
||||
- ! Define federated assurance `d845380d`
|
||||
*(wait: Adoption trigger absent; requires per-IdP assurance trust mapping and reviewed privileged step-up delivery from issuer/package and access-engine owners.)*
|
||||
- ! Verify IAM conformance and coexistence `9cb7fd93`
|
||||
*(wait: Requires admitted live broker, canonical tenant issuer selection and dedicated test-client conformance/coexistence evidence; adoption trigger absent.)*
|
||||
- ! Enforce tenant and platform boundaries `38998c68`
|
||||
*(wait: Requires tenant-engine tier/issuer ownership and access-engine boundary/freshness enforcement evidence after adoption trigger and broker admission.)*
|
||||
- ! Prove recovery and audit delivery `e5f44ddc`
|
||||
*(wait: Requires admitted database/broker, named recovery and audit owners, off-host restore and observed audit/break-glass receipts; adoption trigger absent.)*
|
||||
- … and 1 more open tasks
|
||||
|
||||
---
|
||||
## MCP Orientation (when available)
|
||||
|
||||
If the state-hub MCP server is reachable, call:
|
||||
`get_domain_summary("infotech")`
|
||||
This provides richer cross-domain context.
|
||||
If the MCP call fails, use this file as your orientation source.
|
||||
|
|
@ -0,0 +1,272 @@
|
|||
# Work Records — net-kingdom
|
||||
|
||||
> Generated by `statehub fix-consistency` (CUST-WP-0061-T04, work-record
|
||||
> stage 3). Do not edit by hand — edit the source file/block listed for
|
||||
> each record and re-run fix-consistency to refresh this index. Archived
|
||||
> workplans are omitted; closed decisions/intakes/engagements stay listed
|
||||
> so recently-resolved work is still visible. [auto]
|
||||
|
||||
| Kind | ID | Status | Lane | Source |
|
||||
| --- | --- | --- | --- | --- |
|
||||
| workplan | NK-WP-ADHOC-2026-07-02 | finished | — | workplans/ADHOC-2026-07-02.md |
|
||||
| workplan | NK-WP-ADHOC-2026-08-14 | finished | — | workplans/ADHOC-2026-08-14.md |
|
||||
| workplan | NK-WP-ADHOC-2026-08-23 | finished | — | workplans/ADHOC-2026-08-23.md |
|
||||
| workplan | NK-WP-ADHOC-2026-10-03 | finished | — | workplans/ADHOC-2026-10-03.md |
|
||||
| workplan | NK-WP-ADHOC-2026-10-10 | finished | — | workplans/ADHOC-2026-10-10.md |
|
||||
| workplan | NK-WP-ADHOC-2026-10-11 | finished | — | workplans/ADHOC-2026-10-11.md |
|
||||
| workplan | NK-WP-ADHOC-2026-10-16 | finished | — | workplans/ADHOC-2026-10-16.md |
|
||||
| workplan | NET-WP-0020 | finished | — | workplans/NET-WP-0020-openbao-unseal-custody-and-ssh-automation.md |
|
||||
| workplan | NK-WP-0009 | finished | — | workplans/NK-WP-0009-netkingdom-security-pattern-tutorials.md |
|
||||
| workplan | NK-WP-0011 | active | — | workplans/NK-WP-0011-enterprise-federation-saml.md |
|
||||
| workplan | NK-WP-0021 | finished | — | workplans/NK-WP-0021-activity-core-ops-sso-operators.md |
|
||||
| workplan | NK-WP-0022 | finished | — | workplans/NK-WP-0022-railiance01-identity-cutover-and-coulombcore-retirement.md |
|
||||
| workplan | NK-WP-0023 | finished | — | workplans/NK-WP-0023-user-engine-portal-platform-integration.md |
|
||||
| workplan | NK-WP-0024 | finished | — | workplans/NK-WP-0024-user-engine-portal-integration-expansion.md |
|
||||
| workplan | NK-WP-0025 | finished | — | workplans/NK-WP-0025-public-self-registration-and-application-jit.md |
|
||||
| workplan | NK-WP-0026 | finished | — | workplans/NK-WP-0026-flex-auth-caller-identity-rollout.md |
|
||||
| workplan | NK-WP-0027 | backlog | — | workplans/NK-WP-0027-reef-placement-reconciliation.md |
|
||||
| workplan | NK-WP-0028 | finished | — | workplans/NK-WP-0028-canon-publication-and-grouping-semantics.md |
|
||||
| workplan | NK-WP-0029 | finished | — | workplans/NK-WP-0029-scope-and-intent-reconciliation.md |
|
||||
| workplan | NK-WP-0030 | finished | — | workplans/NK-WP-0030-deterministic-security-scenario-composition.md |
|
||||
| workplan | NK-WP-0031 | finished | — | workplans/NK-WP-0031-deterministic-posture-feedback.md |
|
||||
| workplan | NK-WP-0032 | finished | — | workplans/NK-WP-0032-openbao-operator-loopback-callback.md |
|
||||
| workplan | NK-WP-0033 | finished | — | workplans/NK-WP-0033-keycape-secret-exposure-rotation.md |
|
||||
| workplan | NK-WP-0034 | finished | — | workplans/NK-WP-0034-verification-that-verifies.md |
|
||||
| workplan | NK-WP-0035 | active | — | workplans/NK-WP-0035-emission-cadence-security-profile.md |
|
||||
| workplan | NK-WP-0036 | finished | — | workplans/NK-WP-0036-restore-user-portal-client-registration.md |
|
||||
| workplan | NK-WP-0037 | finished | — | workplans/NK-WP-0037-vergabe-company-welcome.md |
|
||||
| workplan | NK-WP-0038 | finished | — | workplans/NK-WP-0038-tenant-scoped-identity-lifecycle.md |
|
||||
| workplan | NK-WP-0039 | finished | — | workplans/NK-WP-0039-flex-auth-access-engine-coordinate-intake.md |
|
||||
| workplan | NK-WP-0040 | active | — | workplans/NK-WP-0040-execution-attribution-receipt.md |
|
||||
| workplan | NK-WP-0041 | finished | — | workplans/NK-WP-0041-onboarding-journey-usability.md |
|
||||
| workplan | NK-WP-0042 | finished | — | workplans/NK-WP-0042-workload-mfa-step-up.md |
|
||||
| workplan | NK-WP-0043 | finished | — | workplans/NK-WP-0043-cadence-assessment-and-operating-guidance.md |
|
||||
| workplan | NK-WP-0044 | finished | — | workplans/NK-WP-0044-runbook-packs-for-runbook-tutorials.md |
|
||||
| workplan | NK-WP-0045 | finished | — | workplans/NK-WP-0045-root-grant-custody-record.md |
|
||||
| workplan | NK-WP-0046 | finished | — | workplans/NK-WP-0046-secrets-engine-openbao-client-registration.md |
|
||||
| workplan | NK-WP-0047 | finished | — | workplans/NK-WP-0047-platform-password-reset-mail.md |
|
||||
| workplan | NK-WP-0048 | active | — | workplans/NK-WP-0048-security-case-types.md |
|
||||
| workplan | NK-WP-0049 | active | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| workplan | NK-WP-0050 | active | — | workplans/NK-WP-0050-playwright-consumer-registration.md |
|
||||
| workplan | NK-WP-0051 | finished | — | workplans/NK-WP-0051-sign-in-diagnosis.md |
|
||||
| task | NK-WP-ADHOC-2026-07-02-T01 | done | — | workplans/ADHOC-2026-07-02.md |
|
||||
| task | NK-WP-ADHOC-2026-07-02-T02 | done | — | workplans/ADHOC-2026-07-02.md |
|
||||
| task | NK-WP-ADHOC-2026-08-14-T01 | done | — | workplans/ADHOC-2026-08-14.md |
|
||||
| task | NK-WP-ADHOC-2026-08-14-T02 | done | — | workplans/ADHOC-2026-08-14.md |
|
||||
| task | NK-WP-ADHOC-2026-08-14-T03 | done | — | workplans/ADHOC-2026-08-14.md |
|
||||
| task | NK-WP-ADHOC-2026-08-23-T01 | done | — | workplans/ADHOC-2026-08-23.md |
|
||||
| task | NK-WP-ADHOC-2026-10-03-T01 | done | — | workplans/ADHOC-2026-10-03.md |
|
||||
| task | NK-WP-ADHOC-2026-10-10-T01 | done | — | workplans/ADHOC-2026-10-10.md |
|
||||
| task | NK-WP-ADHOC-2026-10-11-T01 | done | — | workplans/ADHOC-2026-10-11.md |
|
||||
| task | NK-WP-ADHOC-2026-10-11-T02 | done | — | workplans/ADHOC-2026-10-11.md |
|
||||
| task | NK-WP-ADHOC-2026-10-11-T03 | done | — | workplans/ADHOC-2026-10-11.md |
|
||||
| task | NK-WP-ADHOC-2026-10-11-T04 | done | — | workplans/ADHOC-2026-10-11.md |
|
||||
| task | NK-WP-ADHOC-2026-10-11-T05 | done | — | workplans/ADHOC-2026-10-11.md |
|
||||
| task | NK-WP-ADHOC-2026-10-11-T06 | done | — | workplans/ADHOC-2026-10-11.md |
|
||||
| task | NK-WP-ADHOC-2026-10-11-T07 | done | — | workplans/ADHOC-2026-10-11.md |
|
||||
| task | NK-WP-ADHOC-2026-10-16-T01 | done | — | workplans/ADHOC-2026-10-16.md |
|
||||
| task | NET-WP-0020-T01 | done | — | workplans/NET-WP-0020-openbao-unseal-custody-and-ssh-automation.md |
|
||||
| task | NET-WP-0020-T02 | done | — | workplans/NET-WP-0020-openbao-unseal-custody-and-ssh-automation.md |
|
||||
| task | NET-WP-0020-T03 | done | — | workplans/NET-WP-0020-openbao-unseal-custody-and-ssh-automation.md |
|
||||
| task | NET-WP-0020-T04 | done | — | workplans/NET-WP-0020-openbao-unseal-custody-and-ssh-automation.md |
|
||||
| task | NET-WP-0020-T05 | done | — | workplans/NET-WP-0020-openbao-unseal-custody-and-ssh-automation.md |
|
||||
| task | NK-WP-0009-T01 | done | — | workplans/NK-WP-0009-netkingdom-security-pattern-tutorials.md |
|
||||
| task | NK-WP-0009-T02 | done | — | workplans/NK-WP-0009-netkingdom-security-pattern-tutorials.md |
|
||||
| task | NK-WP-0009-T03 | done | — | workplans/NK-WP-0009-netkingdom-security-pattern-tutorials.md |
|
||||
| task | NK-WP-0009-T04 | done | — | workplans/NK-WP-0009-netkingdom-security-pattern-tutorials.md |
|
||||
| task | NK-WP-0009-T05 | done | — | workplans/NK-WP-0009-netkingdom-security-pattern-tutorials.md |
|
||||
| task | NK-WP-0009-T06 | done | — | workplans/NK-WP-0009-netkingdom-security-pattern-tutorials.md |
|
||||
| task | NK-WP-0011-T01 | done | — | workplans/NK-WP-0011-enterprise-federation-saml.md |
|
||||
| task | NK-WP-0011-T02 | wait | — | workplans/NK-WP-0011-enterprise-federation-saml.md |
|
||||
| task | NK-WP-0011-T03 | wait | — | workplans/NK-WP-0011-enterprise-federation-saml.md |
|
||||
| task | NK-WP-0011-T04 | wait | — | workplans/NK-WP-0011-enterprise-federation-saml.md |
|
||||
| task | NK-WP-0011-T05 | wait | — | workplans/NK-WP-0011-enterprise-federation-saml.md |
|
||||
| task | NK-WP-0011-T06 | wait | — | workplans/NK-WP-0011-enterprise-federation-saml.md |
|
||||
| task | NK-WP-0011-T07 | wait | — | workplans/NK-WP-0011-enterprise-federation-saml.md |
|
||||
| task | NK-WP-0011-T08 | wait | — | workplans/NK-WP-0011-enterprise-federation-saml.md |
|
||||
| task | NK-WP-0011-T09 | wait | — | workplans/NK-WP-0011-enterprise-federation-saml.md |
|
||||
| task | NK-WP-0021-T01 | done | — | workplans/NK-WP-0021-activity-core-ops-sso-operators.md |
|
||||
| task | NK-WP-0021-T02 | done | — | workplans/NK-WP-0021-activity-core-ops-sso-operators.md |
|
||||
| task | NK-WP-0021-T03 | done | — | workplans/NK-WP-0021-activity-core-ops-sso-operators.md |
|
||||
| task | NK-WP-0021-T04 | done | — | workplans/NK-WP-0021-activity-core-ops-sso-operators.md |
|
||||
| task | NK-WP-0021-T05 | done | — | workplans/NK-WP-0021-activity-core-ops-sso-operators.md |
|
||||
| task | NK-WP-0022-T01 | done | — | workplans/NK-WP-0022-railiance01-identity-cutover-and-coulombcore-retirement.md |
|
||||
| task | NK-WP-0022-T02 | done | — | workplans/NK-WP-0022-railiance01-identity-cutover-and-coulombcore-retirement.md |
|
||||
| task | NK-WP-0022-T03 | done | — | workplans/NK-WP-0022-railiance01-identity-cutover-and-coulombcore-retirement.md |
|
||||
| task | NK-WP-0022-T04 | done | — | workplans/NK-WP-0022-railiance01-identity-cutover-and-coulombcore-retirement.md |
|
||||
| task | NK-WP-0022-T05 | done | — | workplans/NK-WP-0022-railiance01-identity-cutover-and-coulombcore-retirement.md |
|
||||
| task | NK-WP-0022-T06 | done | — | workplans/NK-WP-0022-railiance01-identity-cutover-and-coulombcore-retirement.md |
|
||||
| task | NK-WP-0022-T07 | done | — | workplans/NK-WP-0022-railiance01-identity-cutover-and-coulombcore-retirement.md |
|
||||
| task | NK-WP-0022-T08 | done | — | workplans/NK-WP-0022-railiance01-identity-cutover-and-coulombcore-retirement.md |
|
||||
| task | NK-WP-0023-T01 | done | — | workplans/NK-WP-0023-user-engine-portal-platform-integration.md |
|
||||
| task | NK-WP-0023-T02 | done | — | workplans/NK-WP-0023-user-engine-portal-platform-integration.md |
|
||||
| task | NK-WP-0023-T03 | done | — | workplans/NK-WP-0023-user-engine-portal-platform-integration.md |
|
||||
| task | NK-WP-0023-T04 | done | — | workplans/NK-WP-0023-user-engine-portal-platform-integration.md |
|
||||
| task | NK-WP-0023-T05 | done | — | workplans/NK-WP-0023-user-engine-portal-platform-integration.md |
|
||||
| task | NK-WP-0023-T06 | done | — | workplans/NK-WP-0023-user-engine-portal-platform-integration.md |
|
||||
| task | NK-WP-0023-T07 | done | — | workplans/NK-WP-0023-user-engine-portal-platform-integration.md |
|
||||
| task | NK-WP-0023-T08 | done | — | workplans/NK-WP-0023-user-engine-portal-platform-integration.md |
|
||||
| task | NK-WP-0024-T01 | done | — | workplans/NK-WP-0024-user-engine-portal-integration-expansion.md |
|
||||
| task | NK-WP-0024-T02 | done | — | workplans/NK-WP-0024-user-engine-portal-integration-expansion.md |
|
||||
| task | NK-WP-0024-T03 | done | — | workplans/NK-WP-0024-user-engine-portal-integration-expansion.md |
|
||||
| task | NK-WP-0024-T04 | done | — | workplans/NK-WP-0024-user-engine-portal-integration-expansion.md |
|
||||
| task | NK-WP-0025-T01 | done | — | workplans/NK-WP-0025-public-self-registration-and-application-jit.md |
|
||||
| task | NK-WP-0025-T02 | done | — | workplans/NK-WP-0025-public-self-registration-and-application-jit.md |
|
||||
| task | NK-WP-0025-T03 | done | — | workplans/NK-WP-0025-public-self-registration-and-application-jit.md |
|
||||
| task | NK-WP-0025-T04 | done | — | workplans/NK-WP-0025-public-self-registration-and-application-jit.md |
|
||||
| task | NK-WP-0025-T05 | done | — | workplans/NK-WP-0025-public-self-registration-and-application-jit.md |
|
||||
| task | NK-WP-0026-T01 | done | — | workplans/NK-WP-0026-flex-auth-caller-identity-rollout.md |
|
||||
| task | NK-WP-0026-T02 | done | — | workplans/NK-WP-0026-flex-auth-caller-identity-rollout.md |
|
||||
| task | NK-WP-0027-T01 | done | — | workplans/NK-WP-0027-reef-placement-reconciliation.md |
|
||||
| task | NK-WP-0027-T02 | todo | — | workplans/NK-WP-0027-reef-placement-reconciliation.md |
|
||||
| task | NK-WP-0027-T03 | todo | — | workplans/NK-WP-0027-reef-placement-reconciliation.md |
|
||||
| task | NK-WP-0027-T04 | done | — | workplans/NK-WP-0027-reef-placement-reconciliation.md |
|
||||
| task | NK-WP-0027-T05 | done | — | workplans/NK-WP-0027-reef-placement-reconciliation.md |
|
||||
| task | NK-WP-0027-T06 | todo | — | workplans/NK-WP-0027-reef-placement-reconciliation.md |
|
||||
| task | NK-WP-0028-T01 | done | — | workplans/NK-WP-0028-canon-publication-and-grouping-semantics.md |
|
||||
| task | NK-WP-0028-T02 | done | — | workplans/NK-WP-0028-canon-publication-and-grouping-semantics.md |
|
||||
| task | NK-WP-0028-T03 | done | — | workplans/NK-WP-0028-canon-publication-and-grouping-semantics.md |
|
||||
| task | NK-WP-0028-T04 | done | — | workplans/NK-WP-0028-canon-publication-and-grouping-semantics.md |
|
||||
| task | NK-WP-0029-T01 | done | — | workplans/NK-WP-0029-scope-and-intent-reconciliation.md |
|
||||
| task | NK-WP-0029-T02 | done | — | workplans/NK-WP-0029-scope-and-intent-reconciliation.md |
|
||||
| task | NK-WP-0029-T03 | done | — | workplans/NK-WP-0029-scope-and-intent-reconciliation.md |
|
||||
| task | NK-WP-0029-T04 | done | — | workplans/NK-WP-0029-scope-and-intent-reconciliation.md |
|
||||
| task | NK-WP-0030-T01 | done | — | workplans/NK-WP-0030-deterministic-security-scenario-composition.md |
|
||||
| task | NK-WP-0030-T02 | done | — | workplans/NK-WP-0030-deterministic-security-scenario-composition.md |
|
||||
| task | NK-WP-0030-T03 | done | — | workplans/NK-WP-0030-deterministic-security-scenario-composition.md |
|
||||
| task | NK-WP-0030-T04 | done | — | workplans/NK-WP-0030-deterministic-security-scenario-composition.md |
|
||||
| task | NK-WP-0030-T05 | done | — | workplans/NK-WP-0030-deterministic-security-scenario-composition.md |
|
||||
| task | NK-WP-0031-T01 | done | — | workplans/NK-WP-0031-deterministic-posture-feedback.md |
|
||||
| task | NK-WP-0031-T02 | done | — | workplans/NK-WP-0031-deterministic-posture-feedback.md |
|
||||
| task | NK-WP-0031-T03 | done | — | workplans/NK-WP-0031-deterministic-posture-feedback.md |
|
||||
| task | NK-WP-0031-T04 | done | — | workplans/NK-WP-0031-deterministic-posture-feedback.md |
|
||||
| task | NK-WP-0031-T05 | done | — | workplans/NK-WP-0031-deterministic-posture-feedback.md |
|
||||
| task | NK-WP-0032-T01 | done | — | workplans/NK-WP-0032-openbao-operator-loopback-callback.md |
|
||||
| task | NK-WP-0032-T02 | done | — | workplans/NK-WP-0032-openbao-operator-loopback-callback.md |
|
||||
| task | NK-WP-0032-T03 | done | — | workplans/NK-WP-0032-openbao-operator-loopback-callback.md |
|
||||
| task | NK-WP-0032-T04 | done | — | workplans/NK-WP-0032-openbao-operator-loopback-callback.md |
|
||||
| task | NK-WP-0033-T01 | done | — | workplans/NK-WP-0033-keycape-secret-exposure-rotation.md |
|
||||
| task | NK-WP-0033-T02 | done | — | workplans/NK-WP-0033-keycape-secret-exposure-rotation.md |
|
||||
| task | NK-WP-0033-T03 | done | — | workplans/NK-WP-0033-keycape-secret-exposure-rotation.md |
|
||||
| task | NK-WP-0033-T04 | done | — | workplans/NK-WP-0033-keycape-secret-exposure-rotation.md |
|
||||
| task | NK-WP-0033-T05 | done | — | workplans/NK-WP-0033-keycape-secret-exposure-rotation.md |
|
||||
| task | NK-WP-0034-T01 | done | — | workplans/NK-WP-0034-verification-that-verifies.md |
|
||||
| task | NK-WP-0034-T02 | done | — | workplans/NK-WP-0034-verification-that-verifies.md |
|
||||
| task | NK-WP-0034-T03 | done | — | workplans/NK-WP-0034-verification-that-verifies.md |
|
||||
| task | NK-WP-0034-T04 | done | — | workplans/NK-WP-0034-verification-that-verifies.md |
|
||||
| task | NK-WP-0035-T01 | done | — | workplans/NK-WP-0035-emission-cadence-security-profile.md |
|
||||
| task | NK-WP-0035-T02 | done | — | workplans/NK-WP-0035-emission-cadence-security-profile.md |
|
||||
| task | NK-WP-0035-T03 | done | — | workplans/NK-WP-0035-emission-cadence-security-profile.md |
|
||||
| task | NK-WP-0035-T04 | progress | — | workplans/NK-WP-0035-emission-cadence-security-profile.md |
|
||||
| task | NK-WP-0035-T05 | done | — | workplans/NK-WP-0035-emission-cadence-security-profile.md |
|
||||
| task | NK-WP-0035-T06 | done | — | workplans/NK-WP-0035-emission-cadence-security-profile.md |
|
||||
| task | NK-WP-0036-T01 | done | — | workplans/NK-WP-0036-restore-user-portal-client-registration.md |
|
||||
| task | NK-WP-0036-T02 | done | — | workplans/NK-WP-0036-restore-user-portal-client-registration.md |
|
||||
| task | NK-WP-0036-T03 | done | — | workplans/NK-WP-0036-restore-user-portal-client-registration.md |
|
||||
| task | NK-WP-0036-T04 | done | — | workplans/NK-WP-0036-restore-user-portal-client-registration.md |
|
||||
| task | NK-WP-0036-T05 | done | — | workplans/NK-WP-0036-restore-user-portal-client-registration.md |
|
||||
| task | NK-WP-0036-T06 | done | — | workplans/NK-WP-0036-restore-user-portal-client-registration.md |
|
||||
| task | NK-WP-0037-T01 | done | — | workplans/NK-WP-0037-vergabe-company-welcome.md |
|
||||
| task | NK-WP-0037-T02 | done | — | workplans/NK-WP-0037-vergabe-company-welcome.md |
|
||||
| task | NK-WP-0038-T01 | done | — | workplans/NK-WP-0038-tenant-scoped-identity-lifecycle.md |
|
||||
| task | NK-WP-0038-T02 | done | — | workplans/NK-WP-0038-tenant-scoped-identity-lifecycle.md |
|
||||
| task | NK-WP-0039-T01 | done | — | workplans/NK-WP-0039-flex-auth-access-engine-coordinate-intake.md |
|
||||
| task | NK-WP-0039-T02 | done | — | workplans/NK-WP-0039-flex-auth-access-engine-coordinate-intake.md |
|
||||
| task | NK-WP-0039-T03 | done | — | workplans/NK-WP-0039-flex-auth-access-engine-coordinate-intake.md |
|
||||
| task | NK-WP-0039-T04 | done | — | workplans/NK-WP-0039-flex-auth-access-engine-coordinate-intake.md |
|
||||
| task | NK-WP-0040-T01 | done | — | workplans/NK-WP-0040-execution-attribution-receipt.md |
|
||||
| task | NK-WP-0040-T02 | wait | — | workplans/NK-WP-0040-execution-attribution-receipt.md |
|
||||
| task | NK-WP-0041-T01 | done | — | workplans/NK-WP-0041-onboarding-journey-usability.md |
|
||||
| task | NK-WP-0041-T02 | done | — | workplans/NK-WP-0041-onboarding-journey-usability.md |
|
||||
| task | NK-WP-0041-T03 | done | — | workplans/NK-WP-0041-onboarding-journey-usability.md |
|
||||
| task | NK-WP-0042-T01 | done | — | workplans/NK-WP-0042-workload-mfa-step-up.md |
|
||||
| task | NK-WP-0042-T02 | cancel | — | workplans/NK-WP-0042-workload-mfa-step-up.md |
|
||||
| task | NK-WP-0043-T01 | done | — | workplans/NK-WP-0043-cadence-assessment-and-operating-guidance.md |
|
||||
| task | NK-WP-0043-T02 | done | — | workplans/NK-WP-0043-cadence-assessment-and-operating-guidance.md |
|
||||
| task | NK-WP-0043-T03 | done | — | workplans/NK-WP-0043-cadence-assessment-and-operating-guidance.md |
|
||||
| task | NK-WP-0044-T01 | done | — | workplans/NK-WP-0044-runbook-packs-for-runbook-tutorials.md |
|
||||
| task | NK-WP-0044-T02 | done | — | workplans/NK-WP-0044-runbook-packs-for-runbook-tutorials.md |
|
||||
| task | NK-WP-0044-T03 | done | — | workplans/NK-WP-0044-runbook-packs-for-runbook-tutorials.md |
|
||||
| task | NK-WP-0044-T04 | done | — | workplans/NK-WP-0044-runbook-packs-for-runbook-tutorials.md |
|
||||
| task | NK-WP-0044-T05 | done | — | workplans/NK-WP-0044-runbook-packs-for-runbook-tutorials.md |
|
||||
| task | NK-WP-0044-T06 | done | — | workplans/NK-WP-0044-runbook-packs-for-runbook-tutorials.md |
|
||||
| task | NK-WP-0044-T07 | done | — | workplans/NK-WP-0044-runbook-packs-for-runbook-tutorials.md |
|
||||
| task | NK-WP-0045-T01 | done | — | workplans/NK-WP-0045-root-grant-custody-record.md |
|
||||
| task | NK-WP-0045-T02 | done | — | workplans/NK-WP-0045-root-grant-custody-record.md |
|
||||
| task | NK-WP-0045-T03 | done | — | workplans/NK-WP-0045-root-grant-custody-record.md |
|
||||
| task | NK-WP-0045-T04 | done | — | workplans/NK-WP-0045-root-grant-custody-record.md |
|
||||
| task | NK-WP-0045-T05 | done | — | workplans/NK-WP-0045-root-grant-custody-record.md |
|
||||
| task | NK-WP-0045-T06 | done | — | workplans/NK-WP-0045-root-grant-custody-record.md |
|
||||
| task | NK-WP-0046-T01 | done | — | workplans/NK-WP-0046-secrets-engine-openbao-client-registration.md |
|
||||
| task | NK-WP-0046-T02 | done | — | workplans/NK-WP-0046-secrets-engine-openbao-client-registration.md |
|
||||
| task | NK-WP-0046-T03 | done | — | workplans/NK-WP-0046-secrets-engine-openbao-client-registration.md |
|
||||
| task | NK-WP-0047-T01 | done | — | workplans/NK-WP-0047-platform-password-reset-mail.md |
|
||||
| task | NK-WP-0047-T02 | done | — | workplans/NK-WP-0047-platform-password-reset-mail.md |
|
||||
| task | NK-WP-0047-T03 | done | — | workplans/NK-WP-0047-platform-password-reset-mail.md |
|
||||
| task | NK-WP-0048-T01 | done | — | workplans/NK-WP-0048-security-case-types.md |
|
||||
| task | NK-WP-0048-T02 | done | — | workplans/NK-WP-0048-security-case-types.md |
|
||||
| task | NK-WP-0048-T03 | done | — | workplans/NK-WP-0048-security-case-types.md |
|
||||
| task | NK-WP-0048-T04 | done | — | workplans/NK-WP-0048-security-case-types.md |
|
||||
| task | NK-WP-0048-T05 | done | — | workplans/NK-WP-0048-security-case-types.md |
|
||||
| task | NK-WP-0048-T06 | wait | — | workplans/NK-WP-0048-security-case-types.md |
|
||||
| task | NK-WP-0048-T07 | wait | — | workplans/NK-WP-0048-security-case-types.md |
|
||||
| task | NK-WP-0048-T08 | done | — | workplans/NK-WP-0048-security-case-types.md |
|
||||
| task | NK-WP-0048-T09 | done | — | workplans/NK-WP-0048-security-case-types.md |
|
||||
| task | NK-WP-0048-T10 | done | — | workplans/NK-WP-0048-security-case-types.md |
|
||||
| task | NK-WP-0048-T11 | done | — | workplans/NK-WP-0048-security-case-types.md |
|
||||
| task | NK-WP-0048-T12 | todo | — | workplans/NK-WP-0048-security-case-types.md |
|
||||
| task | NK-WP-0048-T13 | done | — | workplans/NK-WP-0048-security-case-types.md |
|
||||
| task | NK-WP-0048-T14 | todo | — | workplans/NK-WP-0048-security-case-types.md |
|
||||
| task | NK-WP-0048-T15 | todo | — | workplans/NK-WP-0048-security-case-types.md |
|
||||
| task | NK-WP-0048-T16 | todo | — | workplans/NK-WP-0048-security-case-types.md |
|
||||
| task | NK-WP-0048-T17 | done | — | workplans/NK-WP-0048-security-case-types.md |
|
||||
| task | NK-WP-0048-T18 | done | — | workplans/NK-WP-0048-security-case-types.md |
|
||||
| task | NK-WP-0048-T19 | done | — | workplans/NK-WP-0048-security-case-types.md |
|
||||
| task | NK-WP-0049-T01 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T02 | progress | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T03 | wait | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T04 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T05 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T06 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T07 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T08 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T09 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T10 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T11 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T12 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T13 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T14 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T15 | progress | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T16 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T17 | wait | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T18 | wait | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T19 | wait | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T20 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T21 | wait | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T22 | wait | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T23 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T24 | todo | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T25 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T26 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T27 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T28 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T29 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T30 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T31 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T32 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T33 | todo | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0050-T01 | done | — | workplans/NK-WP-0050-playwright-consumer-registration.md |
|
||||
| task | NK-WP-0050-T02 | progress | — | workplans/NK-WP-0050-playwright-consumer-registration.md |
|
||||
| task | NK-WP-0050-T03 | wait | — | workplans/NK-WP-0050-playwright-consumer-registration.md |
|
||||
| task | NK-WP-0051-T01 | done | — | workplans/NK-WP-0051-sign-in-diagnosis.md |
|
||||
| task | NK-WP-0051-T02 | done | — | workplans/NK-WP-0051-sign-in-diagnosis.md |
|
||||
| task | NK-WP-0051-T03 | done | — | workplans/NK-WP-0051-sign-in-diagnosis.md |
|
||||
| task | NK-WP-0051-T04 | done | — | workplans/NK-WP-0051-sign-in-diagnosis.md |
|
||||
| task | NK-WP-0051-T05 | done | — | workplans/NK-WP-0051-sign-in-diagnosis.md |
|
||||
| task | NK-WP-0051-T06 | done | — | workplans/NK-WP-0051-sign-in-diagnosis.md |
|
||||
| intake | NK-IN-0001 | closed | blue | docs/intakes/activity-core-ops-sso-operators.md |
|
||||
| intake | NK-IN-0002 | closed | blue | docs/intakes/activity-core-ops-sso-operators.md |
|
||||
| intake | NET-IN-0001 | open | — | intakes/intakes.md |
|
||||
| intake | NET-IN-0002 | open | — | intakes/intakes.md |
|
||||
| intake | NET-IN-0003 | open | — | intakes/intakes.md |
|
||||
| intake | NET-IN-0004 | open | — | intakes/intakes.md |
|
||||
|
|
@ -0,0 +1 @@
|
|||
{".custodian-brief.md": "100644 ea9ccd0b2bd2cc1ec89723b35c44c53f0d79ba98 0\t.custodian-brief.md\n", "WORK-RECORDS.md": "100644 76a6b7fc304c508f1b50010cb72d892826c6a831 0\tWORK-RECORDS.md\n"}
|
||||
|
|
@ -0,0 +1,73 @@
|
|||
"""Normal file-scoped owner publication with exact unrelated-state preservation."""
|
||||
from pathlib import Path
|
||||
import argparse
|
||||
import hashlib
|
||||
import json
|
||||
import subprocess
|
||||
import sys
|
||||
|
||||
parser = argparse.ArgumentParser()
|
||||
parser.add_argument('manifest', type=Path)
|
||||
parser.add_argument('phase', choices=['commit', 'sync'])
|
||||
args = parser.parse_args()
|
||||
cfg = json.loads(args.manifest.read_text()); here = args.manifest.parent
|
||||
root = Path('/home/worsch') / cfg['owner']; backup = here / 'publication-backup'
|
||||
paths = [f['path'] for f in cfg['files']]
|
||||
def git(*argv):
|
||||
return subprocess.check_output(['git', '-C', str(root), *argv], stderr=subprocess.PIPE, timeout=40).decode().strip()
|
||||
def preserve(restore=False):
|
||||
for row in json.loads((backup / 'originals.json').read_text()):
|
||||
name = row['path']; raw = (backup / (name + '.worktree')).read_bytes()
|
||||
if restore:
|
||||
(root / name).write_bytes(raw)
|
||||
if row['index']:
|
||||
mode, oid, stage, path = row['index'].split()
|
||||
assert stage == '0'
|
||||
git('update-index', '--cacheinfo', mode, oid, path)
|
||||
assert (root / name).read_bytes() == raw
|
||||
assert git('ls-files', '--stage', '--', name) == row['index']
|
||||
if args.phase == 'commit':
|
||||
assert git('rev-parse', 'HEAD') == cfg['base_revision']
|
||||
assert git('ls-remote', 'origin', 'refs/heads/main').split()[0] == cfg['base_revision']
|
||||
for row in cfg['files']:
|
||||
assert hashlib.sha256((root / row['path']).read_bytes()).hexdigest() == row['sha256']
|
||||
assert not backup.exists(); backup.mkdir()
|
||||
originals = []
|
||||
for name in ['.custodian-brief.md', 'WORK-RECORDS.md']:
|
||||
if (root / name).exists():
|
||||
(backup / (name + '.worktree')).write_bytes((root / name).read_bytes())
|
||||
originals.append({'path': name, 'index': git('ls-files', '--stage', '--', name)})
|
||||
(backup / 'originals.json').write_text(json.dumps(originals, indent=2) + '\n')
|
||||
git('add', '--', *paths)
|
||||
result = subprocess.run(['git', '-C', str(root), 'commit', '--only', '-m', cfg['message'], '--', *paths],
|
||||
capture_output=True, text=True, timeout=240)
|
||||
head = git('rev-parse', 'HEAD')
|
||||
(here / 'publication-commit.json').write_text(json.dumps({'exit_code': result.returncode, 'commit': head,
|
||||
'base': cfg['base_revision'], 'files': cfg['files'], 'stdout': result.stdout, 'stderr': result.stderr}, indent=2) + '\n')
|
||||
preserve()
|
||||
assert result.returncode == 0, 'normal commit refused; receipt retained'
|
||||
assert set(git('diff-tree', '--no-commit-id', '--name-only', '-r', head).splitlines()) == set(paths)
|
||||
print(json.dumps({'status': 'committed', 'owner': cfg['owner'], 'commit': head, 'files': len(paths)}))
|
||||
else:
|
||||
head = json.loads((here / 'publication-commit.json').read_text())['commit']
|
||||
assert git('rev-parse', 'HEAD') == head
|
||||
sys.path.insert(0, '/home/worsch/repo-manager/src')
|
||||
from repo_manager.identifiers import ensure_missing_work_record_identifiers
|
||||
preview = ensure_missing_work_record_identifiers(root, execute=False)
|
||||
assert preview['ok'] and not preview['files_changed'] and not preview['assignments'], 'unrelated UUID assignment requires review'
|
||||
try:
|
||||
for label, argv, timeout in [
|
||||
('consistency', ['statehub', 'fix-consistency', '--repo', cfg['owner'], '--json'], 300),
|
||||
('projection', ['/home/worsch/repo-manager/.venv/bin/rmgr', 'sync', '--path', str(root), '--push'], 180)]:
|
||||
result = subprocess.run(argv, cwd=root, capture_output=True, text=True, timeout=timeout)
|
||||
(here / (label + '.json')).write_text(result.stdout)
|
||||
(here / (label + '.stderr.txt')).write_text(result.stderr)
|
||||
assert result.returncode == 0, label + ' refused; receipt retained'
|
||||
finally:
|
||||
preserve(restore=True)
|
||||
projection = json.loads((here / 'projection.json').read_text())
|
||||
assert projection['status'] == 'applied' and projection['commit'] == head
|
||||
assert projection['receipt']['expected_commit'] == projection['receipt']['derived_commit'] == head
|
||||
assert (projection['receipt']['instance_role'], projection['receipt']['instance_label']) == ('primary', 'railiance01')
|
||||
assert git('ls-remote', 'origin', 'refs/heads/main').split()[0] == head
|
||||
print(json.dumps({'status': 'applied', 'owner': cfg['owner'], 'commit': head, 'unrelated_work_preserved': True}))
|
||||
|
|
@ -0,0 +1,131 @@
|
|||
{
|
||||
"repo_slug": "the-custodian",
|
||||
"repo_path": "/home/worsch/the-custodian",
|
||||
"source_revision": null,
|
||||
"source_revision_reason": "dirty_workplans",
|
||||
"issues": [
|
||||
{
|
||||
"severity": "WARN",
|
||||
"check_id": "C-35",
|
||||
"message": "Repo Manager warning: workplans/: repository uses more than one workplan prefix: ['CUST-WP', 'THE-WP']",
|
||||
"file_path": "workplans/",
|
||||
"db_id": "",
|
||||
"file_value": "",
|
||||
"db_value": "",
|
||||
"fixable": false
|
||||
},
|
||||
{
|
||||
"severity": "WARN",
|
||||
"check_id": "C-35",
|
||||
"message": "Repo Manager contradictory: workplans/ADHOC-2026-08-25-retired.md: workplan id 'CUST-WP-ADHOC-2026-08-25-RETIRED' is not accepted by the canon kind registry",
|
||||
"file_path": "workplans/ADHOC-2026-08-25-retired.md",
|
||||
"db_id": "",
|
||||
"file_value": "",
|
||||
"db_value": "",
|
||||
"fixable": false
|
||||
},
|
||||
{
|
||||
"severity": "WARN",
|
||||
"check_id": "C-05",
|
||||
"message": "Title drift in 'cust-wp-0010': file='Domain and Repository Goals' db='Workplan Lifecycle Documentation' (file wins)",
|
||||
"file_path": "workplans/CUST-WP-0010b-domain-and-repo-goals.md",
|
||||
"db_id": "def8455a-9de4-4891-a15a-5b09ca98ab1e",
|
||||
"file_value": "Domain and Repository Goals",
|
||||
"db_value": "Workplan Lifecycle Documentation",
|
||||
"fixable": true
|
||||
},
|
||||
{
|
||||
"severity": "WARN",
|
||||
"check_id": "C-20",
|
||||
"message": "Workplan dependency target 'STATE-WP-0092' is not linked to State Hub",
|
||||
"file_path": "workplans/CUST-WP-0072-fleet-flavor-and-depends-on-backfill.md",
|
||||
"db_id": "",
|
||||
"file_value": "STATE-WP-0092",
|
||||
"db_value": "",
|
||||
"fixable": false
|
||||
},
|
||||
{
|
||||
"severity": "WARN",
|
||||
"check_id": "C-40",
|
||||
"message": "blocker satisfied, task still wait: 'CUST-WP-0073-T05' in workplan 'CUST-WP-0073' \u2014 decision 1591daa1-6e85-4dfd-aadd-5a9fe1ef47fa is resolved",
|
||||
"file_path": "workplans/CUST-WP-0073-agent-credential-separation.md#CUST-WP-0073-T05",
|
||||
"db_id": "",
|
||||
"file_value": "1591daa1-6e85-4dfd-aadd-5a9fe1ef47fa",
|
||||
"db_value": "",
|
||||
"fixable": false
|
||||
},
|
||||
{
|
||||
"severity": "WARN",
|
||||
"check_id": "C-39",
|
||||
"message": "Human wait task 'CUST-WP-0079-T06' in workplan 'CUST-WP-0079' has needs_human: true without decision_id \u2014 unrouted human gate",
|
||||
"file_path": "workplans/CUST-WP-0079-deterministic-security-flow.md#CUST-WP-0079-T06",
|
||||
"db_id": "",
|
||||
"file_value": "needs_human: true",
|
||||
"db_value": "",
|
||||
"fixable": false
|
||||
},
|
||||
{
|
||||
"severity": "INFO",
|
||||
"check_id": "C-08",
|
||||
"message": "Closed DB workstream 'cust-wp-0010b' (id=416ff571\u2026, status=finished) has no backing workplan file",
|
||||
"file_path": "",
|
||||
"db_id": "416ff571-18cf-5cb2-9c8b-836f68a301b3",
|
||||
"file_value": "",
|
||||
"db_value": "",
|
||||
"fixable": false
|
||||
},
|
||||
{
|
||||
"severity": "INFO",
|
||||
"check_id": "C-08",
|
||||
"message": "Retired DB workstream 'interactive-the-custodian@retired-20260828' (id=370c2481\u2026, status=finished) has no backing workplan file \u2014 projection tombstone, not live work",
|
||||
"file_path": "",
|
||||
"db_id": "370c2481-6806-41eb-a917-f8874f03184f",
|
||||
"file_value": "",
|
||||
"db_value": "",
|
||||
"fixable": false
|
||||
},
|
||||
{
|
||||
"severity": "INFO",
|
||||
"check_id": "C-08",
|
||||
"message": "Retired DB workstream 'adhoc-2026-05-02@retired-20260827' (id=3f54ce9c\u2026, status=finished) has no backing workplan file \u2014 projection tombstone, not live work",
|
||||
"file_path": "",
|
||||
"db_id": "3f54ce9c-1f95-42de-894f-0f81a52ba2e8",
|
||||
"file_value": "",
|
||||
"db_value": "",
|
||||
"fixable": false
|
||||
},
|
||||
{
|
||||
"severity": "INFO",
|
||||
"check_id": "C-08",
|
||||
"message": "Retired DB workstream 'the-custodian-adhoc-2026-07-02@retired-20260827' (id=5c53733b\u2026, status=finished) has no backing workplan file \u2014 projection tombstone, not live work",
|
||||
"file_path": "",
|
||||
"db_id": "5c53733b-c077-4a93-be66-9c3af8f9b6fd",
|
||||
"file_value": "",
|
||||
"db_value": "",
|
||||
"fixable": false
|
||||
},
|
||||
{
|
||||
"severity": "WARN",
|
||||
"check_id": "C-26",
|
||||
"message": "Workplan id 'THE-WP-0001' uses prefix 'THE-WP' but repo canonical prefix is 'CUST-WP' \u2014 new plans must conform",
|
||||
"file_path": "workplans/THE-WP-0001-federation-interface.md",
|
||||
"db_id": "",
|
||||
"file_value": "THE-WP-0001",
|
||||
"db_value": "CUST-WP",
|
||||
"fixable": false
|
||||
}
|
||||
],
|
||||
"fixes_applied": [
|
||||
"bindings: synced 89/89",
|
||||
"C-17 cleared: pushed 2 backlogged commit(s)",
|
||||
"C-05 fixed: workstream def8455a\u2026 title \u2192 'Domain and Repository Goals'",
|
||||
"push: pushed"
|
||||
],
|
||||
"summary": {
|
||||
"fail": 0,
|
||||
"automation_error": 0,
|
||||
"warn": 7,
|
||||
"info": 4
|
||||
},
|
||||
"result": "warn"
|
||||
}
|
||||
|
|
@ -0,0 +1 @@
|
|||
WARN: working-memory commit failed: Generated-only commits rejected: staged
|
||||
|
|
@ -0,0 +1,8 @@
|
|||
{
|
||||
"ok": false,
|
||||
"status": "pending_commit",
|
||||
"error": "authoritative workplan files have uncommitted changes",
|
||||
"dirty_paths": [
|
||||
"workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md"
|
||||
]
|
||||
}
|
||||
|
|
@ -0,0 +1,25 @@
|
|||
{
|
||||
"parent": "4097a0bfbc42b937f23a06d19d3aa4587c51927f",
|
||||
"commit": "ffd995213c1d980172598a0f97371e4e9a63c75e",
|
||||
"paths": [
|
||||
"docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r2/FINAL-PROPOSAL.md",
|
||||
"docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r2/PROCESS-CONTRACT.md",
|
||||
"docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r2/action-inputs.json",
|
||||
"docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r2/artifact-manifest.json",
|
||||
"docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r2/build-transfer.py",
|
||||
"docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r2/cleanup-upload-staging.py",
|
||||
"docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r2/cpu-readonly-observation.json",
|
||||
"docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r2/executable-readonly-observation.json",
|
||||
"docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r2/execute-install.py",
|
||||
"docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r2/execution-receipt.json",
|
||||
"docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r2/final-readonly-dry-run.json",
|
||||
"docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r2/frozen-native-argv.json",
|
||||
"docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r2/install-verified.py",
|
||||
"docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r2/local-bytecode-refinement.json",
|
||||
"docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r2/local-transfer-check.py",
|
||||
"docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r2/local-transfer-verification.json"
|
||||
],
|
||||
"commit_exit_code": 0,
|
||||
"stdout": "[main ffd9952] Record failed runtime trial and reviewed verification proposal (1/4)\n 16 files changed, 1298 insertions(+)\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r2/FINAL-PROPOSAL.md\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r2/PROCESS-CONTRACT.md\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r2/action-inputs.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r2/artifact-manifest.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r2/build-transfer.py\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r2/cleanup-upload-staging.py\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r2/cpu-readonly-observation.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r2/executable-readonly-observation.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r2/execute-install.py\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r2/execution-receipt.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r2/final-readonly-dry-run.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r2/frozen-native-argv.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r2/install-verified.py\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r2/local-bytecode-refinement.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r2/local-transfer-check.py\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r2/local-transfer-verification.json\n",
|
||||
"stderr": "{\"blocked_blob_ids\": [], \"scanned_blobs\": 16, \"scanner_sha256\": \"88f91962aa2f93ac6ab281d553b9e125f5197bbbce38f9f2437f7299c32e5509\", \"scanner_version\": \"8.30.1\", \"scope\": \"changed-staged-blobs\", \"status\": \"clean\"}\n"
|
||||
}
|
||||
|
|
@ -0,0 +1,120 @@
|
|||
{
|
||||
"repo_slug": "the-custodian",
|
||||
"repo_path": "/home/worsch/the-custodian",
|
||||
"source_revision": null,
|
||||
"source_revision_reason": "dirty_workplans",
|
||||
"issues": [
|
||||
{
|
||||
"severity": "WARN",
|
||||
"check_id": "C-35",
|
||||
"message": "Repo Manager warning: workplans/: repository uses more than one workplan prefix: ['CUST-WP', 'THE-WP']",
|
||||
"file_path": "workplans/",
|
||||
"db_id": "",
|
||||
"file_value": "",
|
||||
"db_value": "",
|
||||
"fixable": false
|
||||
},
|
||||
{
|
||||
"severity": "WARN",
|
||||
"check_id": "C-35",
|
||||
"message": "Repo Manager contradictory: workplans/ADHOC-2026-08-25-retired.md: workplan id 'CUST-WP-ADHOC-2026-08-25-RETIRED' is not accepted by the canon kind registry",
|
||||
"file_path": "workplans/ADHOC-2026-08-25-retired.md",
|
||||
"db_id": "",
|
||||
"file_value": "",
|
||||
"db_value": "",
|
||||
"fixable": false
|
||||
},
|
||||
{
|
||||
"severity": "WARN",
|
||||
"check_id": "C-20",
|
||||
"message": "Workplan dependency target 'STATE-WP-0092' is not linked to State Hub",
|
||||
"file_path": "workplans/CUST-WP-0072-fleet-flavor-and-depends-on-backfill.md",
|
||||
"db_id": "",
|
||||
"file_value": "STATE-WP-0092",
|
||||
"db_value": "",
|
||||
"fixable": false
|
||||
},
|
||||
{
|
||||
"severity": "WARN",
|
||||
"check_id": "C-40",
|
||||
"message": "blocker satisfied, task still wait: 'CUST-WP-0073-T05' in workplan 'CUST-WP-0073' \u2014 decision 1591daa1-6e85-4dfd-aadd-5a9fe1ef47fa is resolved",
|
||||
"file_path": "workplans/CUST-WP-0073-agent-credential-separation.md#CUST-WP-0073-T05",
|
||||
"db_id": "",
|
||||
"file_value": "1591daa1-6e85-4dfd-aadd-5a9fe1ef47fa",
|
||||
"db_value": "",
|
||||
"fixable": false
|
||||
},
|
||||
{
|
||||
"severity": "WARN",
|
||||
"check_id": "C-39",
|
||||
"message": "Human wait task 'CUST-WP-0079-T06' in workplan 'CUST-WP-0079' has needs_human: true without decision_id \u2014 unrouted human gate",
|
||||
"file_path": "workplans/CUST-WP-0079-deterministic-security-flow.md#CUST-WP-0079-T06",
|
||||
"db_id": "",
|
||||
"file_value": "needs_human: true",
|
||||
"db_value": "",
|
||||
"fixable": false
|
||||
},
|
||||
{
|
||||
"severity": "INFO",
|
||||
"check_id": "C-08",
|
||||
"message": "Closed DB workstream 'cust-wp-0010b' (id=416ff571\u2026, status=finished) has no backing workplan file",
|
||||
"file_path": "",
|
||||
"db_id": "416ff571-18cf-5cb2-9c8b-836f68a301b3",
|
||||
"file_value": "",
|
||||
"db_value": "",
|
||||
"fixable": false
|
||||
},
|
||||
{
|
||||
"severity": "INFO",
|
||||
"check_id": "C-08",
|
||||
"message": "Retired DB workstream 'interactive-the-custodian@retired-20260828' (id=370c2481\u2026, status=finished) has no backing workplan file \u2014 projection tombstone, not live work",
|
||||
"file_path": "",
|
||||
"db_id": "370c2481-6806-41eb-a917-f8874f03184f",
|
||||
"file_value": "",
|
||||
"db_value": "",
|
||||
"fixable": false
|
||||
},
|
||||
{
|
||||
"severity": "INFO",
|
||||
"check_id": "C-08",
|
||||
"message": "Retired DB workstream 'adhoc-2026-05-02@retired-20260827' (id=3f54ce9c\u2026, status=finished) has no backing workplan file \u2014 projection tombstone, not live work",
|
||||
"file_path": "",
|
||||
"db_id": "3f54ce9c-1f95-42de-894f-0f81a52ba2e8",
|
||||
"file_value": "",
|
||||
"db_value": "",
|
||||
"fixable": false
|
||||
},
|
||||
{
|
||||
"severity": "INFO",
|
||||
"check_id": "C-08",
|
||||
"message": "Retired DB workstream 'the-custodian-adhoc-2026-07-02@retired-20260827' (id=5c53733b\u2026, status=finished) has no backing workplan file \u2014 projection tombstone, not live work",
|
||||
"file_path": "",
|
||||
"db_id": "5c53733b-c077-4a93-be66-9c3af8f9b6fd",
|
||||
"file_value": "",
|
||||
"db_value": "",
|
||||
"fixable": false
|
||||
},
|
||||
{
|
||||
"severity": "WARN",
|
||||
"check_id": "C-26",
|
||||
"message": "Workplan id 'THE-WP-0001' uses prefix 'THE-WP' but repo canonical prefix is 'CUST-WP' \u2014 new plans must conform",
|
||||
"file_path": "workplans/THE-WP-0001-federation-interface.md",
|
||||
"db_id": "",
|
||||
"file_value": "THE-WP-0001",
|
||||
"db_value": "CUST-WP",
|
||||
"fixable": false
|
||||
}
|
||||
],
|
||||
"fixes_applied": [
|
||||
"bindings: synced 89/89",
|
||||
"C-17 cleared: pushed 2 backlogged commit(s)",
|
||||
"push: pushed"
|
||||
],
|
||||
"summary": {
|
||||
"fail": 0,
|
||||
"automation_error": 0,
|
||||
"warn": 6,
|
||||
"info": 4
|
||||
},
|
||||
"result": "warn"
|
||||
}
|
||||
|
|
@ -0,0 +1 @@
|
|||
WARN: working-memory commit failed: Generated-only commits rejected: staged
|
||||
|
|
@ -0,0 +1,25 @@
|
|||
{
|
||||
"parent": "ffd995213c1d980172598a0f97371e4e9a63c75e",
|
||||
"commit": "6844177f48e15158678232d8259b87abded67b12",
|
||||
"paths": [
|
||||
"docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r2/pre-absolute-path-dry-run.json",
|
||||
"docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r2/process-fixture-results.json",
|
||||
"docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r2/process_supervision.py",
|
||||
"docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r2/r1-preservation.json",
|
||||
"docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r2/r1-to-r2.patch",
|
||||
"docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r2/r2-initial-readonly-dry-run.json",
|
||||
"docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r2/retained-headroom-refusal.json",
|
||||
"docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r2/retained-local-source-refusal.json",
|
||||
"docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r2/runtime.py",
|
||||
"docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r2/target-readonly-addendum.json",
|
||||
"docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r2/target-readonly-observation.json",
|
||||
"docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r2/test_process_supervision.py",
|
||||
"docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r2/transfer-archive.json",
|
||||
"docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r3/FINAL-PROPOSAL.md",
|
||||
"docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r3/action-inputs.json",
|
||||
"docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r3/artifact-manifest.json"
|
||||
],
|
||||
"commit_exit_code": 0,
|
||||
"stdout": "[main 6844177] Record failed runtime trial and reviewed verification proposal (2/4)\n 16 files changed, 1479 insertions(+)\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r2/pre-absolute-path-dry-run.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r2/process-fixture-results.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r2/process_supervision.py\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r2/r1-preservation.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r2/r1-to-r2.patch\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r2/r2-initial-readonly-dry-run.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r2/retained-headroom-refusal.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r2/retained-local-source-refusal.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r2/runtime.py\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r2/target-readonly-addendum.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r2/target-readonly-observation.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r2/test_process_supervision.py\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r2/transfer-archive.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r3/FINAL-PROPOSAL.md\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r3/action-inputs.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r3/artifact-manifest.json\n",
|
||||
"stderr": "{\"blocked_blob_ids\": [], \"scanned_blobs\": 16, \"scanner_sha256\": \"88f91962aa2f93ac6ab281d553b9e125f5197bbbce38f9f2437f7299c32e5509\", \"scanner_version\": \"8.30.1\", \"scope\": \"changed-staged-blobs\", \"status\": \"clean\"}\n"
|
||||
}
|
||||
|
|
@ -0,0 +1,9 @@
|
|||
{
|
||||
"expected": "6844177f48e15158678232d8259b87abded67b12",
|
||||
"actual": "08870d65de615cbb8b5e1f374bf53a2229c21930",
|
||||
"intervening_paths": [
|
||||
"docs/changes/netkingdom-target-2026-10-17/nk48-adapters-1.2-review/coordinator-review-r5.json"
|
||||
],
|
||||
"overlap_with_selected_paths": false,
|
||||
"history_preserved": true
|
||||
}
|
||||
|
|
@ -0,0 +1,120 @@
|
|||
{
|
||||
"repo_slug": "the-custodian",
|
||||
"repo_path": "/home/worsch/the-custodian",
|
||||
"source_revision": null,
|
||||
"source_revision_reason": "dirty_workplans",
|
||||
"issues": [
|
||||
{
|
||||
"severity": "WARN",
|
||||
"check_id": "C-35",
|
||||
"message": "Repo Manager warning: workplans/: repository uses more than one workplan prefix: ['CUST-WP', 'THE-WP']",
|
||||
"file_path": "workplans/",
|
||||
"db_id": "",
|
||||
"file_value": "",
|
||||
"db_value": "",
|
||||
"fixable": false
|
||||
},
|
||||
{
|
||||
"severity": "WARN",
|
||||
"check_id": "C-35",
|
||||
"message": "Repo Manager contradictory: workplans/ADHOC-2026-08-25-retired.md: workplan id 'CUST-WP-ADHOC-2026-08-25-RETIRED' is not accepted by the canon kind registry",
|
||||
"file_path": "workplans/ADHOC-2026-08-25-retired.md",
|
||||
"db_id": "",
|
||||
"file_value": "",
|
||||
"db_value": "",
|
||||
"fixable": false
|
||||
},
|
||||
{
|
||||
"severity": "WARN",
|
||||
"check_id": "C-20",
|
||||
"message": "Workplan dependency target 'STATE-WP-0092' is not linked to State Hub",
|
||||
"file_path": "workplans/CUST-WP-0072-fleet-flavor-and-depends-on-backfill.md",
|
||||
"db_id": "",
|
||||
"file_value": "STATE-WP-0092",
|
||||
"db_value": "",
|
||||
"fixable": false
|
||||
},
|
||||
{
|
||||
"severity": "WARN",
|
||||
"check_id": "C-40",
|
||||
"message": "blocker satisfied, task still wait: 'CUST-WP-0073-T05' in workplan 'CUST-WP-0073' \u2014 decision 1591daa1-6e85-4dfd-aadd-5a9fe1ef47fa is resolved",
|
||||
"file_path": "workplans/CUST-WP-0073-agent-credential-separation.md#CUST-WP-0073-T05",
|
||||
"db_id": "",
|
||||
"file_value": "1591daa1-6e85-4dfd-aadd-5a9fe1ef47fa",
|
||||
"db_value": "",
|
||||
"fixable": false
|
||||
},
|
||||
{
|
||||
"severity": "WARN",
|
||||
"check_id": "C-39",
|
||||
"message": "Human wait task 'CUST-WP-0079-T06' in workplan 'CUST-WP-0079' has needs_human: true without decision_id \u2014 unrouted human gate",
|
||||
"file_path": "workplans/CUST-WP-0079-deterministic-security-flow.md#CUST-WP-0079-T06",
|
||||
"db_id": "",
|
||||
"file_value": "needs_human: true",
|
||||
"db_value": "",
|
||||
"fixable": false
|
||||
},
|
||||
{
|
||||
"severity": "INFO",
|
||||
"check_id": "C-08",
|
||||
"message": "Closed DB workstream 'cust-wp-0010b' (id=416ff571\u2026, status=finished) has no backing workplan file",
|
||||
"file_path": "",
|
||||
"db_id": "416ff571-18cf-5cb2-9c8b-836f68a301b3",
|
||||
"file_value": "",
|
||||
"db_value": "",
|
||||
"fixable": false
|
||||
},
|
||||
{
|
||||
"severity": "INFO",
|
||||
"check_id": "C-08",
|
||||
"message": "Retired DB workstream 'interactive-the-custodian@retired-20260828' (id=370c2481\u2026, status=finished) has no backing workplan file \u2014 projection tombstone, not live work",
|
||||
"file_path": "",
|
||||
"db_id": "370c2481-6806-41eb-a917-f8874f03184f",
|
||||
"file_value": "",
|
||||
"db_value": "",
|
||||
"fixable": false
|
||||
},
|
||||
{
|
||||
"severity": "INFO",
|
||||
"check_id": "C-08",
|
||||
"message": "Retired DB workstream 'adhoc-2026-05-02@retired-20260827' (id=3f54ce9c\u2026, status=finished) has no backing workplan file \u2014 projection tombstone, not live work",
|
||||
"file_path": "",
|
||||
"db_id": "3f54ce9c-1f95-42de-894f-0f81a52ba2e8",
|
||||
"file_value": "",
|
||||
"db_value": "",
|
||||
"fixable": false
|
||||
},
|
||||
{
|
||||
"severity": "INFO",
|
||||
"check_id": "C-08",
|
||||
"message": "Retired DB workstream 'the-custodian-adhoc-2026-07-02@retired-20260827' (id=5c53733b\u2026, status=finished) has no backing workplan file \u2014 projection tombstone, not live work",
|
||||
"file_path": "",
|
||||
"db_id": "5c53733b-c077-4a93-be66-9c3af8f9b6fd",
|
||||
"file_value": "",
|
||||
"db_value": "",
|
||||
"fixable": false
|
||||
},
|
||||
{
|
||||
"severity": "WARN",
|
||||
"check_id": "C-26",
|
||||
"message": "Workplan id 'THE-WP-0001' uses prefix 'THE-WP' but repo canonical prefix is 'CUST-WP' \u2014 new plans must conform",
|
||||
"file_path": "workplans/THE-WP-0001-federation-interface.md",
|
||||
"db_id": "",
|
||||
"file_value": "THE-WP-0001",
|
||||
"db_value": "CUST-WP",
|
||||
"fixable": false
|
||||
}
|
||||
],
|
||||
"fixes_applied": [
|
||||
"bindings: synced 89/89",
|
||||
"C-17 cleared: pushed 1 backlogged commit(s)",
|
||||
"push: pushed"
|
||||
],
|
||||
"summary": {
|
||||
"fail": 0,
|
||||
"automation_error": 0,
|
||||
"warn": 6,
|
||||
"info": 4
|
||||
},
|
||||
"result": "warn"
|
||||
}
|
||||
|
|
@ -0,0 +1 @@
|
|||
WARN: working-memory commit failed: Generated-only commits rejected: staged
|
||||
Loading…
Add table
Add a link
Reference in a new issue