coulomb/the-custodian
4
0
Fork 0
Code Issues 1 Pull requests Projects Releases Packages Wiki Activity Actions

Record completed issuer pin and actionable custody review handoff
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source
This commit is contained in:
codex 2026-09-09 00:58:41 +02:00
parent 06382a3156
commit cc0badb64b
4 changed files with 1017 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

2
docs/assessments/2026-09-08-helixforge-factory-critical-path.md
View file

@ -1,5 +1,7 @@
# Factory critical-path execution — 2026-09-08
Continued on [2026-09-09: issuer pin complete and custody reviews ready](2026-09-09-helixforge-issuer-pin.md).
Implemented and published prerequisite corrections in ops-warden, key-cape,
approval-engine and audit-core, followed by local runtime installation and an
attended OpenBao capability preflight, then verified the actual upstream issuer. The canonical integration workplan and next

927
docs/assessments/2026-09-09-helixforge-issuer-pin.json Normal file
View file

@ -0,0 +1,927 @@
{
"schema": "custodian.factory-issuer-pin-continuation.v1",
"recorded_at": "2026-09-08T22:57:37.545227+00:00",
"live_pin": {
"schema": "netkingdom.keycape-issuer-pin-live-evidence.v1",
"recorded_at": "2026-09-08T22:24:00.262369+00:00",
"authorization": "User continuation: good, go on, after the explicit next step to ensure the verified issuer configuration pin.",
"source_commit": "ad9979b159f56a5d77004031dea4a897e61751dc",
"signed_issuer_proof_ref": "key-cape/docs/evidence/2026-09-08-upstream-issuer-live-proof.json",
"check_before": {
"before": {
"resource_version": "51346058",
"uid": "2e94519d-1550-41c7-9701-2efe47fe1fd3"
},
"config_changed": false,
"deployment_changed": false,
"issuer_matches": false,
"mode": "issuer-check-live",
"observed_at": "2026-09-08T22:23:58.199881+00:00",
"prior_pin_state": "absent",
"schema": "netkingdom.keycape-issuer-pin.v1",
"secret_values_emitted": false,
"target": "sso/keycape-config",
"verified_issuer": "https://auth.coulomb.social"
},
"pin": {
"after": {
"resource_version": "58713343",
"uid": "2e94519d-1550-41c7-9701-2efe47fe1fd3"
},
"before": {
"resource_version": "51346058",
"uid": "2e94519d-1550-41c7-9701-2efe47fe1fd3"
},
"config_changed": true,
"deployment_changed": false,
"issuer_matches": true,
"mode": "issuer-pin-live",
"observed_at": "2026-09-08T22:23:58.727554+00:00",
"other_secret_data_unchanged": true,
"prior_pin_state": "absent",
"schema": "netkingdom.keycape-issuer-pin.v1",
"secret_values_emitted": false,
"target": "sso/keycape-config",
"unrelated_config_bytes_preserved": true,
"verified_issuer": "https://auth.coulomb.social"
},
"check_after": {
"before": {
"resource_version": "58713343",
"uid": "2e94519d-1550-41c7-9701-2efe47fe1fd3"
},
"config_changed": false,
"deployment_changed": false,
"issuer_matches": true,
"mode": "issuer-check-live",
"observed_at": "2026-09-08T22:23:59.920100+00:00",
"prior_pin_state": "matching",
"schema": "netkingdom.keycape-issuer-pin.v1",
"secret_values_emitted": false,
"target": "sso/keycape-config",
"verified_issuer": "https://auth.coulomb.social"
},
"deployment_before": {
"uid": "99ddd83c-cb3f-4847-bcf8-35f1aa87627f",
"resource_version": "55113259",
"generation": 29,
"images": [
{
"name": "keycape",
"image": "forgejo.coulomb.social/coulomb/key-cape:main-153258b"
}
],
"ready_replicas": 1,
"available_replicas": 1
},
"deployment_after": {
"uid": "99ddd83c-cb3f-4847-bcf8-35f1aa87627f",
"resource_version": "55113259",
"generation": 29,
"images": [
{
"name": "keycape",
"image": "forgejo.coulomb.social/coulomb/key-cape:main-153258b"
}
],
"ready_replicas": 1,
"available_replicas": 1
},
"deployment_unchanged": true,
"tests_passed": 13,
"credential_values_emitted": false,
"custody_activated": false,
"ccr_reviews_completed": false,
"process_reload_or_new_image_proved": false
},
"review_apply_gates": [
{
"ccr": "CCR-2026-0017",
"apply_plan_refused": true,
"reason": "requires status approved, got proposed",
"exit_code": 1
},
{
"ccr": "CCR-2026-0018",
"apply_plan_refused": true,
"reason": "requires status approved, got proposed",
"exit_code": 1
}
],
"projection_receipts": [
{
"repo": "net-kingdom",
"commit": "896c1200c0f387cd331ceca11cb6a6586ac815eb",
"method": "Supported primary reconciliation endpoint after scoped sole-retirement review; CLI retry blocked by idempotency-key conflict",
"receipt": {
"schema": "state-hub.repository-projection-reconcile.v1",
"instance_role": "primary",
"instance_label": "railiance01",
"expected_commit": "896c1200c0f387cd331ceca11cb6a6586ac815eb",
"derived_commit": "896c1200c0f387cd331ceca11cb6a6586ac815eb",
"outcome": {
"schema": "state-hub.projection-reset.v1",
"repo_slug": "net-kingdom",
"commit": "896c1200c0f387cd331ceca11cb6a6586ac815eb",
"status": "applied",
"counts": {
"created": 0,
"updated": 44,
"retired": 1,
"refused": 0,
"released": 0,
"created_tasks": 0,
"updated_tasks": 98,
"cancelled_tasks": 0
},
"created": [],
"updated": [
"NET-WP-0015",
"NET-WP-0016",
"NET-WP-0017",
"NET-WP-0018",
"NET-WP-0019",
"NET-WP-0020",
"NK-WP-0001",
"NK-WP-0002",
"NK-WP-0003",
"NK-WP-0004",
"NK-WP-0005",
"NK-WP-0006",
"NK-WP-0007",
"NK-WP-0008",
"NK-WP-0009",
"NK-WP-0010",
"NK-WP-0011",
"NK-WP-0012",
"NK-WP-0013",
"NK-WP-0014",
"NK-WP-0015",
"NK-WP-0016",
"NK-WP-0017",
"NK-WP-0018",
"NK-WP-0019",
"NK-WP-0021",
"NK-WP-0022",
"NK-WP-0023",
"NK-WP-0024",
"NK-WP-0025",
"NK-WP-0026",
"NK-WP-0027",
"NK-WP-0028",
"NK-WP-0029",
"NK-WP-0030",
"NK-WP-0031",
"NK-WP-0032",
"NK-WP-0033",
"NK-WP-0034",
"NK-WP-0035",
"NK-WP-ADHOC-2026-06-14",
"NK-WP-ADHOC-2026-07-02",
"NK-WP-ADHOC-2026-08-14",
"NK-WP-ADHOC-2026-08-23"
],
"retired": [
"nk-wp-0035"
],
"released": [],
"created_tasks": [],
"updated_tasks": [
"NET-WP-0020-T05",
"NK-WP-0001-T01",
"NK-WP-0001-T02",
"NK-WP-0001-T03",
"NK-WP-0001-T04",
"NK-WP-0001-T05",
"NK-WP-0001-T06",
"NK-WP-0001-T07",
"NK-WP-0001-T08",
"NK-WP-0002-T01",
"NK-WP-0002-T02",
"NK-WP-0002-T03",
"NK-WP-0002-T04",
"NK-WP-0005-T02",
"NK-WP-0005-T03",
"NK-WP-0005-T04",
"NK-WP-0005-T06",
"NK-WP-0005-T07",
"NK-WP-0006-T1",
"NK-WP-0006-T2",
"NK-WP-0006-T3",
"NK-WP-0006-T4",
"NK-WP-0006-T5",
"NK-WP-0006-T6",
"NK-WP-0007-T1",
"NK-WP-0007-T2",
"NK-WP-0007-T3",
"NK-WP-0007-T4",
"NK-WP-0007-T5",
"NK-WP-0009-T01",
"NK-WP-0009-T02",
"NK-WP-0009-T03",
"NK-WP-0009-T04",
"NK-WP-0009-T05",
"NK-WP-0011-T01",
"NK-WP-0011-T02",
"NK-WP-0011-T03",
"NK-WP-0011-T04",
"NK-WP-0011-T05",
"NK-WP-0011-T06",
"NK-WP-0011-T07",
"NK-WP-0012-T1",
"NK-WP-0012-T2",
"NK-WP-0012-T3",
"NK-WP-0012-T4",
"NK-WP-0012-T5",
"NK-WP-0013-T1",
"NK-WP-0013-T2",
"NK-WP-0013-T3",
"NK-WP-0013-T4",
"NK-WP-0013-T5",
"NK-WP-0014-T1",
"NK-WP-0014-T2",
"NK-WP-0014-T3",
"NK-WP-0014-T4",
"NK-WP-0014-T5",
"NK-WP-0015-T1",
"NK-WP-0015-T2",
"NK-WP-0015-T3",
"NK-WP-0015-T4",
"NK-WP-0015-T5",
"NK-WP-0015-T6",
"NK-WP-0016-T1",
"NK-WP-0016-T2",
"NK-WP-0016-T3",
"NK-WP-0016-T4",
"NK-WP-0016-T5",
"NK-WP-0016-T6",
"NK-WP-0017-T1",
"NK-WP-0017-T2",
"NK-WP-0017-T3",
"NK-WP-0017-T4",
"NK-WP-0017-T5",
"NK-WP-0017-T6",
"NK-WP-0018-T1",
"NK-WP-0018-T2",
"NK-WP-0018-T3",
"NK-WP-0018-T4",
"NK-WP-0018-T5",
"NK-WP-0018-T6",
"NK-WP-0019-T1",
"NK-WP-0019-T2",
"NK-WP-0019-T3",
"NK-WP-0019-T4",
"NK-WP-0019-T5",
"NK-WP-0019-T6",
"NK-WP-0021-T01",
"NK-WP-0021-T02",
"NK-WP-0021-T03",
"NK-WP-0021-T04",
"NK-WP-0021-T05",
"NK-WP-0026-T01",
"NK-WP-0033-T05",
"NK-WP-0035-T01",
"NK-WP-0035-T02",
"NK-WP-0035-T03",
"NK-WP-0035-T04",
"NK-WP-0035-T05"
],
"cancelled_tasks": [],
"refused": [],
"notes": []
}
}
},
{
"repo": "key-cape",
"commit": "cf23469ead867966fbf21e732b4c8c7bea337b3b",
"method": "rmgr sync --push",
"receipt": {
"schema": "state-hub.repository-projection-reconcile.v1",
"instance_role": "primary",
"instance_label": "railiance01",
"expected_commit": "cf23469ead867966fbf21e732b4c8c7bea337b3b",
"derived_commit": "cf23469ead867966fbf21e732b4c8c7bea337b3b",
"outcome": {
"schema": "state-hub.projection-reset.v1",
"repo_slug": "key-cape",
"commit": "cf23469ead867966fbf21e732b4c8c7bea337b3b",
"status": "applied",
"counts": {
"created": 0,
"updated": 29,
"retired": 0,
"refused": 0,
"released": 0,
"created_tasks": 0,
"updated_tasks": 13,
"cancelled_tasks": 0
},
"created": [],
"updated": [
"ADHOC-2026-09-05",
"ADHOC-2026-09-07",
"KEY-WP-0001",
"KEY-WP-0002",
"KEY-WP-0003",
"KEY-WP-0004",
"KEY-WP-0005",
"KEY-WP-0006",
"KEY-WP-0007",
"KEY-WP-0008",
"KEY-WP-0009",
"KEY-WP-0010",
"KEY-WP-0011",
"KEY-WP-0012",
"KEY-WP-0013",
"KEY-WP-0014",
"KEY-WP-0015",
"KEY-WP-0016",
"KEY-WP-0017",
"KEY-WP-0018",
"KEY-WP-0019",
"KEY-WP-0020",
"KEY-WP-0021",
"KEY-WP-0022",
"KEY-WP-0023",
"KEY-WP-0024",
"KEY-WP-0025",
"KEY-WP-0026",
"KEY-WP-0027"
],
"retired": [],
"released": [],
"created_tasks": [],
"updated_tasks": [
"KEY-WP-0001-T04",
"KEY-WP-0001-T09",
"KEY-WP-0001-T12",
"KEY-WP-0001-T14",
"KEY-WP-0001-T17",
"KEY-WP-0001-T21",
"KEY-WP-0001-T23",
"KEY-WP-0002-T01",
"KEY-WP-0002-T02",
"KEY-WP-0002-T03",
"KEY-WP-0002-T04",
"KEY-WP-0002-T06",
"KEY-WP-0013-T02"
],
"cancelled_tasks": [],
"refused": [],
"notes": []
}
}
},
{
"repo": "railiance-platform",
"commit": "52b24eab9a8aff3396e71b2296d0240a44f3b0db",
"method": "rmgr sync --push",
"receipt": {
"schema": "state-hub.repository-projection-reconcile.v1",
"instance_role": "primary",
"instance_label": "railiance01",
"expected_commit": "52b24eab9a8aff3396e71b2296d0240a44f3b0db",
"derived_commit": "52b24eab9a8aff3396e71b2296d0240a44f3b0db",
"outcome": {
"schema": "state-hub.projection-reset.v1",
"repo_slug": "railiance-platform",
"commit": "52b24eab9a8aff3396e71b2296d0240a44f3b0db",
"status": "applied",
"counts": {
"created": 0,
"updated": 41,
"retired": 0,
"refused": 0,
"released": 0,
"created_tasks": 0,
"updated_tasks": 1,
"cancelled_tasks": 0
},
"created": [],
"updated": [
"RAIL-PL-WP-0001",
"RAIL-PL-WP-0002",
"RPF-WP-0001",
"RPF-WP-0002",
"RPF-WP-0003",
"RPF-WP-0004",
"RPF-WP-0005",
"RPF-WP-0006",
"RPF-WP-0007",
"RPF-WP-0008",
"RPF-WP-0009",
"RPF-WP-0010",
"RPF-WP-0011",
"RPF-WP-0012",
"RPF-WP-0013",
"RPF-WP-0014",
"RPF-WP-0015",
"RPF-WP-0016",
"RPF-WP-0017",
"RPF-WP-0018",
"RPF-WP-0019",
"RPF-WP-0020",
"RPF-WP-0021",
"RPF-WP-0022",
"RPF-WP-0023",
"RPF-WP-0024",
"RPF-WP-0025",
"RPF-WP-0026",
"RPF-WP-0027",
"RPF-WP-0028",
"RPF-WP-0029",
"RPF-WP-0030",
"RPF-WP-0031",
"RPF-WP-0032",
"RPF-WP-0033",
"RPF-WP-0034",
"RPF-WP-0035",
"RPF-WP-0036",
"RPF-WP-0037",
"RPF-WP-0038",
"RPF-WP-ADHOC-2026-08-23"
],
"retired": [],
"released": [],
"created_tasks": [],
"updated_tasks": [
"RPF-WP-0035-T05"
],
"cancelled_tasks": [],
"refused": [],
"notes": []
}
}
},
{
"repo": "prj-helixforge-factory",
"commit": "53051c98f670e16035ca9f687afcfa9f5544ee80",
"method": "rmgr sync --push",
"receipt": {
"schema": "state-hub.repository-projection-reconcile.v1",
"instance_role": "primary",
"instance_label": "railiance01",
"expected_commit": "53051c98f670e16035ca9f687afcfa9f5544ee80",
"derived_commit": "53051c98f670e16035ca9f687afcfa9f5544ee80",
"outcome": {
"schema": "state-hub.projection-reset.v1",
"repo_slug": "prj-helixforge-factory",
"commit": "53051c98f670e16035ca9f687afcfa9f5544ee80",
"status": "applied",
"counts": {
"created": 0,
"updated": 1,
"retired": 0,
"refused": 0,
"released": 0,
"created_tasks": 0,
"updated_tasks": 0,
"cancelled_tasks": 0
},
"created": [],
"updated": [
"HFACT-WP-0001"
],
"retired": [],
"released": [],
"created_tasks": [],
"updated_tasks": [],
"cancelled_tasks": [],
"refused": [],
"notes": []
}
}
}
],
"scoped_retirement": {
"source_commit": "896c1200c0f387cd331ceca11cb6a6586ac815eb",
"duplicate_uuid": "064c5e8b-7852-4d7f-a5fa-e26e406ab8e0",
"duplicate_status": "archived",
"history_preserved": true,
"canonical_uuid": "04685f94-1991-5e62-80d2-5669913e99fc",
"canonical_status": "blocked",
"canonical_handoff_status": "wait",
"retired_only_reviewed_duplicate": true,
"cli_limitation": "rmgr uses the same Idempotency-Key for different acknowledgement payloads at one commit; the retry returned HTTP 409.",
"execution": "Same supported primary reconciliation endpoint, distinct idempotency key for each distinct payload after explicit sole-refusal recheck.",
"receipt": {
"schema": "state-hub.repository-projection-reconcile.v1",
"instance_role": "primary",
"instance_label": "railiance01",
"expected_commit": "896c1200c0f387cd331ceca11cb6a6586ac815eb",
"derived_commit": "896c1200c0f387cd331ceca11cb6a6586ac815eb",
"outcome": {
"schema": "state-hub.projection-reset.v1",
"repo_slug": "net-kingdom",
"commit": "896c1200c0f387cd331ceca11cb6a6586ac815eb",
"status": "applied",
"counts": {
"created": 0,
"updated": 44,
"retired": 1,
"refused": 0,
"released": 0,
"created_tasks": 0,
"updated_tasks": 98,
"cancelled_tasks": 0
},
"created": [],
"updated": [
"NET-WP-0015",
"NET-WP-0016",
"NET-WP-0017",
"NET-WP-0018",
"NET-WP-0019",
"NET-WP-0020",
"NK-WP-0001",
"NK-WP-0002",
"NK-WP-0003",
"NK-WP-0004",
"NK-WP-0005",
"NK-WP-0006",
"NK-WP-0007",
"NK-WP-0008",
"NK-WP-0009",
"NK-WP-0010",
"NK-WP-0011",
"NK-WP-0012",
"NK-WP-0013",
"NK-WP-0014",
"NK-WP-0015",
"NK-WP-0016",
"NK-WP-0017",
"NK-WP-0018",
"NK-WP-0019",
"NK-WP-0021",
"NK-WP-0022",
"NK-WP-0023",
"NK-WP-0024",
"NK-WP-0025",
"NK-WP-0026",
"NK-WP-0027",
"NK-WP-0028",
"NK-WP-0029",
"NK-WP-0030",
"NK-WP-0031",
"NK-WP-0032",
"NK-WP-0033",
"NK-WP-0034",
"NK-WP-0035",
"NK-WP-ADHOC-2026-06-14",
"NK-WP-ADHOC-2026-07-02",
"NK-WP-ADHOC-2026-08-14",
"NK-WP-ADHOC-2026-08-23"
],
"retired": [
"nk-wp-0035"
],
"released": [],
"created_tasks": [],
"updated_tasks": [
"NET-WP-0020-T05",
"NK-WP-0001-T01",
"NK-WP-0001-T02",
"NK-WP-0001-T03",
"NK-WP-0001-T04",
"NK-WP-0001-T05",
"NK-WP-0001-T06",
"NK-WP-0001-T07",
"NK-WP-0001-T08",
"NK-WP-0002-T01",
"NK-WP-0002-T02",
"NK-WP-0002-T03",
"NK-WP-0002-T04",
"NK-WP-0005-T02",
"NK-WP-0005-T03",
"NK-WP-0005-T04",
"NK-WP-0005-T06",
"NK-WP-0005-T07",
"NK-WP-0006-T1",
"NK-WP-0006-T2",
"NK-WP-0006-T3",
"NK-WP-0006-T4",
"NK-WP-0006-T5",
"NK-WP-0006-T6",
"NK-WP-0007-T1",
"NK-WP-0007-T2",
"NK-WP-0007-T3",
"NK-WP-0007-T4",
"NK-WP-0007-T5",
"NK-WP-0009-T01",
"NK-WP-0009-T02",
"NK-WP-0009-T03",
"NK-WP-0009-T04",
"NK-WP-0009-T05",
"NK-WP-0011-T01",
"NK-WP-0011-T02",
"NK-WP-0011-T03",
"NK-WP-0011-T04",
"NK-WP-0011-T05",
"NK-WP-0011-T06",
"NK-WP-0011-T07",
"NK-WP-0012-T1",
"NK-WP-0012-T2",
"NK-WP-0012-T3",
"NK-WP-0012-T4",
"NK-WP-0012-T5",
"NK-WP-0013-T1",
"NK-WP-0013-T2",
"NK-WP-0013-T3",
"NK-WP-0013-T4",
"NK-WP-0013-T5",
"NK-WP-0014-T1",
"NK-WP-0014-T2",
"NK-WP-0014-T3",
"NK-WP-0014-T4",
"NK-WP-0014-T5",
"NK-WP-0015-T1",
"NK-WP-0015-T2",
"NK-WP-0015-T3",
"NK-WP-0015-T4",
"NK-WP-0015-T5",
"NK-WP-0015-T6",
"NK-WP-0016-T1",
"NK-WP-0016-T2",
"NK-WP-0016-T3",
"NK-WP-0016-T4",
"NK-WP-0016-T5",
"NK-WP-0016-T6",
"NK-WP-0017-T1",
"NK-WP-0017-T2",
"NK-WP-0017-T3",
"NK-WP-0017-T4",
"NK-WP-0017-T5",
"NK-WP-0017-T6",
"NK-WP-0018-T1",
"NK-WP-0018-T2",
"NK-WP-0018-T3",
"NK-WP-0018-T4",
"NK-WP-0018-T5",
"NK-WP-0018-T6",
"NK-WP-0019-T1",
"NK-WP-0019-T2",
"NK-WP-0019-T3",
"NK-WP-0019-T4",
"NK-WP-0019-T5",
"NK-WP-0019-T6",
"NK-WP-0021-T01",
"NK-WP-0021-T02",
"NK-WP-0021-T03",
"NK-WP-0021-T04",
"NK-WP-0021-T05",
"NK-WP-0026-T01",
"NK-WP-0033-T05",
"NK-WP-0035-T01",
"NK-WP-0035-T02",
"NK-WP-0035-T03",
"NK-WP-0035-T04",
"NK-WP-0035-T05"
],
"cancelled_tasks": [],
"refused": [],
"notes": []
}
}
},
"final_closeout": {
"recorded_at": "2026-09-08T22:57:10.042009+00:00",
"task_readbacks": [
{
"task": "KEY-WP-0013-T02",
"uuid": "607897c5-bad9-55e5-86df-7802f592d6e8",
"status": "wait",
"needs_human": false,
"intervention_note": null,
"blocking_reason": null,
"description_sha256": "38eca245b19f3d09e6b37b40237dbc7a3b91bb1d90f423e67c1979b81293f621",
"repaired_fields_after_reconcile": [
"description"
],
"verified": true
},
{
"task": "RPF-WP-0035-T05",
"uuid": "e15d62c9-e5da-5721-a135-87c050f7851c",
"status": "wait",
"needs_human": true,
"intervention_note": "Review CCR-2026-0017 and CCR-2026-0018 as platform-operator and key-cape-owner; both pending decisions are linked from the CCRs and the review packet. Signed issuer and exact configuration pin are proved.",
"blocking_reason": null,
"description_sha256": "1f9246f761f3aee40cfb738be53ff42945908dce6de8fcefe4ec50fc34335a7d",
"repaired_fields_after_reconcile": [
"description"
],
"verified": true
},
{
"task": "HFACT-WP-0001-T01",
"uuid": "5cee3251-faf9-5925-8ffd-7a8bf378b0a4",
"status": "wait",
"needs_human": false,
"intervention_note": null,
"blocking_reason": "Project published and registered; both product PR receipts finalized. Exact unattended actor/project/profile, grants, operating owners and enforceable spend contract still require the G0 admission packet.",
"description_sha256": "d01f4c980546d357572faccef5f1b628654db61ab394acbcb914fdbdfc560eba",
"repaired_fields_after_reconcile": [],
"verified": true
},
{
"task": "HFACT-WP-0001-T02",
"uuid": "3a3a967d-5bec-52ee-be20-dc94524b8e85",
"status": "progress",
"needs_human": false,
"intervention_note": null,
"blocking_reason": null,
"description_sha256": "4bf22f0a3d2e51f148c1633df03e6ef2a9d90cc1d3683875d9716228604e9798",
"repaired_fields_after_reconcile": [],
"verified": true
},
{
"task": "HFACT-WP-0001-T03",
"uuid": "67c80db1-01ba-54f1-80ff-76398f9e7823",
"status": "wait",
"needs_human": false,
"intervention_note": "",
"blocking_reason": "Actual signed upstream issuer proved and exact configuration pin verified at Secret revision 58713343. RPF-WP-0035-T05 owns the named pending CCR-2026-0017/0018 reviews; attended custody/compatible rollout and separate audit/client-side/native delivery remain.",
"description_sha256": "7706695faceca2e8c1fa5dcd67a4d3d3c980b6f10a56b4f7ff89696300aa1c2b",
"repaired_fields_after_reconcile": [
"intervention_note"
],
"verified": true
},
{
"task": "HFACT-WP-0001-T04",
"uuid": "1054b135-f367-57b1-9308-72a1fbb38f62",
"status": "wait",
"needs_human": false,
"intervention_note": null,
"blocking_reason": "Local protected artifact installation and installed-path startup proved by SAND-WP-0015-T06. Await trusted owner configuration, T03 native credentials, real-model acceptance and Railiance-specific placement.",
"description_sha256": "2bde066a96176fcdf73b4ca77c7665fa1bd6e083dd6d47d2123b3bdd1f7fe467",
"repaired_fields_after_reconcile": [],
"verified": true
},
{
"task": "HFACT-WP-0001-T05",
"uuid": "2b171ebd-75f3-5ce2-85a9-98e8ab77fd19",
"status": "wait",
"needs_human": false,
"intervention_note": null,
"blocking_reason": "Await actionable admission records, owner credential chain and accepted profile/placement from T02-T04.",
"description_sha256": "4b9e0535a9563d1583e33619d3291bcf68b2c68082ae69b3964636f20ca16315",
"repaired_fields_after_reconcile": [],
"verified": true
},
{
"task": "HFACT-WP-0001-T06",
"uuid": "4d72717a-d5c9-571d-987b-9373f01253fa",
"status": "wait",
"needs_human": false,
"intervention_note": null,
"blocking_reason": "Await the current governed Railiance worker proof in T05.",
"description_sha256": "aedb7c3030499c63df9cc522a06c6fa8c43125f1e4f900dc858b31488a056aa0",
"repaired_fields_after_reconcile": [],
"verified": true
},
{
"task": "HFACT-WP-0001-T07",
"uuid": "a815d9b3-b03e-5764-95c2-fa1a2940611a",
"status": "wait",
"needs_human": false,
"intervention_note": null,
"blocking_reason": "Recovery matrix and measurement ledger are prepared; final live recovery proof requires the deployed T05/T06 configuration.",
"description_sha256": "f9730567f0939057764335526ed1ba4d09f21ace1a3ddf28524d622c16f6d23f",
"repaired_fields_after_reconcile": [],
"verified": true
},
{
"task": "HFACT-WP-0001-T08",
"uuid": "59cfddfb-7cd6-5103-9444-8764e9d51678",
"status": "wait",
"needs_human": false,
"intervention_note": null,
"blocking_reason": "Await useful delivery and operational controls from T06/T07, then the complete fourteen-day observation window.",
"description_sha256": "f801d06c2925350df6471287a731b90928424431308a9387131480ff314a0b85",
"repaired_fields_after_reconcile": [],
"verified": true
}
],
"pending_reviews": [
{
"ccr": "CCR-2026-0017",
"source": "credential-change-requests/CCR-2026-0017-keycape-secrets-engine-approval-client.yaml",
"decision_id": "b533a271-b704-4c5c-98a2-9a5951aadfb6",
"status": "open",
"required_approvers": [
"platform-operator",
"key-cape-owner"
],
"readback_verified": true
},
{
"ccr": "CCR-2026-0018",
"source": "credential-change-requests/CCR-2026-0018-keycape-approval-engine-operator-client.yaml",
"decision_id": "efa90517-0cae-4eb6-a68d-5b0489c84d65",
"status": "open",
"required_approvers": [
"platform-operator",
"key-cape-owner"
],
"readback_verified": true
}
],
"repositories": [
{
"repo": "net-kingdom",
"commit": "896c1200c0f387cd331ceca11cb6a6586ac815eb",
"remote_main_matches": true,
"clean": true
},
{
"repo": "key-cape",
"commit": "cf23469ead867966fbf21e732b4c8c7bea337b3b",
"remote_main_matches": true,
"clean": true
},
{
"repo": "railiance-platform",
"commit": "52b24eab9a8aff3396e71b2296d0240a44f3b0db",
"remote_main_matches": true,
"clean": true
},
{
"repo": "prj-helixforge-factory",
"commit": "53051c98f670e16035ca9f687afcfa9f5544ee80",
"remote_main_matches": true,
"clean": true
}
],
"consistency_checks": [
{
"repo": "key-cape",
"command": "statehub fix-consistency --no-writeback --json",
"summary": {
"fail": 0,
"automation_error": 0,
"warn": 13,
"info": 1
},
"result": "warn"
},
{
"repo": "prj-helixforge-factory",
"command": "statehub fix-consistency --no-writeback --json",
"summary": {
"fail": 0,
"automation_error": 0,
"warn": 2,
"info": 0
},
"result": "warn"
}
],
"progress": [
{
"label": "net-kingdom",
"id": "9f6c31d5-213a-4269-81a5-febd6fdeb2ff",
"workplan_id": null,
"task_id": null
},
{
"label": "key-cape",
"id": "d9f6e931-5b71-41db-a07d-060c3d95267c",
"workplan_id": "6e815d88-b0e3-5ce0-be5d-13ab15917f7f",
"task_id": "607897c5-bad9-55e5-86df-7802f592d6e8"
},
{
"label": "railiance-platform",
"id": "d107f7dd-3db0-460c-92ac-e3b5284ec84f",
"workplan_id": "975db491-5412-5e27-8e34-14a2417bb039",
"task_id": "e15d62c9-e5da-5721-a135-87c050f7851c"
},
{
"label": "factory-identity",
"id": "d403dd34-f406-48f2-b280-38a86afec51e",
"workplan_id": "ed4fe524-036f-5221-8deb-00e24e944de1",
"task_id": "67c80db1-01ba-54f1-80ff-76398f9e7823"
},
{
"label": "factory-hygiene",
"id": "68918c02-e288-420e-b195-4fa20e6466bc",
"workplan_id": "ed4fe524-036f-5221-8deb-00e24e944de1",
"task_id": "3a3a967d-5bec-52ee-be20-dc94524b8e85"
},
{
"label": "custodian",
"id": "21069d35-a6a6-42ad-bc34-a6f1a03cb38e",
"workplan_id": null,
"task_id": null
}
],
"human_needed_count": 16
},
"remaining_owner_records": {
"RPF-WP-0035-T05": "Two named custody reviews and completion/exercise of the contained first-provision procedure before the attended activation window.",
"KEY-WP-0013-T02": "Admitted custody, compatible config/image rollout, service-client positive/negative checks and existing-human-login regression.",
"HFACT-WP-0001-T02": "Repo Manager acknowledgement retry must bind idempotency key to request semantics; source/Hub field parity remains a checked limitation.",
"HFACT-WP-0001-T03": "Consume live custody/identity/approval/audit/client-side/native delivery for the exact factory proof tuple."
}
}

61
docs/assessments/2026-09-09-helixforge-issuer-pin.md Normal file
View file

@ -0,0 +1,61 @@
# HelixForge critical path: issuer pin complete, custody reviews ready
NetKingdom completed the stored upstream issuer prerequisite on 2026-09-09
(2026-09-08T22:23:58Z). Its live configuration was missing `authelia.issuer`;
the contained owner helper inserted the independently verified
`https://auth.coulomb.social` value and read it back successfully.
The Secret UID stayed the same and its resourceVersion advanced from `51346058`
to `58713343`. Atomic UID/revision preconditions prevented a stale write. Every
other configuration byte and Secret data entry, including the signing key, was
preserved. The Deployment stayed at generation 29, image `main-153258b`, with
one ready and available replica. No credential value entered output or evidence.
The owner implementation extends the existing configuration helper with two
issuer-only modes; its legacy client/LLDAP patch mode was not used. All thirteen
tests passed, including concurrency, byte preservation and error containment.
The read and write procedures are both exercised against the actual target.
[Owner procedure](/home/worsch/net-kingdom/docs/keycape-upstream-issuer-pin.md).
This closes one concrete prerequisite inside KEY-WP-0013-T02 and
HFACT-WP-0001-T03. Those tasks still wait for custody and the compatible
image/configuration rollout. A stored pin does not prove that the existing
process reloaded it or that downstream login regression has passed.
The next human dependency is now actionable in its existing owner record,
RPF-WP-0035-T05. Both existing CCRs have pending review decisions:
| Request | Pending decision | Required reviewers |
| --- | --- | --- |
| CCR-2026-0017 | `b533a271-b704-4c5c-98a2-9a5951aadfb6` | platform-operator, key-cape-owner |
| CCR-2026-0018 | `efa90517-0cae-4eb6-a68d-5b0489c84d65` | platform-operator, key-cape-owner |
[The review packet](/home/worsch/railiance-platform/docs/credential-lane-designs/keycape-approval-clients-review.md)
sets out the exact paths, two separate policies/roles/stores, namespace and
service-account binding, TTL, risks and excluded capabilities. Both CCRs validate
and their generated policies match source. Both still refuse `apply-plan`
because they are proposed. No owner review, custody activation or client-side
credential access has been inferred from the user's continuation instruction.
The generated plans still leave initial secret provisioning to a contained
owner procedure. That procedure must be completed and exercised before the
attended activation window; a successful capabilities preflight does not establish
that it is ready. This remaining work stays with RPF-WP-0035-T05 and the linked
KeyCape rollout, alongside their existing rollback and live acceptance duties.
Efficiency has improved in two concrete ways: the issuer pin no longer requires
manual configuration reconstruction, and the custody review is now a pair of
linked decisions owned by one task instead of an unstructured cross-repository
wait. No elapsed-time saving or factory throughput result is claimed. The
fourteen-day operating observation remains unstarted.
Final synchronization also cleared the sole already owner-archived NetKingdom
duplicate after a [scoped review](2026-09-09-netkingdom-projection-review.json).
Its history remains readable, and the canonical profile handoff remains waiting.
Repo Manager's acknowledgement retry reused an idempotency key with a changed
payload and received HTTP 409. The supported primary endpoint completed the
reviewed operation using distinct request keys. HFACT-WP-0001-T02 retains the
CLI fix and regression test; this receipt does not claim that defect is fixed.
[Execution, synchronization and progress receipt](2026-09-09-helixforge-issuer-pin.json)
contains the live evidence, published owner revisions and final Hub readbacks.

27
docs/assessments/2026-09-09-netkingdom-projection-review.json Normal file
View file

@ -0,0 +1,27 @@
{
"schema": "custodian.scoped-projection-retirement-review.v1",
"reviewed_by": "codex",
"owner_task": "HFACT-WP-0001-T02",
"repo": "net-kingdom",
"expected_commit": "896c1200c0f387cd331ceca11cb6a6586ac815eb",
"target": {
"uuid": "064c5e8b-7852-4d7f-a5fa-e26e406ab8e0",
"slug": "nk-wp-0035",
"status": "archived",
"backing_relative_path": "workplans/NK-WP-0035-emission-cadence-security-profile.md",
"prior_owner_disposition": "Hub description records owner-approved archival on 2026-09-07: forbidden hand-registration duplicated the canonical source-derived record, with nothing unique retained here.",
"task_statuses": ["done", "done", "cancel", "done"]
},
"canonical_record": {
"uuid": "04685f94-1991-5e62-80d2-5669913e99fc",
"source_id": "NK-WP-0035",
"status": "blocked",
"retained_open_task_uuid": "e3fbc8b8-00d5-57ce-ba0c-19b58044c950",
"retained_open_task_status": "wait"
},
"operation": "Reconcile the exact published repository and acknowledge only the already archived duplicate after confirming it is the sole retirement refusal.",
"implementation_review": "state-hub/api/services/forge_projection.py marks projection_retired_at, records the reason and tombstones the stale slug. It does not delete the old workplan or task history.",
"abort": "Any different source commit, additional retirement refusal, changed duplicate disposition, nonterminal duplicate task or missing canonical waiting task.",
"acceptance": "Applied exact-commit primary receipt retires only nk-wp-0035; canonical workplan remains blocked and canonical handoff remains wait; old record and four terminal tasks remain readable.",
"execution_status": "reviewed_before_execution"
}