diff --git a/docs/assessments/2026-09-08-helixforge-factory-critical-path.md b/docs/assessments/2026-09-08-helixforge-factory-critical-path.md new file mode 100644 index 0000000..60a3983 --- /dev/null +++ b/docs/assessments/2026-09-08-helixforge-factory-critical-path.md @@ -0,0 +1,46 @@ +# Factory critical-path execution — 2026-09-08 + +Implemented and published prerequisite corrections in ops-warden, key-cape, +approval-engine and audit-core. The canonical integration workplan and next +admission sequence remain in +[prj-helixforge-factory](/home/worsch/prj-helixforge-factory/operations/identity-admission.md). + +| Delivered | Evidence | Effect | +| --- | --- | --- | +| Warden preserves explicit policy refusal | Code `31d9b66`; 429 tests passed, four integration tests excluded by the normal suite configuration; Ruff passed. Existing SSH probe still HTTP 200/ALLOW. Installed credential request now HTTP 403 / exit 4 before transport. | Replaces misleading “unavailable / fail-open” behavior with the actual caller/owner binding refusal. WARDEN-WP-0039-T03 owns that live admission. | +| Installer refreshes the actual Warden package | `19bb75c`; initial `--force` reused a cached wheel, while `--reinstall-package ops-warden` installed the corrected source. Installed module and behavior checked. | A published fix now reaches the executing CLI. | +| KeyCape requires genuine issuer denial | `dcebd46`; complete Go suite and vet passed. Negative checks reject timeouts, server errors, invalid tokens and unrelated refusals. Image pulled by immutable digest. | Prevents false successful scope/predecessor proofs. KEY-WP-0013-T06 is done. | +| Approval audit scope is exact | Approval `b46b0f2`, Audit `bbe8c15`; 81 receiver and six sender checks passed. Exact `tenant:platform`, source approval-engine, write-only/load-bearing, explicit redact. | Resolves both tenant/redaction input waits and removes the proposed wildcard tenant scope. Credential and live admission remain open. | +| KeyCape rollout is concrete | Pinned candidate plus two credential refs, `/readyz`, and single-instance replacement passed Railiance server dry-run. Rollback restores the compatible config/image pair. | The next attended rollout starts from a reviewed patch, with known configuration and credential prerequisites. No production deployment performed. | + +The human approver UI/callback is now its own KEY-WP-0013-T05 task. Its absence +does not block the independent service registrations or approval service startup. +It still blocks evidence requiring a real human approver. Together with the two +audit inputs, three source-input waits are removed from the service-startup +path; no live security gate is marked complete by that separation. + +The project now records thirteen source-pinned supplying records, including +RPF-WP-0035-T05 / proposed CCR-2026-0017/0018 and WARDEN-WP-0039-T03. +The two CCRs explicitly cover verifier-side delivery only. Client-side read +lanes and linked approval audit receiver/sender custody remain distinct returns. + +The immediate sequence is: verify the actual upstream ID-token issuer; obtain +the named custody reviews and run the contained attended first provision; +deploy and verify KeyCape; admit audit/consumer credentials; prove deployed +approval claim/consume and native model credential delivery. Exact policy +binding and required human-approval evidence remain explicit. Runtime placement +preparation can proceed alongside this chain. The factory's exact operating +grant and enforceable budget still precede paid execution. + +All four modified owner repos returned zero consistency failures. The checks +retain historical/advisory warnings where applicable; canonical reconciliation +then projected published source. Five new task assignees were empty despite +source metadata and were corrected through the supported API with readback. +HFACT-WP-0001-T02 retains that projection parity issue. + +[Published evidence](/home/worsch/prj-helixforge-factory/evidence/2026-09-08-critical-path.json) +records revisions, validations and the dry-run. These changes reduce ambiguous +handoffs and unreliable checks. Time saved and autonomous throughput are not +measured. No secrets were provisioned, no new policy binding granted and no +paid model run admitted; G0–G5 remain open and the fourteen-day window has not +started. diff --git a/docs/assessments/2026-09-08-helixforge-factory-followthrough.md b/docs/assessments/2026-09-08-helixforge-factory-followthrough.md index 0c53bda..81732e1 100644 --- a/docs/assessments/2026-09-08-helixforge-factory-followthrough.md +++ b/docs/assessments/2026-09-08-helixforge-factory-followthrough.md @@ -1,5 +1,9 @@ # Factory implementation return — 2026-09-08 +Later execution: [critical-path corrections and next admission](2026-09-08-helixforge-factory-critical-path.md) +records the installed policy fix, pinned KeyCape rollout candidate, resolved +audit scope inputs and thirteen updated owner-return records. + The user authorized following through and selected vergabe-teilnahme as the primary customer service/UI product. The Custodian selected reuse-surface for the first internal capability: its existing hosted registry offers immediate @@ -48,10 +52,11 @@ restored to disabled. Current main ancestry was verified before the operations. Non-secret [publication receipts](https://forgejo.coulomb.social/coulomb/prj-helixforge-factory/src/branch/main/evidence/pr-merge-receipts.json) are retained in the project. -The credential proxy reported flex-auth unavailable and its configured -unknown-zone fail-open behavior during this attended publication. HFACT-WP-0001-T03 -retains live policy availability and authorization-negative verification before -governed execution acceptance. Login success is not that enforcement proof. +The credential proxy reported flex-auth unavailable and unknown-zone fail-open +during publication. Subsequent critical-path execution reproduced an explicit +HTTP 403 from the reachable PDP, fixed that misclassification and verified the +installed CLI now refuses before credential transport. WARDEN-WP-0039-T03 and +HFACT-WP-0001-T03 retain the exact delegated policy binding and live admission. The workplan retains exact native credential/approval/audit receipts through GLAS-WP-0015, protected runtime placement, natural worker claim/heartbeat/close, diff --git a/docs/assessments/2026-09-08-helixforge-factory/critical-path-final.json b/docs/assessments/2026-09-08-helixforge-factory/critical-path-final.json new file mode 100644 index 0000000..a16d761 --- /dev/null +++ b/docs/assessments/2026-09-08-helixforge-factory/critical-path-final.json @@ -0,0 +1,133 @@ +{ + "project_commit": "ceae2b4d1c642357b8a978128f0158a65a50ca69", + "workplan_id": "ed4fe524-036f-5221-8deb-00e24e944de1", + "topic_id": "f39fa2a3-c491-414c-a91b-b4c5fcc6139c", + "tasks": [ + { + "record_id": "HFACT-WP-0001-T01", + "id": "5cee3251-faf9-5925-8ffd-7a8bf378b0a4", + "status": "wait", + "assignee": "the-custodian", + "blocking_reason": "Project published and registered; both product PR receipts finalized. Exact unattended actor/project/profile, grants, operating owners and enforceable spend contract still require the G0 admission packet." + }, + { + "record_id": "HFACT-WP-0001-T02", + "id": "3a3a967d-5bec-52ee-be20-dc94524b8e85", + "status": "progress", + "assignee": "the-custodian", + "blocking_reason": null + }, + { + "record_id": "HFACT-WP-0001-T03", + "id": "67c80db1-01ba-54f1-80ff-76398f9e7823", + "status": "wait", + "assignee": "the-custodian", + "blocking_reason": "Corrected verifier image and exact audit scope published. Await actual upstream issuer proof, RPF-WP-0035-T05/CCR-2026-0017/0018 activation, separate client-side/audit custody and live approval/native delivery; WARDEN-WP-0039-T03 retains explicit credential-policy binding refusal." + }, + { + "record_id": "HFACT-WP-0001-T04", + "id": "1054b135-f367-57b1-9308-72a1fbb38f62", + "status": "wait", + "assignee": "the-custodian", + "blocking_reason": "Source preparation authorized; real-model acceptance requires T03 native credentials and the protected runtime installation receipt." + }, + { + "record_id": "HFACT-WP-0001-T05", + "id": "2b171ebd-75f3-5ce2-85a9-98e8ab77fd19", + "status": "wait", + "assignee": "the-custodian", + "blocking_reason": "Await actionable admission records, owner credential chain and accepted profile/placement from T02-T04." + }, + { + "record_id": "HFACT-WP-0001-T06", + "id": "4d72717a-d5c9-571d-987b-9373f01253fa", + "status": "wait", + "assignee": "the-custodian", + "blocking_reason": "Await the current governed Railiance worker proof in T05." + }, + { + "record_id": "HFACT-WP-0001-T07", + "id": "a815d9b3-b03e-5764-95c2-fa1a2940611a", + "status": "wait", + "assignee": "the-custodian", + "blocking_reason": "Recovery matrix and measurement ledger are prepared; final live recovery proof requires the deployed T05/T06 configuration." + }, + { + "record_id": "HFACT-WP-0001-T08", + "id": "59cfddfb-7cd6-5103-9444-8764e9d51678", + "status": "wait", + "assignee": "the-custodian", + "blocking_reason": "Await useful delivery and operational controls from T06/T07, then the complete fourteen-day observation window." + } + ], + "progress_id": "d26a938e-43f7-4413-ada6-c63dbe2a22c9", + "owner_progress": [ + { + "repo": "ops-warden", + "workplan_id": "ae44a935-6fca-514c-a385-4550dd2b1fe8", + "progress_id": "a532420d-0ff1-4984-bdb3-594014d282fc", + "source_commit": "3a01b8f1b50d5f20cbbbfca1aaec619f95cacf2c" + }, + { + "repo": "key-cape", + "workplan_id": "6e815d88-b0e3-5ce0-be5d-13ab15917f7f", + "progress_id": "36b23deb-7716-476c-bceb-2fb4f7c50e7f", + "source_commit": "5c7db26b7cb128141b4d6cd8de020a44036dba05" + }, + { + "repo": "approval-engine", + "workplan_id": "4fa25ad5-f5d0-5592-aa59-085f8ee3edaf", + "progress_id": "7404f9a5-621c-42fc-b740-eb04b2281bb9", + "source_commit": "b46b0f26669dc83c944ee5145426bad03d5ef720" + }, + { + "repo": "audit-core", + "workplan_id": "46a96b03-bc08-53b5-9c93-4071adabf734", + "progress_id": "1f22f0f4-1cce-49e0-a40e-8fae605a81bf", + "source_commit": "565e7e38d486ca2fe2fc15f93e32617c2fb89992" + } + ], + "owner_task_readback": [ + { + "id": "eaad08d9-ae47-5f50-8278-ea402a0e2869", + "record_id": "WARDEN-WP-0039-T01", + "status": "done", + "assignee": "the-custodian", + "blocking_reason": null + }, + { + "id": "ac85cf00-391c-5c63-b8f4-ed5bd57684e5", + "record_id": "WARDEN-WP-0039-T02", + "status": "done", + "assignee": "the-custodian", + "blocking_reason": null + }, + { + "id": "8ca28b63-2e04-5333-b635-011b124c1806", + "record_id": "WARDEN-WP-0039-T03", + "status": "wait", + "assignee": "the-custodian", + "blocking_reason": "The configured ops-warden caller represents ops-warden; credential requests name their owner as resource.system. Need the flex-auth/credential-owner contract for that exact delegated read, without broadening caller bindings or relabelling resource ownership." + }, + { + "id": "9a782909-91db-59fa-aae7-83766f4fbb0d", + "record_id": "KEY-WP-0013-T05", + "status": "wait", + "assignee": "the-custodian", + "blocking_reason": "An actual approver UI owner, client ID and deployed callback are not yet supplied. approval-engine is a bearer-only resource server." + }, + { + "id": "65132e1d-10db-5915-a664-83beaf30365a", + "record_id": "KEY-WP-0013-T06", + "status": "done", + "assignee": "the-custodian", + "blocking_reason": null + } + ], + "project_consistency": { + "fail": 0, + "automation_error": 0, + "warn": 1, + "info": 0 + } +} diff --git a/docs/assessments/2026-09-08-helixforge-factory/critical-path-projection.json b/docs/assessments/2026-09-08-helixforge-factory/critical-path-projection.json new file mode 100644 index 0000000..f4af888 --- /dev/null +++ b/docs/assessments/2026-09-08-helixforge-factory/critical-path-projection.json @@ -0,0 +1,20 @@ +{ + "ok": true, + "status": "applied", + "repo_slug": "prj-helixforge-factory", + "commit": "ceae2b4d1c642357b8a978128f0158a65a50ca69", + "instance_role": "primary", + "instance_label": "railiance01", + "expected_commit": "ceae2b4d1c642357b8a978128f0158a65a50ca69", + "derived_commit": "ceae2b4d1c642357b8a978128f0158a65a50ca69", + "counts": { + "created": 0, + "updated": 1, + "retired": 0, + "refused": 0, + "released": 0, + "created_tasks": 0, + "updated_tasks": 1, + "cancelled_tasks": 0 + } +}