coulomb/the-custodian
4
0
Fork 0
Code Issues 1 Pull requests Projects Releases Packages Wiki Activity Actions

docs(factory): retain verified critical-path execution and admission handoff
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source
This commit is contained in:
codex 2026-09-08 20:49:06 +02:00
parent f3cd554ad6
commit d60f5a1274
4 changed files with 208 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

46
docs/assessments/2026-09-08-helixforge-factory-critical-path.md Normal file
View file

@ -0,0 +1,46 @@
# Factory critical-path execution — 2026-09-08
Implemented and published prerequisite corrections in ops-warden, key-cape,
approval-engine and audit-core. The canonical integration workplan and next
admission sequence remain in
[prj-helixforge-factory](/home/worsch/prj-helixforge-factory/operations/identity-admission.md).
| Delivered | Evidence | Effect |
| --- | --- | --- |
| Warden preserves explicit policy refusal | Code `31d9b66`; 429 tests passed, four integration tests excluded by the normal suite configuration; Ruff passed. Existing SSH probe still HTTP 200/ALLOW. Installed credential request now HTTP 403 / exit 4 before transport. | Replaces misleading “unavailable / fail-open” behavior with the actual caller/owner binding refusal. WARDEN-WP-0039-T03 owns that live admission. |
| Installer refreshes the actual Warden package | `19bb75c`; initial `--force` reused a cached wheel, while `--reinstall-package ops-warden` installed the corrected source. Installed module and behavior checked. | A published fix now reaches the executing CLI. |
| KeyCape requires genuine issuer denial | `dcebd46`; complete Go suite and vet passed. Negative checks reject timeouts, server errors, invalid tokens and unrelated refusals. Image pulled by immutable digest. | Prevents false successful scope/predecessor proofs. KEY-WP-0013-T06 is done. |
| Approval audit scope is exact | Approval `b46b0f2`, Audit `bbe8c15`; 81 receiver and six sender checks passed. Exact `tenant:platform`, source approval-engine, write-only/load-bearing, explicit redact. | Resolves both tenant/redaction input waits and removes the proposed wildcard tenant scope. Credential and live admission remain open. |
| KeyCape rollout is concrete | Pinned candidate plus two credential refs, `/readyz`, and single-instance replacement passed Railiance server dry-run. Rollback restores the compatible config/image pair. | The next attended rollout starts from a reviewed patch, with known configuration and credential prerequisites. No production deployment performed. |
The human approver UI/callback is now its own KEY-WP-0013-T05 task. Its absence
does not block the independent service registrations or approval service startup.
It still blocks evidence requiring a real human approver. Together with the two
audit inputs, three source-input waits are removed from the service-startup
path; no live security gate is marked complete by that separation.
The project now records thirteen source-pinned supplying records, including
RPF-WP-0035-T05 / proposed CCR-2026-0017/0018 and WARDEN-WP-0039-T03.
The two CCRs explicitly cover verifier-side delivery only. Client-side read
lanes and linked approval audit receiver/sender custody remain distinct returns.
The immediate sequence is: verify the actual upstream ID-token issuer; obtain
the named custody reviews and run the contained attended first provision;
deploy and verify KeyCape; admit audit/consumer credentials; prove deployed
approval claim/consume and native model credential delivery. Exact policy
binding and required human-approval evidence remain explicit. Runtime placement
preparation can proceed alongside this chain. The factory's exact operating
grant and enforceable budget still precede paid execution.
All four modified owner repos returned zero consistency failures. The checks
retain historical/advisory warnings where applicable; canonical reconciliation
then projected published source. Five new task assignees were empty despite
source metadata and were corrected through the supported API with readback.
HFACT-WP-0001-T02 retains that projection parity issue.
[Published evidence](/home/worsch/prj-helixforge-factory/evidence/2026-09-08-critical-path.json)
records revisions, validations and the dry-run. These changes reduce ambiguous
handoffs and unreliable checks. Time saved and autonomous throughput are not
measured. No secrets were provisioned, no new policy binding granted and no
paid model run admitted; G0–G5 remain open and the fourteen-day window has not
started.