Admit reviewed receiver evidence batch 3
This commit is contained in:
codex
parent
5994d4208b
commit
f4a672f3aa
24 changed files with 14424 additions and 0 deletions
File diff suppressed because it is too large
Load diff
|
|
@ -0,0 +1,86 @@
|
|||
{
|
||||
"schema": "state95.workplan-followthrough-readback.v1",
|
||||
"status": "applied",
|
||||
"source_revision": "9eaa36143ea18111c522ea14d32978495b4e5030",
|
||||
"remote_revision": "9eaa36143ea18111c522ea14d32978495b4e5030",
|
||||
"instance_role": "primary",
|
||||
"instance_label": "railiance01",
|
||||
"expected_commit": "9eaa36143ea18111c522ea14d32978495b4e5030",
|
||||
"derived_commit": "9eaa36143ea18111c522ea14d32978495b4e5030",
|
||||
"tasks": [
|
||||
{
|
||||
"uuid": "6a5f87bb-e63d-5e20-b9fc-c1b5cd403ff7",
|
||||
"record_id": "STATE-WP-0095-T01",
|
||||
"status": "done",
|
||||
"needs_human": false
|
||||
},
|
||||
{
|
||||
"uuid": "ebb24194-e4cc-5130-aaa6-663f2ea2c822",
|
||||
"record_id": "STATE-WP-0095-T02",
|
||||
"status": "done",
|
||||
"needs_human": false
|
||||
},
|
||||
{
|
||||
"uuid": "e8566341-cf6e-5b9c-ad80-8564d14cd52a",
|
||||
"record_id": "STATE-WP-0095-T03",
|
||||
"status": "done",
|
||||
"needs_human": false
|
||||
},
|
||||
{
|
||||
"uuid": "3bbb311f-194e-5862-8aed-358a580f22b4",
|
||||
"record_id": "STATE-WP-0095-T04",
|
||||
"status": "done",
|
||||
"needs_human": false
|
||||
},
|
||||
{
|
||||
"uuid": "339b9a37-181c-5599-9a89-0393e199bd4b",
|
||||
"record_id": "STATE-WP-0095-T05",
|
||||
"status": "done",
|
||||
"needs_human": false
|
||||
},
|
||||
{
|
||||
"uuid": "6af973b4-1964-5d4d-a2f8-8dbd4c01fda4",
|
||||
"record_id": "STATE-WP-0095-T06",
|
||||
"status": "done",
|
||||
"needs_human": false
|
||||
},
|
||||
{
|
||||
"uuid": "cfd1ea99-e75b-542e-a434-acefb62f3c7d",
|
||||
"record_id": "STATE-WP-0095-T07",
|
||||
"status": "wait",
|
||||
"needs_human": false
|
||||
},
|
||||
{
|
||||
"uuid": "2dd9b04f-2250-5a8a-b5bc-c8a009872858",
|
||||
"record_id": "STATE-WP-0095-T08",
|
||||
"status": "done",
|
||||
"needs_human": false
|
||||
},
|
||||
{
|
||||
"uuid": "8be8f13b-6352-5295-9755-de6fbfb13593",
|
||||
"record_id": "STATE-WP-0095-T09",
|
||||
"status": "done",
|
||||
"needs_human": false
|
||||
},
|
||||
{
|
||||
"uuid": "88585c69-d9b9-5e1f-a256-6416ff71e824",
|
||||
"record_id": "STATE-WP-0095-T10",
|
||||
"status": "wait",
|
||||
"needs_human": true
|
||||
}
|
||||
],
|
||||
"new_dependency": {
|
||||
"id": "713e6db5-7574-4ade-a750-84bdde02f80a",
|
||||
"from_workplan_id": "79579572-8120-5d3b-aca5-dd4aff60d058",
|
||||
"from_task_id": "cfd1ea99-e75b-542e-a434-acefb62f3c7d",
|
||||
"to_task_id": "88585c69-d9b9-5e1f-a256-6416ff71e824",
|
||||
"relationship_type": "starts_after",
|
||||
"source_owner": "forge:state-hub",
|
||||
"source_commit": "9eaa36143ea18111c522ea14d32978495b4e5030"
|
||||
},
|
||||
"unchanged_old_edge_creation_commits_not_rewritten": true,
|
||||
"whole_unrelated_index_dirty_preserved": true,
|
||||
"runtime_source": "c103cbf3c8bed5dba87a03e320595ddded9301a3",
|
||||
"runtime_changed": false,
|
||||
"new_UUIDs": false
|
||||
}
|
||||
|
|
@ -0,0 +1,39 @@
|
|||
--- a/workplans/STATE-WP-0095-historical-source-receiving.md
|
||||
+++ b/workplans/STATE-WP-0095-historical-source-receiving.md
|
||||
@@ -237,7 +237,7 @@
|
||||
id: STATE-WP-0095-T07
|
||||
status: wait
|
||||
priority: high
|
||||
-depends_on: [STATE-WP-0095-T06, RMGR-WP-0019-T06]
|
||||
+depends_on: [STATE-WP-0095-T06, RMGR-WP-0019-T06, STATE-WP-0095-T10]
|
||||
state_hub_task_id: "cfd1ea99-e75b-542e-a434-acefb62f3c7d"
|
||||
```
|
||||
|
||||
@@ -357,3 +357,27 @@
|
||||
before any retry; capture legitimate source HEAD transitions rather than assume
|
||||
a static revision. T07 and T10 remain wait. No original parent preimage recovery,
|
||||
new runtime delivery or broader authority follows from this source repair.
|
||||
+
|
||||
+
|
||||
+T07 current-baseline client return, 2026-10-17: after the owner refreshed the
|
||||
+installed package and verified the actually loaded checker matched the reviewed
|
||||
+R6 source, ordinary Cluster deep consistency and fast projection passed.
|
||||
+Bindings synced 20/20, omitting the three frozen histories; all three parent
|
||||
+and 15 task CURRENT full-row hashes remained unchanged across
|
||||
+before-verified-client.json / after-verified-client.json. Unrelated staged brief
|
||||
+state was preserved. This proves the corrected installed client stage against
|
||||
+its fresh current baseline; earlier parent-hash failures remain retained
|
||||
+historical exceptions, not restored preimages or backfilled successes.
|
||||
+
|
||||
+T10 remains wait/needs_human for exact proposal
|
||||
+STATE-WP-0095-T10-frozen-bindings-guard-r1 revision 1, metadata
|
||||
+sha256:81d365926fc585a186955d8c98ee83501fd3cec12135b2256d71b46a75097932,
|
||||
+pending decision df703266-6719-4c04-ae1b-ba9afd3bca1c. The inspected candidate
|
||||
+image is main-c103cbf@sha256:4cc4ce17bbcdb1b66132d07c5b7b741f46df83124ef1c8403ffabdafba6993d1,
|
||||
+from runtime source c103cbf3c8bed5dba87a03e320595ddded9301a3. Image-only
|
||||
+server dry-run passed eight identities with only three image-field changes.
|
||||
+The exact proposal and recovery limits are retained in the Custodian dated
|
||||
+2026-10-17 guard-successor-review-r1 packet. No new API runtime is approved or
|
||||
+delivered by this source-only note; its later workplan commit does not change
|
||||
+the image's source pin. T09 stays done, T07/T10 stay wait pending reviewed API
|
||||
+delivery and explicit successor/current-baseline acceptance disposition.
|
||||
|
|
@ -0,0 +1,8 @@
|
|||
{
|
||||
"task_blocks": 10,
|
||||
"all_UUIDs_statuses_needs_human_unchanged": true,
|
||||
"only_task_field_change": "T07.depends_on adds STATE-WP-0095-T10",
|
||||
"proposal_metadata_digest_verified": true,
|
||||
"canonical_mutation": false,
|
||||
"runtime_changed": false
|
||||
}
|
||||
|
|
@ -0,0 +1,16 @@
|
|||
{
|
||||
"schema": "state95.proposal-revision-followthrough.v1",
|
||||
"base_revision": "9eaa36143ea18111c522ea14d32978495b4e5030",
|
||||
"files": [
|
||||
{
|
||||
"path": "workplans/STATE-WP-0095-historical-source-receiving.md",
|
||||
"base_sha256": "df055846c34f4e4eb9dc1fcc88969efd40bfca9daad1df006f7527e9b6d6c9e7",
|
||||
"candidate_sha256": "163acbdf8252f37e309f4cb0b51d48706c6bd43d439fdbf7802b953b78ae35ac"
|
||||
}
|
||||
],
|
||||
"patch_sha256": "sha256:83bf9a6d6f7dc9de6856aca30b3d10c5e715214132ab715f15a8f0caeef9c935",
|
||||
"new_UUIDs": false,
|
||||
"runtime_changed": false,
|
||||
"proposal_id": "STATE-WP-0095-T10-frozen-bindings-guard-r1",
|
||||
"revision": 2
|
||||
}
|
||||
|
|
@ -0,0 +1,198 @@
|
|||
{
|
||||
"ok": true,
|
||||
"status": "applied",
|
||||
"repo_slug": "state-hub",
|
||||
"commit": "4c03c9d2c6a47f5c7247473f74b2e2f188b787bd",
|
||||
"requests": 2,
|
||||
"elapsed_ms": 10221.2,
|
||||
"git": {
|
||||
"upstream": "origin/main",
|
||||
"behind": 0,
|
||||
"ahead": 0
|
||||
},
|
||||
"identifiers": {
|
||||
"schema": "repo-manager.identifier-assignment.v1",
|
||||
"ok": true,
|
||||
"executed": true,
|
||||
"repo": "state-hub",
|
||||
"namespace": "helixforge",
|
||||
"assignments": [],
|
||||
"historical_invalid_identifiers": [],
|
||||
"historical_identity_collisions": [],
|
||||
"files_changed": []
|
||||
},
|
||||
"receipt": {
|
||||
"schema": "state-hub.repository-projection-reconcile.v1",
|
||||
"instance_role": "primary",
|
||||
"instance_label": "railiance01",
|
||||
"expected_commit": "4c03c9d2c6a47f5c7247473f74b2e2f188b787bd",
|
||||
"derived_commit": "4c03c9d2c6a47f5c7247473f74b2e2f188b787bd",
|
||||
"outcome": {
|
||||
"schema": "state-hub.projection-reset.v1",
|
||||
"repo_slug": "state-hub",
|
||||
"commit": "4c03c9d2c6a47f5c7247473f74b2e2f188b787bd",
|
||||
"status": "applied",
|
||||
"counts": {
|
||||
"created": 0,
|
||||
"updated": 70,
|
||||
"retired": 0,
|
||||
"refused": 0,
|
||||
"released": 0,
|
||||
"created_tasks": 0,
|
||||
"updated_tasks": 1,
|
||||
"cancelled_tasks": 0,
|
||||
"created_edges": 0,
|
||||
"removed_edges": 0,
|
||||
"unresolved_edges": 0,
|
||||
"external_edges": 6
|
||||
},
|
||||
"created": [],
|
||||
"updated": [
|
||||
"CUST-WP-0003",
|
||||
"CUST-WP-0011",
|
||||
"CUST-WP-0012",
|
||||
"CUST-WP-0038",
|
||||
"CUST-WP-0042",
|
||||
"STATE-WP-0043",
|
||||
"STATE-WP-0044",
|
||||
"STATE-WP-0045",
|
||||
"STATE-WP-0046",
|
||||
"STATE-WP-0047",
|
||||
"STATE-WP-0048",
|
||||
"STATE-WP-0049",
|
||||
"STATE-WP-0050",
|
||||
"STATE-WP-0051",
|
||||
"STATE-WP-0052",
|
||||
"STATE-WP-0053",
|
||||
"STATE-WP-0054",
|
||||
"STATE-WP-0055",
|
||||
"STATE-WP-0056",
|
||||
"STATE-WP-0057",
|
||||
"STATE-WP-0058",
|
||||
"STATE-WP-0059",
|
||||
"STATE-WP-0060",
|
||||
"STATE-WP-0061",
|
||||
"STATE-WP-0062",
|
||||
"STATE-WP-0063",
|
||||
"STATE-WP-0064",
|
||||
"STATE-WP-0065",
|
||||
"STATE-WP-0066",
|
||||
"STATE-WP-0067",
|
||||
"STATE-WP-0068",
|
||||
"STATE-WP-0069",
|
||||
"STATE-WP-0070",
|
||||
"STATE-WP-0071",
|
||||
"STATE-WP-0072",
|
||||
"STATE-WP-0073",
|
||||
"STATE-WP-0074",
|
||||
"STATE-WP-0075",
|
||||
"STATE-WP-0076",
|
||||
"STATE-WP-0077",
|
||||
"STATE-WP-0078",
|
||||
"STATE-WP-0079",
|
||||
"STATE-WP-0080",
|
||||
"STATE-WP-0081",
|
||||
"STATE-WP-0082",
|
||||
"STATE-WP-0083",
|
||||
"STATE-WP-0084",
|
||||
"STATE-WP-0085",
|
||||
"STATE-WP-0086",
|
||||
"STATE-WP-0087",
|
||||
"STATE-WP-0088",
|
||||
"STATE-WP-0089",
|
||||
"STATE-WP-0090",
|
||||
"STATE-WP-0091",
|
||||
"STATE-WP-0092",
|
||||
"STATE-WP-0093",
|
||||
"STATE-WP-0094",
|
||||
"STATE-WP-0095",
|
||||
"STATE-WP-0096",
|
||||
"STATE-WP-0097",
|
||||
"STATE-WP-0098",
|
||||
"STATE-WP-ADHOC-2026-06-04",
|
||||
"STATE-WP-ADHOC-2026-07-01",
|
||||
"STATE-WP-ADHOC-2026-08-08",
|
||||
"STATE-WP-ADHOC-2026-08-23",
|
||||
"STATE-WP-ADHOC-2026-08-30",
|
||||
"STATE-WP-ADHOC-2026-09-04",
|
||||
"STATE-WP-ADHOC-2026-09-22",
|
||||
"STATE-WP-ADHOC-2026-10-06",
|
||||
"STATE-WP-ADHOC-2026-10-13"
|
||||
],
|
||||
"retired": [],
|
||||
"released": [],
|
||||
"created_tasks": [],
|
||||
"updated_tasks": [
|
||||
"STATE-WP-0095-T10"
|
||||
],
|
||||
"cancelled_tasks": [],
|
||||
"created_edges": [],
|
||||
"removed_edges": [],
|
||||
"unresolved_edges": [],
|
||||
"external_edges": [
|
||||
{
|
||||
"workplan": "STATE-WP-0098",
|
||||
"from": "STATE-WP-0098-T04",
|
||||
"target": "HUB-WP-0011-T01",
|
||||
"relationship_type": "starts_after",
|
||||
"from_workplan_id": "0c68970e-295b-57fc-ac70-e472ee3a7bc4",
|
||||
"from_task_id": "077797c8-289b-55ec-9597-28f223891b02",
|
||||
"to_workplan_id": null,
|
||||
"to_task_id": "588e4b58-4694-513c-8e7a-1fab38fb6ce3"
|
||||
},
|
||||
{
|
||||
"workplan": "CUST-WP-0038",
|
||||
"from": "CUST-WP-0038",
|
||||
"target": "CUST-WP-0011",
|
||||
"relationship_type": "blocks",
|
||||
"from_workplan_id": "ccb87fa4-6381-5f22-b097-6e026f56a9c1",
|
||||
"from_task_id": null,
|
||||
"to_workplan_id": "967baafb-d92d-405a-ba0b-0d00d37c4940",
|
||||
"to_task_id": null
|
||||
},
|
||||
{
|
||||
"workplan": "STATE-WP-0079",
|
||||
"from": "STATE-WP-0079-T04",
|
||||
"target": "HUB-WP-0011-T03",
|
||||
"relationship_type": "starts_after",
|
||||
"from_workplan_id": "ed077b62-7048-5752-bf65-f90471f45854",
|
||||
"from_task_id": "3a454438-1955-547f-a491-8eab7cd25710",
|
||||
"to_workplan_id": null,
|
||||
"to_task_id": "61c727a5-f4b1-54c0-b634-7d71a5416496"
|
||||
},
|
||||
{
|
||||
"workplan": "STATE-WP-0079",
|
||||
"from": "STATE-WP-0079-T04",
|
||||
"target": "HUB-WP-0006-T06",
|
||||
"relationship_type": "starts_after",
|
||||
"from_workplan_id": "ed077b62-7048-5752-bf65-f90471f45854",
|
||||
"from_task_id": "3a454438-1955-547f-a491-8eab7cd25710",
|
||||
"to_workplan_id": null,
|
||||
"to_task_id": "7c8225f7-03dc-57b0-a668-c3d781bd828a"
|
||||
},
|
||||
{
|
||||
"workplan": "STATE-WP-0079",
|
||||
"from": "STATE-WP-0079-T06",
|
||||
"target": "STATE-WP-0079-T04",
|
||||
"relationship_type": "starts_after",
|
||||
"from_workplan_id": "ed077b62-7048-5752-bf65-f90471f45854",
|
||||
"from_task_id": "9230c99b-af58-5794-9291-452e619a30fa",
|
||||
"to_workplan_id": null,
|
||||
"to_task_id": "3a454438-1955-547f-a491-8eab7cd25710"
|
||||
},
|
||||
{
|
||||
"workplan": "STATE-WP-0079",
|
||||
"from": "STATE-WP-0079-T06",
|
||||
"target": "STATE-WP-0079-T05",
|
||||
"relationship_type": "starts_after",
|
||||
"from_workplan_id": "ed077b62-7048-5752-bf65-f90471f45854",
|
||||
"from_task_id": "9230c99b-af58-5794-9291-452e619a30fa",
|
||||
"to_workplan_id": null,
|
||||
"to_task_id": "f6cf8c01-eb59-5ca8-a541-23928d4a000c"
|
||||
}
|
||||
],
|
||||
"refused": [],
|
||||
"notes": []
|
||||
}
|
||||
}
|
||||
}
|
||||
|
|
@ -0,0 +1,16 @@
|
|||
from pathlib import Path
|
||||
import hashlib,json,importlib.util
|
||||
p=Path(__file__).resolve().parent;owner=Path('/home/worsch/state-hub')
|
||||
spec=importlib.util.spec_from_file_location('pub',p.parent/'owner-followthrough-r5/publish_followthrough_source.py');pub=importlib.util.module_from_spec(spec);spec.loader.exec_module(pub)
|
||||
d=json.loads((p/'manifest.json').read_text());e=d['files'][0];assert len(d['files'])==1
|
||||
assert pub.git(owner,'rev-parse','HEAD').stdout.decode().strip()==d['base_revision']
|
||||
assert hashlib.sha256((p/'state-hub-workplan.patch').read_bytes()).hexdigest()=='83bf9a6d6f7dc9de6856aca30b3d10c5e715214132ab715f15a8f0caeef9c935'
|
||||
f=owner/e['path'];s=p/'state-hub'/e['path'];assert not f.is_symlink() and not s.is_symlink()
|
||||
assert hashlib.sha256(f.read_bytes()).hexdigest()==e['base_sha256']
|
||||
assert hashlib.sha256(s.read_bytes()).hexdigest()==e['candidate_sha256']
|
||||
assert not pub.git(owner,'diff','--cached','--',e['path']).stdout
|
||||
before=pub.preserved_state(owner,{e['path']});f.write_bytes(s.read_bytes());assert pub.preserved_state(owner,{e['path']})==before
|
||||
result=pub.commit_source(owner,d,pub.SCANNER,execute=True,push=False)
|
||||
assert pub.preserved_state(owner,{e['path']})==before
|
||||
(p/'source-commit-result.json').write_text(json.dumps(result,indent=2)+'\n')
|
||||
print(json.dumps({k:v for k,v in result.items() if k not in {'preserved_before','preserved_after'}}))
|
||||
|
|
@ -0,0 +1,10 @@
|
|||
from pathlib import Path
|
||||
import subprocess,json,hashlib
|
||||
p=Path(__file__).resolve().parent
|
||||
checker=Path('/home/worsch/state-hub/scripts/consistency_check.py')
|
||||
assert hashlib.sha256(checker.read_bytes()).hexdigest()=='1bfbc89d3ff5c621ec541fd32384083cc7dcf96a639b217d62b6fc34de238efd'
|
||||
r=subprocess.run(['/home/worsch/state-hub/.venv/bin/python',str(checker),'--repo','state-hub','--repo-path','/home/worsch/state-hub','--api-base','http://127.0.0.1:8000','--json'],cwd='/home/worsch/state-hub',capture_output=True,text=True,timeout=180)
|
||||
try:d=json.loads(r.stdout)
|
||||
except Exception:d={'status':'unparsed','exit':r.returncode}
|
||||
(p/'normal-consistency-result.json').write_text(json.dumps(d,indent=2)+'\n')
|
||||
print(json.dumps({'exit':r.returncode,'mode':'normal_check_no_fix_preserve_existing_dirty_files','parsed_type':type(d).__name__,'checker_sha256':'sha256:1bfbc89d3ff5c621ec541fd32384083cc7dcf96a639b217d62b6fc34de238efd'}))
|
||||
|
|
@ -0,0 +1,10 @@
|
|||
from pathlib import Path
|
||||
import subprocess,json
|
||||
p=Path(__file__).resolve().parent
|
||||
r=subprocess.run(['make','sync','SYNC_PATH=.','SYNC_PUSH=1','STATE_HUB_API_BASE=http://127.0.0.1:8000'],cwd='/home/worsch/state-hub',capture_output=True,text=True,timeout=180)
|
||||
try:d=json.loads(r.stdout[r.stdout.index('{'):])
|
||||
except Exception:d={'status':'unverified','reason':'normal_sync_receipt_unparseable','exit':r.returncode}
|
||||
(p/'normal-sync-result.json').write_text(json.dumps(d,indent=2)+'\n')
|
||||
receipt=d.get('receipt',{})
|
||||
print(json.dumps({'exit':r.returncode,'status':d.get('status'),'commit':d.get('commit'),'instance_role':receipt.get('instance_role'),'instance_label':receipt.get('instance_label'),'expected_commit':receipt.get('expected_commit'),'derived_commit':receipt.get('derived_commit'),'identifier_assignments':d.get('identifiers',{}).get('assignments')}))
|
||||
raise SystemExit(r.returncode)
|
||||
File diff suppressed because it is too large
Load diff
|
|
@ -0,0 +1,31 @@
|
|||
--- a/workplans/STATE-WP-0095-historical-source-receiving.md
|
||||
+++ b/workplans/STATE-WP-0095-historical-source-receiving.md
|
||||
@@ -370,14 +370,25 @@
|
||||
historical exceptions, not restored preimages or backfilled successes.
|
||||
|
||||
T10 remains wait/needs_human for exact proposal
|
||||
-STATE-WP-0095-T10-frozen-bindings-guard-r1 revision 1, metadata
|
||||
-sha256:81d365926fc585a186955d8c98ee83501fd3cec12135b2256d71b46a75097932,
|
||||
+STATE-WP-0095-T10-frozen-bindings-guard-r1, now revision 2, metadata
|
||||
+sha256:5d0ddebc21bcb035809cc8b57f4c2e1ba8ed09204be5b965460e178a90913f1e,
|
||||
pending decision df703266-6719-4c04-ae1b-ba9afd3bca1c. The inspected candidate
|
||||
image is main-c103cbf@sha256:4cc4ce17bbcdb1b66132d07c5b7b741f46df83124ef1c8403ffabdafba6993d1,
|
||||
from runtime source c103cbf3c8bed5dba87a03e320595ddded9301a3. Image-only
|
||||
server dry-run passed eight identities with only three image-field changes.
|
||||
The exact proposal and recovery limits are retained in the Custodian dated
|
||||
-2026-10-17 guard-successor-review-r1 packet. No new API runtime is approved or
|
||||
+2026-10-17 guard-successor-review-r2 packet. No new API runtime is approved or
|
||||
delivered by this source-only note; its later workplan commit does not change
|
||||
the image's source pin. T09 stays done, T07/T10 stay wait pending reviewed API
|
||||
delivery and explicit successor/current-baseline acceptance disposition.
|
||||
+
|
||||
+
|
||||
+T10 proposal revision history: revision 1 metadata
|
||||
+sha256:81d365926fc585a186955d8c98ee83501fd3cec12135b2256d71b46a75097932
|
||||
+and its original helper remain immutable local evidence, unapproved and
|
||||
+unexecuted. Revision 2 of the same stable proposal changes only the native
|
||||
+probe's EXPECTED hash metadata into module/sha256 records for normal publication
|
||||
+scanning; probe behavior, exact image, recovery and acceptance scope remain
|
||||
+unchanged. The same decision df703266-6719-4c04-ae1b-ba9afd3bca1c remains open
|
||||
+and pending. This source-only amendment grants no runtime authority or new
|
||||
+image/code change; T07/T10 remain wait and T09 remains done.
|
||||
|
|
@ -0,0 +1,5 @@
|
|||
{
|
||||
"all10_task_blocks_unchanged": true,
|
||||
"proposal_metadata_digest_verified": true,
|
||||
"source_only": true
|
||||
}
|
||||
|
|
@ -0,0 +1,46 @@
|
|||
# Approved root-owned deployment verification preparation
|
||||
|
||||
These are source helpers for root review and execution through the existing
|
||||
State Hub owner API-pod path. This subagent did not execute them or mutate a
|
||||
live database. No additional approval or credential request is implied.
|
||||
|
||||
1. Root must run snapshot_full_row_hashes.py before the approved rollout and
|
||||
again afterward inside the ordinary API-pod Python environment. It uses
|
||||
existing async_session_factory with repeatable-read READ ONLY and dynamic
|
||||
Workplan/Task model table assertions, full to_jsonb records hashed inside
|
||||
the pod, columns/counts/UUIDs and canonical hashes only. It returns no raw
|
||||
rows, credentials, DSN or SQL diagnostics and retains no full DB row bytes.
|
||||
2. compare_snapshots.py compares only those sanitized receipts, exact3parent /
|
||||
15task columns/UUID/full-row hashes and expected delivered module hash. Do
|
||||
not substitute API-only snapshots for this full DB evidence. The optional
|
||||
private API baseline is explicitly limited in its receipt and is not a full
|
||||
database preservation claim.
|
||||
3. After delivered module hash review, root can review/run
|
||||
native_rollback_refusal_probes.py inside the same API-pod interpreter with
|
||||
the exact private published-source payload on stdin. The payload receipt
|
||||
binds published cluster HEADcac8eabe and22workplan files; all uncommitted
|
||||
cluster additions are excluded. It performs no Forge token lookup and no
|
||||
network clone. The deployed receiving module derives the checked source in
|
||||
private temporary files; no caller projection is published as authority.
|
||||
4. Each actual DB defect is inside a nested transaction, with explicit outer
|
||||
rollback and statement/lock/idle timeouts. It tests ordinary preservation,
|
||||
actual foreign-parent move, actual task/parent nonterminal status and actual
|
||||
missing task (DELETE inside rollback). Source status and UUIDs are never
|
||||
committed or published. The foreign-holder case precisely expects the
|
||||
historical binding missing-child refusal; it is not a claim of reaching the
|
||||
separate global creation-UUID holder branch. Constraint/lock/unrelated
|
||||
refusal remains unverified and must be retained, not relabeled success.
|
||||
5. Each case rolls back, clears ORM state and checks all historical full-row
|
||||
hashes restored; final fresh transaction rechecks. Successful preserve may
|
||||
stage unrelated legitimate source updates inside rollback, never commit.
|
||||
Any unrelated authoritative-source or stale-row refusal must remain a
|
||||
blocker to claiming that normal receive passed. Native helper exceptions
|
||||
emit only closed status and optional five-character SQLSTATE, not values.
|
||||
|
||||
Root should invoke Python with argv lists, not shell interpolation, e.g. fixed
|
||||
kubectl -n state-hub exec -i <approved API pod> -- /app/.venv/bin/python -c
|
||||
<exact reviewed script text>, passing the payload bytes as stdin. No TTY, secret
|
||||
argument, file credential or environment dump is needed. Keep any command error
|
||||
stdout/stderr private and publish only the helper's fixed JSON receipt. Root
|
||||
retains the real approved action/verification receipt; source compile is not
|
||||
native proof. All helpers are compiled, not run against a live DB by this lane.
|
||||
|
|
@ -0,0 +1,13 @@
|
|||
{
|
||||
"status": "private_api_baseline_captured",
|
||||
"observed_at": "2026-10-16T23:55:07.822861+00:00",
|
||||
"rows": {
|
||||
"parents": 3,
|
||||
"tasks": 15
|
||||
},
|
||||
"private_snapshot": "/tmp/state95-private-api-baseline-dkreewoe/baseline.json",
|
||||
"snapshot_sha256": "sha256:8204a2095433feb777694bfef5b2beec512acaaadd5129501d8ca1f278838c6c",
|
||||
"limitations": [
|
||||
"API fields only, not all DBcolumns. No schema migration or database mutation performed."
|
||||
]
|
||||
}
|
||||
|
|
@ -0,0 +1,13 @@
|
|||
#!/usr/bin/env python3
|
||||
"""Compare sanitized full-row hash receipts only; never consumes row values."""
|
||||
import argparse,json
|
||||
from pathlib import Path
|
||||
ap=argparse.ArgumentParser();ap.add_argument('before');ap.add_argument('after');args=ap.parse_args()
|
||||
a=json.loads(Path(args.before).read_text());b=json.loads(Path(args.after).read_text())
|
||||
assert a['status']==b['status']=='captured_readonly'
|
||||
assert a['tables']['workplans']['row_count']==b['tables']['workplans']['row_count']==3
|
||||
assert a['tables']['tasks']['row_count']==b['tables']['tasks']['row_count']==15
|
||||
same=a['tables']==b['tables']
|
||||
expected='sha256:e3c4bf965764b32a6df5d61c71272ee22569df9a9ddae2a3fc3df97ec554e0b2'
|
||||
result={'schema':'state95.historical-full-row-preservation.v1','status':'passed' if same and b['historical_module_sha256']==expected else 'refused_or_unverified','full_row_columns_uuids_hashes_equal':same,'delivered_historical_module_hash_matches':b['historical_module_sha256']==expected,'parent_count':3,'task_count':15,'raw_rows_retained':False}
|
||||
print(json.dumps(result));raise SystemExit(result['status']!='passed')
|
||||
|
|
@ -0,0 +1,32 @@
|
|||
{
|
||||
"schema": "state95.postdeployment-verifier-source.v1",
|
||||
"status": "source_prepared_for_root_review_not_native_executed_by_subagent",
|
||||
"approved_rollout_proposal_digest": "63a02e8296d126c0158b7eb2c4ce79c7eeb6f8d6f61298d473c1065c7557ba32",
|
||||
"runtime_source": "51bc70d1ff8f25450a8650d8e50caf053093a02e",
|
||||
"files": [
|
||||
{
|
||||
"path": "snapshot_full_row_hashes.py",
|
||||
"sha256": "sha256:f01e93c0fcb4ca155bdf76813626c33e4343f6a8caec2870ab1d785243c60479"
|
||||
},
|
||||
{
|
||||
"path": "native_rollback_refusal_probes.py",
|
||||
"sha256": "sha256:839d90fd336fe56bbd73d101b0770e8eba3d7517a3953b8afd075feccdd0b94d"
|
||||
},
|
||||
{
|
||||
"path": "compare_snapshots.py",
|
||||
"sha256": "sha256:fe38d1268a8c4bb54f0941f87a9aab5ee24410cc0197b082dbebe71bc94b0b78"
|
||||
},
|
||||
{
|
||||
"path": "README.md",
|
||||
"sha256": "sha256:f432c3bcb29ee0715ef8e72d5ae806a800f07338cd9b5faea9d71c470c51d699"
|
||||
},
|
||||
{
|
||||
"path": "private-published-source-payload-receipt.json",
|
||||
"sha256": "sha256:df2c438c455578d778b00363203b69aedd46e8bcdbdb3e0bd6650de6bde14bb9"
|
||||
},
|
||||
{
|
||||
"path": "api-baseline-receipt.json",
|
||||
"sha256": "sha256:8f6da30c33482b552392d16584f704265750f3a0263fa6ec4f20f5175b7bd852"
|
||||
}
|
||||
]
|
||||
}
|
||||
|
|
@ -0,0 +1,79 @@
|
|||
#!/usr/bin/env python3
|
||||
"""Root-reviewed in-pod native probes only; private source stdin, every DB effect rolled back."""
|
||||
import asyncio,base64,copy,hashlib,json,logging,sys,tempfile,uuid
|
||||
from pathlib import Path
|
||||
logging.disable(logging.CRITICAL)
|
||||
BINDINGS=[{'repo': 'railiance-cluster', 'path': 'workplans/archived/260622-RAIL-BS-WP-0002-k3s-baseline.md', 'sha256': '8d6f8533c119117686bc0d5bb9ed5349726aa6c3189ff98b53409c68ac685ca9', 'record_id': 'RAIL-BS-WP-0002', 'uuid': '4c63dfc6-9eac-4e79-9f77-8f644ad7147d', 'parent_record_id': 'RAIL-BS-WP-0002', 'source_status': 'finished', 'tasks': [{'label': 'T01', 'uuid': '3f042630-eab0-4c6a-9167-e2b28ff20e40', 'status': 'done', 'source': 'workplans/archived/260622-RAIL-BS-WP-0002-k3s-baseline.md#task-block-1'}, {'label': 'T02', 'uuid': 'e8510646-46ed-4697-a345-f3d3009eea78', 'status': 'done', 'source': 'workplans/archived/260622-RAIL-BS-WP-0002-k3s-baseline.md#task-block-2'}, {'label': 'T03', 'uuid': 'dab2c07f-8aa0-4635-8df6-857e87e93fc5', 'status': 'done', 'source': 'workplans/archived/260622-RAIL-BS-WP-0002-k3s-baseline.md#task-block-3'}, {'label': 'T04', 'uuid': '5c3d40e4-239b-488e-9519-6f7a38d2325f', 'status': 'done', 'source': 'workplans/archived/260622-RAIL-BS-WP-0002-k3s-baseline.md#task-block-4'}, {'label': 'T05', 'uuid': '7f9e0e58-a130-467a-a2d0-b3f2564e496f', 'status': 'done', 'source': 'workplans/archived/260622-RAIL-BS-WP-0002-k3s-baseline.md#task-block-5'}]}, {'repo': 'railiance-cluster', 'path': 'workplans/archived/260622-RAIL-BS-WP-0003-pgpool-ha-failover-fix.md', 'sha256': '4dc2f61e15adc3c5c81f9ecf8b933512275b95e8f829fac52ae7cde1385cea4a', 'record_id': 'RAIL-BS-WP-0003', 'uuid': '7ee9ee22-1fae-4567-9194-8d70a9e0f45b', 'parent_record_id': 'RAIL-BS-WP-0003', 'source_status': 'finished', 'tasks': [{'label': 'T01', 'uuid': '6841c93a-f146-47eb-9f7c-8fa0e02c1bbc', 'status': 'done', 'source': 'workplans/archived/260622-RAIL-BS-WP-0003-pgpool-ha-failover-fix.md#task-block-1'}, {'label': 'T02', 'uuid': 'ab166073-30a7-4702-a037-4091e8706e20', 'status': 'done', 'source': 'workplans/archived/260622-RAIL-BS-WP-0003-pgpool-ha-failover-fix.md#task-block-2'}, {'label': 'T03', 'uuid': '140da396-8e30-4f4d-b88c-c42c0cd46c01', 'status': 'done', 'source': 'workplans/archived/260622-RAIL-BS-WP-0003-pgpool-ha-failover-fix.md#task-block-3'}, {'label': 'T04', 'uuid': 'd8a3ba40-fda0-4c1f-a9f1-ffcd621a5b3d', 'status': 'done', 'source': 'workplans/archived/260622-RAIL-BS-WP-0003-pgpool-ha-failover-fix.md#task-block-4'}]}, {'repo': 'railiance-cluster', 'path': 'workplans/archived/260622-RAIL-BS-WP-0004-safety-net.md', 'sha256': '04f787078232395bd2d43861de16c521848559fa286f06e1caa9cb779aa71ac3', 'record_id': 'RAIL-BS-WP-0004', 'uuid': '7e8b0c20-51eb-40c9-9e3b-85dd380d7625', 'parent_record_id': 'RAIL-BS-WP-0004', 'source_status': 'finished', 'tasks': [{'label': 'T01', 'uuid': '4526a842-ea31-4874-9231-92ab556cfe7b', 'status': 'done', 'source': 'workplans/archived/260622-RAIL-BS-WP-0004-safety-net.md#task-block-1'}, {'label': 'T02', 'uuid': 'a6313e06-1976-46a7-8e31-df4eb2eca880', 'status': 'done', 'source': 'workplans/archived/260622-RAIL-BS-WP-0004-safety-net.md#task-block-2'}, {'label': 'T03', 'uuid': '05d42a55-921f-4aa7-bb76-e8af9c7e0ac3', 'status': 'done', 'source': 'workplans/archived/260622-RAIL-BS-WP-0004-safety-net.md#task-block-3'}, {'label': 'T04', 'uuid': '08233868-d522-4117-bc4e-6c0f52545665', 'status': 'done', 'source': 'workplans/archived/260622-RAIL-BS-WP-0004-safety-net.md#task-block-4'}, {'label': 'T05', 'uuid': '2d5acff7-4a4e-4ddd-ad06-08237ad3dac8', 'status': 'done', 'source': 'workplans/archived/260622-RAIL-BS-WP-0004-safety-net.md#task-block-5'}, {'label': 'T06', 'uuid': 'f8e4a094-c367-40eb-b895-da17bc144b07', 'status': 'done', 'source': 'workplans/archived/260622-RAIL-BS-WP-0004-safety-net.md#task-block-6'}]}]
|
||||
PAYLOAD_SHA='82af93c3f8585f97fed63fafca2a6105caaeed8d52848ad628091663386fa949'
|
||||
EXPECTED_HP='e3c4bf965764b32a6df5d61c71272ee22569df9a9ddae2a3fc3df97ec554e0b2'
|
||||
EXPECTED_FP='b980e62cbd85c3e7df42b01abf14354e04133374db94af6531dcd91629c3487d'
|
||||
def digest(value):return 'sha256:'+hashlib.sha256(json.dumps(value,sort_keys=True,separators=(',',':'),ensure_ascii=False).encode()).hexdigest()
|
||||
async def main():
|
||||
from sqlalchemy import text
|
||||
from api.database import async_session_factory,engine
|
||||
from api.services import forge_projection as fp,historical_projection as hp
|
||||
from api.models.workplan import Workplan
|
||||
from api.models.task import Task
|
||||
engine.echo=False
|
||||
assert Workplan.__tablename__=='workplans' and Task.__tablename__=='tasks'
|
||||
assert hashlib.sha256(Path(hp.__file__).read_bytes()).hexdigest()==EXPECTED_HP
|
||||
assert hashlib.sha256(Path(fp.__file__).read_bytes()).hexdigest()==EXPECTED_FP
|
||||
raw=sys.stdin.buffer.read(2097153);assert len(raw)<=2097152 and hashlib.sha256(raw).hexdigest()==PAYLOAD_SHA
|
||||
payload=json.loads(raw);assert set(payload)=={'repo','revision','files'} and payload['repo']=='railiance-cluster'
|
||||
parents=[e['uuid'] for e in BINDINGS];task_ids=[t['uuid'] for e in BINDINGS for t in e['tasks']]
|
||||
async def snapshot(session):
|
||||
result={}
|
||||
for table,ids in [('workplans',parents),('tasks',task_ids)]:
|
||||
values=(await session.execute(text('SELECT to_jsonb(row) FROM '+table+' AS row WHERE row.id=ANY(:ids) ORDER BY row.id'),{'ids':[uuid.UUID(v) for v in ids]})).scalars().all()
|
||||
assert len(values)==len(ids)
|
||||
result[table]=digest(values)
|
||||
return result
|
||||
with tempfile.TemporaryDirectory(prefix='state95-exact-published-source-') as temporary:
|
||||
checkout=Path(temporary)/'railiance-cluster';checkout.mkdir(mode=0o700)
|
||||
for name,value in payload['files'].items():
|
||||
path=Path(name);assert path.parts[0]=='workplans' and not path.is_absolute() and '..' not in path.parts and path.suffix=='.md'
|
||||
target=checkout/path;target.parent.mkdir(parents=True,exist_ok=True);target.write_bytes(base64.b64decode(value,validate=True));target.chmod(0o600)
|
||||
derived=fp.derive_from_checkout(checkout,'railiance-cluster',payload['revision'])
|
||||
histories=[w for w in derived.workplans if w.historical_preservation]
|
||||
assert len(histories)==3 and {w.uuid for w in histories}==set(parents)
|
||||
result={'schema':'state95.native-rollback-refusal-probes.v1','status':'failed','source_revision':payload['revision'],'private_source_payload_sha256':'sha256:'+PAYLOAD_SHA,'module_hashes_verified':True,'commits_performed':0,'cases':{},'raw_rows_or_diagnostics_retained':False}
|
||||
async with async_session_factory() as session:
|
||||
try:
|
||||
await session.execute(text("SET LOCAL statement_timeout='5s'"))
|
||||
await session.execute(text("SET LOCAL lock_timeout='1s'"))
|
||||
await session.execute(text("SET LOCAL idle_in_transaction_session_timeout='10s'"))
|
||||
before=await snapshot(session);result['before_full_row_hashes']=before
|
||||
for case in ('preserve','foreign-holder','nonterminal-task','nonterminal-parent','missing-task'):
|
||||
nested=await session.begin_nested();row={'status':'unverified','rolled_back':False}
|
||||
try:
|
||||
session.expire_all()
|
||||
if case=='foreign-holder':await session.execute(text('UPDATE tasks SET workplan_id=:parent WHERE id=:task'),{'parent':uuid.UUID(parents[1]),'task':uuid.UUID(task_ids[0])})
|
||||
elif case=='nonterminal-task':await session.execute(text("UPDATE tasks SET status='progress' WHERE id=:task"),{'task':uuid.UUID(task_ids[0])})
|
||||
elif case=='nonterminal-parent':await session.execute(text("UPDATE workplans SET status='active' WHERE id=:parent"),{'parent':uuid.UUID(parents[0])})
|
||||
elif case=='missing-task':await session.execute(text('DELETE FROM tasks WHERE id=:task'),{'task':uuid.UUID(task_ids[0])})
|
||||
outcome=await fp.reset_repository_projection(session,'railiance-cluster',derived=copy.deepcopy(derived))
|
||||
reasons={r.get('reason') for r in outcome.refused}
|
||||
if case=='preserve':
|
||||
await session.flush();row['full_historical_rows_equal']=await snapshot(session)==before
|
||||
row['status']='passed' if outcome.status in {'noop','applied'} and not outcome.refused and row['full_historical_rows_equal'] else 'refused_or_unverified'
|
||||
else:
|
||||
row['historical_binding_refused']=outcome.status=='refused' and 'historical binding requires existing parent and task UUIDs' in reasons
|
||||
row['status']='passed' if row['historical_binding_refused'] else 'wrong_or_unverified_refusal'
|
||||
row['native_outcome_status']=outcome.status
|
||||
except BaseException as error:
|
||||
code=getattr(getattr(error,'orig',error),'sqlstate',None)
|
||||
row={'status':'native_probe_error','sqlstate':code if isinstance(code,str) and len(code)==5 and code.isalnum() else None,'rolled_back':False}
|
||||
finally:
|
||||
await nested.rollback();session.expire_all();row['rolled_back']=True
|
||||
row['full_historical_rows_restored']=await snapshot(session)==before
|
||||
result['cases'][case]=row
|
||||
result['after_full_row_hashes']=await snapshot(session)
|
||||
finally:await session.rollback()
|
||||
async with async_session_factory() as check:
|
||||
try:result['fresh_transaction_full_rows_equal']=await snapshot(check)==before
|
||||
finally:await check.rollback()
|
||||
result['status']='passed' if all(v['status']=='passed' and v['rolled_back'] and v['full_historical_rows_restored'] for v in result['cases'].values()) and result['fresh_transaction_full_rows_equal'] else 'refused_or_unverified'
|
||||
await engine.dispose();print(json.dumps(result,sort_keys=True))
|
||||
if __name__=='__main__':
|
||||
try:asyncio.run(main())
|
||||
except BaseException:print(json.dumps({'schema':'state95.native-rollback-refusal-probes.v1','status':'refused_or_unverified','commits_performed':0,'raw_rows_or_diagnostics_retained':False}));raise SystemExit(1)
|
||||
|
|
@ -0,0 +1,10 @@
|
|||
{
|
||||
"schema": "state95.source-probe-payload.v1",
|
||||
"scope": "exact_current_git_HEAD_workplans_only_uncommitted_additions_excluded",
|
||||
"revision": "cac8eabef5a0d0990a7b0de8f5e2c762666ac7f0",
|
||||
"private_payload_path": "/tmp/state95-private-source-payload-frvylkw5/published-workplans.json",
|
||||
"bytes": 155730,
|
||||
"sha256": "sha256:82af93c3f8585f97fed63fafca2a6105caaeed8d52848ad628091663386fa949",
|
||||
"file_count": 22,
|
||||
"native_authority": false
|
||||
}
|
||||
|
|
@ -0,0 +1,40 @@
|
|||
#!/usr/bin/env python3
|
||||
"""Run by approved owner inside API pod; SELECT-only, output full-row hashes only."""
|
||||
import asyncio
|
||||
import hashlib
|
||||
import json
|
||||
import logging
|
||||
from pathlib import Path
|
||||
import uuid
|
||||
logging.disable(logging.CRITICAL)
|
||||
BINDINGS=[{'repo': 'railiance-cluster', 'path': 'workplans/archived/260622-RAIL-BS-WP-0002-k3s-baseline.md', 'sha256': '8d6f8533c119117686bc0d5bb9ed5349726aa6c3189ff98b53409c68ac685ca9', 'record_id': 'RAIL-BS-WP-0002', 'uuid': '4c63dfc6-9eac-4e79-9f77-8f644ad7147d', 'parent_record_id': 'RAIL-BS-WP-0002', 'source_status': 'finished', 'tasks': [{'label': 'T01', 'uuid': '3f042630-eab0-4c6a-9167-e2b28ff20e40', 'status': 'done', 'source': 'workplans/archived/260622-RAIL-BS-WP-0002-k3s-baseline.md#task-block-1'}, {'label': 'T02', 'uuid': 'e8510646-46ed-4697-a345-f3d3009eea78', 'status': 'done', 'source': 'workplans/archived/260622-RAIL-BS-WP-0002-k3s-baseline.md#task-block-2'}, {'label': 'T03', 'uuid': 'dab2c07f-8aa0-4635-8df6-857e87e93fc5', 'status': 'done', 'source': 'workplans/archived/260622-RAIL-BS-WP-0002-k3s-baseline.md#task-block-3'}, {'label': 'T04', 'uuid': '5c3d40e4-239b-488e-9519-6f7a38d2325f', 'status': 'done', 'source': 'workplans/archived/260622-RAIL-BS-WP-0002-k3s-baseline.md#task-block-4'}, {'label': 'T05', 'uuid': '7f9e0e58-a130-467a-a2d0-b3f2564e496f', 'status': 'done', 'source': 'workplans/archived/260622-RAIL-BS-WP-0002-k3s-baseline.md#task-block-5'}]}, {'repo': 'railiance-cluster', 'path': 'workplans/archived/260622-RAIL-BS-WP-0003-pgpool-ha-failover-fix.md', 'sha256': '4dc2f61e15adc3c5c81f9ecf8b933512275b95e8f829fac52ae7cde1385cea4a', 'record_id': 'RAIL-BS-WP-0003', 'uuid': '7ee9ee22-1fae-4567-9194-8d70a9e0f45b', 'parent_record_id': 'RAIL-BS-WP-0003', 'source_status': 'finished', 'tasks': [{'label': 'T01', 'uuid': '6841c93a-f146-47eb-9f7c-8fa0e02c1bbc', 'status': 'done', 'source': 'workplans/archived/260622-RAIL-BS-WP-0003-pgpool-ha-failover-fix.md#task-block-1'}, {'label': 'T02', 'uuid': 'ab166073-30a7-4702-a037-4091e8706e20', 'status': 'done', 'source': 'workplans/archived/260622-RAIL-BS-WP-0003-pgpool-ha-failover-fix.md#task-block-2'}, {'label': 'T03', 'uuid': '140da396-8e30-4f4d-b88c-c42c0cd46c01', 'status': 'done', 'source': 'workplans/archived/260622-RAIL-BS-WP-0003-pgpool-ha-failover-fix.md#task-block-3'}, {'label': 'T04', 'uuid': 'd8a3ba40-fda0-4c1f-a9f1-ffcd621a5b3d', 'status': 'done', 'source': 'workplans/archived/260622-RAIL-BS-WP-0003-pgpool-ha-failover-fix.md#task-block-4'}]}, {'repo': 'railiance-cluster', 'path': 'workplans/archived/260622-RAIL-BS-WP-0004-safety-net.md', 'sha256': '04f787078232395bd2d43861de16c521848559fa286f06e1caa9cb779aa71ac3', 'record_id': 'RAIL-BS-WP-0004', 'uuid': '7e8b0c20-51eb-40c9-9e3b-85dd380d7625', 'parent_record_id': 'RAIL-BS-WP-0004', 'source_status': 'finished', 'tasks': [{'label': 'T01', 'uuid': '4526a842-ea31-4874-9231-92ab556cfe7b', 'status': 'done', 'source': 'workplans/archived/260622-RAIL-BS-WP-0004-safety-net.md#task-block-1'}, {'label': 'T02', 'uuid': 'a6313e06-1976-46a7-8e31-df4eb2eca880', 'status': 'done', 'source': 'workplans/archived/260622-RAIL-BS-WP-0004-safety-net.md#task-block-2'}, {'label': 'T03', 'uuid': '05d42a55-921f-4aa7-bb76-e8af9c7e0ac3', 'status': 'done', 'source': 'workplans/archived/260622-RAIL-BS-WP-0004-safety-net.md#task-block-3'}, {'label': 'T04', 'uuid': '08233868-d522-4117-bc4e-6c0f52545665', 'status': 'done', 'source': 'workplans/archived/260622-RAIL-BS-WP-0004-safety-net.md#task-block-4'}, {'label': 'T05', 'uuid': '2d5acff7-4a4e-4ddd-ad06-08237ad3dac8', 'status': 'done', 'source': 'workplans/archived/260622-RAIL-BS-WP-0004-safety-net.md#task-block-5'}, {'label': 'T06', 'uuid': 'f8e4a094-c367-40eb-b895-da17bc144b07', 'status': 'done', 'source': 'workplans/archived/260622-RAIL-BS-WP-0004-safety-net.md#task-block-6'}]}]
|
||||
def digest(value):return 'sha256:'+hashlib.sha256(json.dumps(value,sort_keys=True,separators=(',',':'),ensure_ascii=False).encode()).hexdigest()
|
||||
async def main():
|
||||
from sqlalchemy import text
|
||||
from api.database import async_session_factory,engine
|
||||
from api.models.workplan import Workplan
|
||||
from api.models.task import Task
|
||||
engine.echo=False
|
||||
assert Workplan.__tablename__=='workplans' and Task.__tablename__=='tasks'
|
||||
parents=[entry['uuid'] for entry in BINDINGS]
|
||||
tasks={task['uuid']:entry['uuid'] for entry in BINDINGS for task in entry['tasks']}
|
||||
result={'schema':'state95.full-db-row-hash-snapshot.v1','status':'failed','credential_values_exposed':False,'raw_rows_retained':False}
|
||||
async with async_session_factory() as session:
|
||||
try:
|
||||
await session.execute(text('SET TRANSACTION ISOLATION LEVEL REPEATABLE READ, READ ONLY'))
|
||||
rows={}
|
||||
for table,identifiers in [('workplans',parents),('tasks',list(tasks))]:
|
||||
query=text('SELECT to_jsonb(row) FROM '+table+' AS row WHERE row.id=ANY(:ids) ORDER BY row.id')
|
||||
values=(await session.execute(query,{'ids':[uuid.UUID(v) for v in identifiers]})).scalars().all()
|
||||
assert len(values)==len(identifiers) and {v['id'] for v in values}==set(identifiers)
|
||||
if table=='tasks':assert all(v['workplan_id']==tasks[v['id']] for v in values)
|
||||
assert all(v['status'] in {'done','cancel','finished','archived','completed'} for v in values)
|
||||
rows[table]={'row_count':len(values),'columns':sorted(values[0]),'rows':[{'uuid':v['id'],'sha256':digest(v)} for v in values],'all_rows_sha256':digest(values)}
|
||||
from api.services import historical_projection
|
||||
result.update(status='captured_readonly',tables=rows,historical_module_sha256='sha256:'+hashlib.sha256(Path(historical_projection.__file__).read_bytes()).hexdigest())
|
||||
finally:await session.rollback()
|
||||
await engine.dispose()
|
||||
print(json.dumps(result,sort_keys=True))
|
||||
if __name__=='__main__':
|
||||
try:asyncio.run(main())
|
||||
except BaseException:print(json.dumps({'schema':'state95.full-db-row-hash-snapshot.v1','status':'refused_or_unverified','raw_rows_retained':False}));raise SystemExit(1)
|
||||
|
|
@ -0,0 +1,152 @@
|
|||
---
|
||||
id: RCLUSTER-WP-0018
|
||||
type: workplan
|
||||
title: "Establish original KeyCape TLS recovery and future archive boundary"
|
||||
domain: financials
|
||||
repo: railiance-cluster
|
||||
status: active
|
||||
owner: codex
|
||||
topic_slug: railiance
|
||||
created: "2026-10-17"
|
||||
updated: "2026-10-17"
|
||||
flavor: implementation
|
||||
depends_on: []
|
||||
related: [CUST-WP-0080, NK-WP-0049, RCLUSTER-WP-0007, RCLUSTER-WP-0017]
|
||||
state_hub_workstream_id: "e0a7813d-c916-5e49-84b2-5e5b30441891"
|
||||
---
|
||||
|
||||
Required owner source work for NK-WP-0049-T35 and CUST-WP-0080 G08. Reviewed
|
||||
against current INTENT/SCOPE, backup sources and existing work records; ready
|
||||
means work can proceed, not privileged execute authority. This does not promote
|
||||
HA/backlog work, reopen archived local backup delivery or duplicate signer0017.
|
||||
Source-owner scope is certificate plumbing/backup posture; NetKingdom owns
|
||||
namespace ingress, while exact original independent TLS custody remains to be
|
||||
established. No secret read, reissue, live change or native assent occurred.
|
||||
|
||||
## Record source boundary and public-only metadata preparation
|
||||
|
||||
```task
|
||||
id: RCLUSTER-WP-0018-T01
|
||||
status: done
|
||||
priority: high
|
||||
assignee: codex
|
||||
state_hub_task_id: "7280193d-0d59-5b78-a2d3-96ebd127127f"
|
||||
```
|
||||
|
||||
Completed 2026-10-17 as isolated source preparation. Independently reviewed the
|
||||
17 public source references against current owner bytes, checked current owner
|
||||
instructions/environment/supervision and existing plans, and recorded the exact
|
||||
boundary in docs/keycape-tls-recovery-boundary.md. Prepared bounded public-only
|
||||
certificate/trust metadata projection with generated-certificate tests; no actual
|
||||
certificate/key read. Source integration/publication and task projection remain
|
||||
separate receipts, not claimed by this completed preparation task.
|
||||
|
||||
Evidence: the-custodian docs/changes/netkingdom-target-2026-10-16/
|
||||
recovery-owner-handoffs-r1/ and prior recovery-attempt-r1/t35-t36-source-next/.
|
||||
|
||||
Publication return, 2026-10-17: normal owner source publication at
|
||||
c562d7134c38679952a8ffd17a8a893a900aef0d was applied on primary/railiance01
|
||||
with expected and derived commits equal. Read-only source/remote/Hub proof
|
||||
verified this workplan's five exact task ID/UUID/status bindings and three
|
||||
internal dependency edges. Receipts are retained in the Custodian packet
|
||||
docs/changes/netkingdom-target-2026-10-17/railiance-cluster-projection.json and
|
||||
cluster-publication-readback.json. The later legitimate C23 lifecycle repair
|
||||
at 26671d33600e218316d29c9cd020f115ebfb35b2 changed ready to active; active
|
||||
is retained. This return records publication separately from the completed
|
||||
source preparation above. Original TLS artifact/provider custody, extraction
|
||||
and native admission remain T02–T05 obligations; publication proves no TLS
|
||||
recovery, private-key custody or native acceptance.
|
||||
|
||||
The whole maintenance pipeline's historical-row guard failed for three parent
|
||||
rows while 15 task full-row hashes remained unchanged. STATE-WP-0095-T07 and
|
||||
RMGR-WP-0019-T06 remain wait; neither publication nor this memo asserts full
|
||||
historical-row preservation or restoration. The subsequent forward correction
|
||||
restores the brief's committed content to its pre-accident version while restoring
|
||||
the original staged/worktree change for its owner; history is not rewound. No legacy deep consistency fix is run by the correction.
|
||||
|
||||
## Establish exact independent original TLS artifact and provider custody metadata
|
||||
|
||||
```task
|
||||
id: RCLUSTER-WP-0018-T02
|
||||
status: todo
|
||||
priority: high
|
||||
assignee: codex
|
||||
state_hub_task_id: "90836435-917f-504c-a711-3f29ece348e3"
|
||||
```
|
||||
|
||||
Next: identify the actual original sso/kc-tls custody owner and independent public
|
||||
provenance through existing owner processes. Record artifact/provider, timestamp,
|
||||
public certificate/trust hashes, private custody entry point and outage dependencies
|
||||
without values. Source review cannot infer a fresh backup, original key coverage
|
||||
or independent decryption custody from a local backup script. Use credential
|
||||
routing before any later credential need; missing route is not proof of absence.
|
||||
Done when exact independent recovery or an explicitly owned unavailable capability
|
||||
is evidenced as metadata and a reviewed next action, with no guessed assent.
|
||||
|
||||
## Prepare safe isolated original extraction or explicit reissue alternative
|
||||
|
||||
```task
|
||||
id: RCLUSTER-WP-0018-T03
|
||||
status: wait
|
||||
priority: high
|
||||
assignee: codex
|
||||
depends_on: [RCLUSTER-WP-0018-T02]
|
||||
blocking_reason: "Exact original artifact/provider/custody disposition is required before selecting extraction or reissue source."
|
||||
state_hub_task_id: "5dfa9a3a-2639-5cf6-b0a4-13eef417d47a"
|
||||
```
|
||||
|
||||
From T02, reuse the actual owner path to prepare an exact attended private-only
|
||||
recovery command and full dependency/cleanup proof. Do not run whole-state restore
|
||||
or expose raw state/Secret output. If existing backup staging is required, correct
|
||||
only the needed path with bounded memory-only staging and early exact cleanup,
|
||||
including error/parent-loss tests before use. Original recovery and accepted
|
||||
reissue are distinct claims; no self-signed trust substitute, new broker or
|
||||
implicit production action. Done when the exact source proposal, public metadata
|
||||
preflight, negatives, timeout, abort and custody obligations are reviewed.
|
||||
|
||||
## Verify admitted original TLS recovery through the actual owner boundary
|
||||
|
||||
```task
|
||||
id: RCLUSTER-WP-0018-T04
|
||||
status: wait
|
||||
priority: high
|
||||
assignee: codex
|
||||
needs_human: true
|
||||
depends_on: [RCLUSTER-WP-0018-T02, RCLUSTER-WP-0018-T03]
|
||||
blocking_reason: "Await exact reviewed attended owner custody path and its existing scoped authority; no private input or native attempt requested yet."
|
||||
state_hub_task_id: "021b07bb-65bc-5743-bac5-4294b4be74f6"
|
||||
```
|
||||
|
||||
Only the actual admitted owner action can prove recovered certificate/key pairing,
|
||||
original hostname/trust and independent outage operation, or the expressly accepted
|
||||
reissue result. Retain exact source/artifact/target/identity/negative/cleanup receipts.
|
||||
Human custody/authority gates are not worker wakeups. Source and historical local
|
||||
backup proof never fill native assent. Return bounded public proof to NK49T35;
|
||||
no production mutation, credential retrieval or approval is granted by this task.
|
||||
|
||||
## Disposition original TLS coverage in the future identity archive contract
|
||||
|
||||
```task
|
||||
id: RCLUSTER-WP-0018-T05
|
||||
status: todo
|
||||
priority: high
|
||||
assignee: codex
|
||||
state_hub_task_id: "5bc67a22-0991-5625-86a6-f749560d8a0e"
|
||||
```
|
||||
|
||||
Next: deliver the source-owned requirement in docs/keycape-tls-recovery-boundary.md
|
||||
to NetKingdom's existing contract process: original TLS custody or accepted reissue,
|
||||
independent provider/key recovery, public identity hashes, scoped capture/read
|
||||
permissions and verification/retention. Record named owner dependencies as live
|
||||
work before closure. Do not append kc-tls to secret_refs, expand capture credentials
|
||||
or rewrite a historical archive without those owner reviews/authority. Done when
|
||||
the future contract requirement has an exact tracked disposition/handoff; it is
|
||||
not proof of current archive coverage or actual future capture.
|
||||
|
||||
## Coordination and completion
|
||||
|
||||
Beneficiary NK-WP-0049-T35/CUST-WP-0080 remains linked to this obligor record by
|
||||
derived cross_owner_wait case nk49-t35-rcluster18 in the packet. No new project
|
||||
driver, live worker injection or message was created. Own T03 wait has an explicit
|
||||
local prerequisite; T04 is a human gate. Close only after source/native obligations
|
||||
are proved or an explicit bounded scope disposition hands off remaining live work.
|
||||
|
|
@ -0,0 +1,132 @@
|
|||
---
|
||||
id: RCLUSTER-WP-0018
|
||||
type: workplan
|
||||
title: "Establish original KeyCape TLS recovery and future archive boundary"
|
||||
domain: financials
|
||||
repo: railiance-cluster
|
||||
status: active
|
||||
owner: codex
|
||||
topic_slug: railiance
|
||||
created: "2026-10-17"
|
||||
updated: "2026-10-17"
|
||||
flavor: implementation
|
||||
depends_on: []
|
||||
related: [CUST-WP-0080, NK-WP-0049, RCLUSTER-WP-0007, RCLUSTER-WP-0017]
|
||||
state_hub_workstream_id: "e0a7813d-c916-5e49-84b2-5e5b30441891"
|
||||
---
|
||||
|
||||
Required owner source work for NK-WP-0049-T35 and CUST-WP-0080 G08. Reviewed
|
||||
against current INTENT/SCOPE, backup sources and existing work records; ready
|
||||
means work can proceed, not privileged execute authority. This does not promote
|
||||
HA/backlog work, reopen archived local backup delivery or duplicate signer0017.
|
||||
Source-owner scope is certificate plumbing/backup posture; NetKingdom owns
|
||||
namespace ingress, while exact original independent TLS custody remains to be
|
||||
established. No secret read, reissue, live change or native assent occurred.
|
||||
|
||||
## Record source boundary and public-only metadata preparation
|
||||
|
||||
```task
|
||||
id: RCLUSTER-WP-0018-T01
|
||||
status: done
|
||||
priority: high
|
||||
assignee: codex
|
||||
state_hub_task_id: "7280193d-0d59-5b78-a2d3-96ebd127127f"
|
||||
```
|
||||
|
||||
Completed 2026-10-17 as isolated source preparation. Independently reviewed the
|
||||
17 public source references against current owner bytes, checked current owner
|
||||
instructions/environment/supervision and existing plans, and recorded the exact
|
||||
boundary in docs/keycape-tls-recovery-boundary.md. Prepared bounded public-only
|
||||
certificate/trust metadata projection with generated-certificate tests; no actual
|
||||
certificate/key read. Source integration/publication and task projection remain
|
||||
separate receipts, not claimed by this completed preparation task.
|
||||
|
||||
Evidence: the-custodian docs/changes/netkingdom-target-2026-10-16/
|
||||
recovery-owner-handoffs-r1/ and prior recovery-attempt-r1/t35-t36-source-next/.
|
||||
|
||||
## Establish exact independent original TLS artifact and provider custody metadata
|
||||
|
||||
```task
|
||||
id: RCLUSTER-WP-0018-T02
|
||||
status: todo
|
||||
priority: high
|
||||
assignee: codex
|
||||
state_hub_task_id: "90836435-917f-504c-a711-3f29ece348e3"
|
||||
```
|
||||
|
||||
Next: identify the actual original sso/kc-tls custody owner and independent public
|
||||
provenance through existing owner processes. Record artifact/provider, timestamp,
|
||||
public certificate/trust hashes, private custody entry point and outage dependencies
|
||||
without values. Source review cannot infer a fresh backup, original key coverage
|
||||
or independent decryption custody from a local backup script. Use credential
|
||||
routing before any later credential need; missing route is not proof of absence.
|
||||
Done when exact independent recovery or an explicitly owned unavailable capability
|
||||
is evidenced as metadata and a reviewed next action, with no guessed assent.
|
||||
|
||||
## Prepare safe isolated original extraction or explicit reissue alternative
|
||||
|
||||
```task
|
||||
id: RCLUSTER-WP-0018-T03
|
||||
status: wait
|
||||
priority: high
|
||||
assignee: codex
|
||||
depends_on: [RCLUSTER-WP-0018-T02]
|
||||
blocking_reason: "Exact original artifact/provider/custody disposition is required before selecting extraction or reissue source."
|
||||
state_hub_task_id: "5dfa9a3a-2639-5cf6-b0a4-13eef417d47a"
|
||||
```
|
||||
|
||||
From T02, reuse the actual owner path to prepare an exact attended private-only
|
||||
recovery command and full dependency/cleanup proof. Do not run whole-state restore
|
||||
or expose raw state/Secret output. If existing backup staging is required, correct
|
||||
only the needed path with bounded memory-only staging and early exact cleanup,
|
||||
including error/parent-loss tests before use. Original recovery and accepted
|
||||
reissue are distinct claims; no self-signed trust substitute, new broker or
|
||||
implicit production action. Done when the exact source proposal, public metadata
|
||||
preflight, negatives, timeout, abort and custody obligations are reviewed.
|
||||
|
||||
## Verify admitted original TLS recovery through the actual owner boundary
|
||||
|
||||
```task
|
||||
id: RCLUSTER-WP-0018-T04
|
||||
status: wait
|
||||
priority: high
|
||||
assignee: codex
|
||||
needs_human: true
|
||||
depends_on: [RCLUSTER-WP-0018-T02, RCLUSTER-WP-0018-T03]
|
||||
blocking_reason: "Await exact reviewed attended owner custody path and its existing scoped authority; no private input or native attempt requested yet."
|
||||
state_hub_task_id: "021b07bb-65bc-5743-bac5-4294b4be74f6"
|
||||
```
|
||||
|
||||
Only the actual admitted owner action can prove recovered certificate/key pairing,
|
||||
original hostname/trust and independent outage operation, or the expressly accepted
|
||||
reissue result. Retain exact source/artifact/target/identity/negative/cleanup receipts.
|
||||
Human custody/authority gates are not worker wakeups. Source and historical local
|
||||
backup proof never fill native assent. Return bounded public proof to NK49T35;
|
||||
no production mutation, credential retrieval or approval is granted by this task.
|
||||
|
||||
## Disposition original TLS coverage in the future identity archive contract
|
||||
|
||||
```task
|
||||
id: RCLUSTER-WP-0018-T05
|
||||
status: todo
|
||||
priority: high
|
||||
assignee: codex
|
||||
state_hub_task_id: "5bc67a22-0991-5625-86a6-f749560d8a0e"
|
||||
```
|
||||
|
||||
Next: deliver the source-owned requirement in docs/keycape-tls-recovery-boundary.md
|
||||
to NetKingdom's existing contract process: original TLS custody or accepted reissue,
|
||||
independent provider/key recovery, public identity hashes, scoped capture/read
|
||||
permissions and verification/retention. Record named owner dependencies as live
|
||||
work before closure. Do not append kc-tls to secret_refs, expand capture credentials
|
||||
or rewrite a historical archive without those owner reviews/authority. Done when
|
||||
the future contract requirement has an exact tracked disposition/handoff; it is
|
||||
not proof of current archive coverage or actual future capture.
|
||||
|
||||
## Coordination and completion
|
||||
|
||||
Beneficiary NK-WP-0049-T35/CUST-WP-0080 remains linked to this obligor record by
|
||||
derived cross_owner_wait case nk49-t35-rcluster18 in the packet. No new project
|
||||
driver, live worker injection or message was created. Own T03 wait has an explicit
|
||||
local prerequisite; T04 is a human gate. Close only after source/native obligations
|
||||
are proved or an explicit bounded scope disposition hands off remaining live work.
|
||||
|
|
@ -0,0 +1,54 @@
|
|||
#!/usr/bin/env python3
|
||||
"""Reviewed forward-only two-path commit; retain original brief/index/worktree dirt."""
|
||||
from pathlib import Path
|
||||
import argparse,hashlib,json,subprocess
|
||||
P=Path(__file__).resolve().parent
|
||||
R=Path('/home/worsch/railiance-cluster')
|
||||
B=P.parent/'railiance-cluster-publication-backup'
|
||||
M=json.loads((P/'manifest.json').read_text())
|
||||
def sha(p):return hashlib.sha256(p.read_bytes()).hexdigest()
|
||||
def git(*args):
|
||||
r=subprocess.run(['git','-C',str(R),*args],capture_output=True,timeout=180)
|
||||
if r.returncode:raise RuntimeError(json.dumps({'args':args,'exit':r.returncode,'stdout':r.stdout.decode(errors='replace'),'stderr':r.stderr.decode(errors='replace')}))
|
||||
return r.stdout
|
||||
parser=argparse.ArgumentParser();parser.add_argument('--execute',action='store_true');a=parser.parse_args()
|
||||
assert git('rev-parse','HEAD').decode().strip()==M['base']
|
||||
for name,h in M['files'].items():assert sha(P/name)==h
|
||||
for name,h in M['original_backup_sha256'].items():assert sha(B/name)==h
|
||||
originals=json.loads((B/'originals.json').read_text())
|
||||
for name,index in originals.items():
|
||||
assert (R/name).read_bytes()==(B/(name+'.worktree')).read_bytes()
|
||||
assert git('ls-files','--stage','--',name).decode()==index
|
||||
wp,brief=M['paths'];assert (R/wp).read_bytes()==(P/'WP18.preimage.md').read_bytes()
|
||||
assert git('show',M['restore_brief_from_commit']+':'+brief)==(P/'brief.forward-restore.md').read_bytes()
|
||||
assert git('diff','--cached','--name-only')==b''
|
||||
before_index=git('ls-files','--stage').decode().splitlines()
|
||||
frozen={str(p.relative_to(R)):sha(p) for p in (R/'workplans/archived').glob('260622-RAIL-BS-WP-000[234]-*.md')};assert len(frozen)==3
|
||||
assert sha(R/'WORK-RECORDS.md')==M['original_backup_sha256']['WORK-RECORDS.md.worktree']
|
||||
git('apply','--check',str(P/'forward-correction.patch'))
|
||||
if not a.execute:print(json.dumps({'status':'checked-ready','paths':M['paths'],'original_brief_and_work_records_preserved':True}));raise SystemExit(0)
|
||||
(P/'execution-start.json').write_text(json.dumps({'status':'started','base':M['base'],'index_entries':before_index,'frozen_sha256':frozen},indent=2)+'\n')
|
||||
commit_output='';error=None
|
||||
try:
|
||||
git('apply',str(P/'forward-correction.patch'))
|
||||
# --only feeds exactly the two reviewed worktree versions to normal hooks.
|
||||
commit_output=git('commit','--only','-m','Record Cluster publication and restore unrelated staged brief','--',*M['paths']).decode()
|
||||
finally:
|
||||
# The owner's original brief index/worktree is reinstated even if a hook refuses.
|
||||
(R/brief).write_bytes((B/(brief+'.worktree')).read_bytes())
|
||||
mode,oid,stagepath=originals[brief].split(' ',2)
|
||||
assert stagepath=='0\t'+brief+'\n'
|
||||
git('update-index','--cacheinfo',mode,oid,brief)
|
||||
for name,index in originals.items():
|
||||
assert (R/name).read_bytes()==(B/(name+'.worktree')).read_bytes()
|
||||
assert git('ls-files','--stage','--',name).decode()==index
|
||||
head=git('rev-parse','HEAD').decode().strip();assert head!=M['base']
|
||||
assert set(git('diff-tree','--no-commit-id','--name-only','-r',head).decode().splitlines())==set(M['paths'])
|
||||
assert git('show','HEAD:'+brief)==(P/'brief.forward-restore.md').read_bytes()
|
||||
assert git('show','HEAD:'+wp)==(P/'WP18.candidate.md').read_bytes()
|
||||
# Every unrelated stage entry is identical, including user's exact brief entry.
|
||||
without_wp=lambda entries:[line for line in entries if line.split('\t',1)[1]!=wp]
|
||||
assert without_wp(git('ls-files','--stage').decode().splitlines())==without_wp(before_index)
|
||||
assert {path:sha(R/path) for path in frozen}==frozen
|
||||
receipt={'status':'committed-forward-correction','head':head,'parent':M['base'],'paths':M['paths'],'commit_output':commit_output,'head_brief_equals_c562':True,'original_brief_index_and_worktree_restored':True,'all_other_index_entries_identical':True,'work_records_index_and_dirty_worktree_preserved':True,'three_archives_unchanged':True,'wp18_status':'active','task_blocks_and_UUIDs_unchanged':True,'legacy_deepfix':False,'history_rewrite':False,'native_TLS_acceptance':False,'all18historical_preservation_claim':False,'status_porcelain':git('status','--porcelain').decode()}
|
||||
(P/'forward-correction-commit.json').write_text(json.dumps(receipt,indent=2)+'\n');print(json.dumps(receipt,indent=2))
|
||||
|
|
@ -0,0 +1,33 @@
|
|||
<!-- custodian-brief: generated by fix-consistency — do not edit manually -->
|
||||
# Custodian Brief — railiance-cluster
|
||||
|
||||
**Domain:** financials
|
||||
**Last synced:** 2026-10-16 19:05 UTC
|
||||
**State Hub:** http://127.0.0.1:8000 *(adjust if running on a remote machine)*
|
||||
|
||||
## Current Goal
|
||||
|
||||
Install k3s and Kubernetes Baseline on the HostEurope Server
|
||||
|
||||
## Active Workstreams
|
||||
|
||||
### Review NetKingdom signer runtime and node-local storage readiness
|
||||
Progress: 1/3 done | workplan_id: `f383557d-c8a8-553e-adcd-9f82ff9c2929`
|
||||
|
||||
**Open tasks:**
|
||||
- ► Review the bounded native preflight and storage action `7f4320c6`
|
||||
- · Verify the approved runtime and storage result `747a8d77`
|
||||
|
||||
## Inbox Hygiene
|
||||
|
||||
**Stale unread:** 6 message(s) older than 3 day(s) — triage at session start.
|
||||
**Missing thread_id:** 8 unread message(s) lack supersession chains.
|
||||
- ! the-custodian: Workplan 'three-phoenix-ha-cluster' is blocked with no wait task `a1368d99`
|
||||
|
||||
---
|
||||
## MCP Orientation (when available)
|
||||
|
||||
If the state-hub MCP server is reachable, call:
|
||||
`get_domain_summary("financials")`
|
||||
This provides richer cross-domain context.
|
||||
If the MCP call fails, use this file as your orientation source.
|
||||
|
|
@ -0,0 +1,28 @@
|
|||
<!-- custodian-brief: generated by fix-consistency — do not edit manually -->
|
||||
# Custodian Brief — railiance-cluster
|
||||
|
||||
**Domain:** financials
|
||||
**Last synced:** 2026-10-13 18:24 UTC
|
||||
**State Hub:** http://127.0.0.1:8000 *(adjust if running on a remote machine)*
|
||||
|
||||
## Current Goal
|
||||
|
||||
Install k3s and Kubernetes Baseline on the HostEurope Server
|
||||
|
||||
## Active Workstreams
|
||||
|
||||
*(none — repo may need first-session setup)*
|
||||
|
||||
## Inbox Hygiene
|
||||
|
||||
**Stale unread:** 6 message(s) older than 3 day(s) — triage at session start.
|
||||
**Missing thread_id:** 6 unread message(s) lack supersession chains.
|
||||
- ! the-custodian: Workplan 'three-phoenix-ha-cluster' is blocked with no wait task `a1368d99`
|
||||
|
||||
---
|
||||
## MCP Orientation (when available)
|
||||
|
||||
If the state-hub MCP server is reachable, call:
|
||||
`get_domain_summary("financials")`
|
||||
This provides richer cross-domain context.
|
||||
If the MCP call fails, use this file as your orientation source.
|
||||
Loading…
Add table
Add a link
Reference in a new issue