From fb7c116c3d8d9d8dc4ae80bbe9e64230ef6d8eaa Mon Sep 17 00:00:00 2001 From: codex Date: Mon, 2 Nov 2026 00:06:59 +0100 Subject: [PATCH] docs: preserve consistency bindings and blocked-work handoff --- .../consistency-receipt.json | 25 +++++++ .../projected-tasks.json | 75 +++++++++++++++++++ .../sync-closeout-receipt.json | 17 ++++- ...0083-fleet-sync-and-scanner-remediation.md | 11 +++ 4 files changed, 127 insertions(+), 1 deletion(-) create mode 100644 docs/changes/2026-11-01-scanner-json-digest/consistency-receipt.json create mode 100644 docs/changes/2026-11-01-scanner-json-digest/projected-tasks.json diff --git a/docs/changes/2026-11-01-scanner-json-digest/consistency-receipt.json b/docs/changes/2026-11-01-scanner-json-digest/consistency-receipt.json new file mode 100644 index 00000000..af778e1d --- /dev/null +++ b/docs/changes/2026-11-01-scanner-json-digest/consistency-receipt.json @@ -0,0 +1,25 @@ +{ + "repo_slug": "the-custodian", + "source_revision": "450fad9ee9cbc4e872641df818444346b5f0be49", + "result": "warn", + "summary": { + "fail": 0, + "automation_error": 0, + "warn": 6, + "info": 4 + }, + "fixes_applied": [ + "C-06 fixed: created workstream a5b7b679\u2026 for CUST-WP-0083, wrote ID to CUST-WP-0083-fleet-sync-and-scanner-remediation.md", + " + task CUST-WP-0083-T01 \u2192 790b9295\u2026", + " + task CUST-WP-0083-T02 \u2192 c7bf93ed\u2026", + " + task CUST-WP-0083-T03 \u2192 a09478f1\u2026", + " + task CUST-WP-0083-T04 \u2192 589e1a54\u2026", + " + task CUST-WP-0083-T05 \u2192 af09a25a\u2026", + " + task CUST-WP-0083-T06 \u2192 2f91d01a\u2026", + " + task CUST-WP-0083-T07 \u2192 3081a39b\u2026", + " + task CUST-WP-0083-T08 \u2192 39ef8dbd\u2026", + " + task CUST-WP-0083-T09 \u2192 9e59ef2e\u2026", + " + task CUST-WP-0083-T10 \u2192 108c0633\u2026", + "brief: .custodian-brief.md updated" + ] +} diff --git a/docs/changes/2026-11-01-scanner-json-digest/projected-tasks.json b/docs/changes/2026-11-01-scanner-json-digest/projected-tasks.json new file mode 100644 index 00000000..f0b3fff3 --- /dev/null +++ b/docs/changes/2026-11-01-scanner-json-digest/projected-tasks.json @@ -0,0 +1,75 @@ +{ + "workplan_id": "a5b7b679-7431-5c9d-b716-a900fcc58811", + "tasks": [ + { + "id": "790b9295-469d-5b74-90b4-4cffa024f133", + "status": "done", + "needs_human": false, + "workplan_id": "a5b7b679-7431-5c9d-b716-a900fcc58811", + "workstream_id": "a5b7b679-7431-5c9d-b716-a900fcc58811" + }, + { + "id": "c7bf93ed-4d01-5128-85c5-dcba10054274", + "status": "wait", + "needs_human": false, + "workplan_id": "a5b7b679-7431-5c9d-b716-a900fcc58811", + "workstream_id": "a5b7b679-7431-5c9d-b716-a900fcc58811" + }, + { + "id": "a09478f1-59c3-589d-ac7a-5439cc79af09", + "status": "wait", + "needs_human": false, + "workplan_id": "a5b7b679-7431-5c9d-b716-a900fcc58811", + "workstream_id": "a5b7b679-7431-5c9d-b716-a900fcc58811" + }, + { + "id": "589e1a54-9a4e-5f90-bd29-5c61a6cf8081", + "status": "wait", + "needs_human": true, + "workplan_id": "a5b7b679-7431-5c9d-b716-a900fcc58811", + "workstream_id": "a5b7b679-7431-5c9d-b716-a900fcc58811" + }, + { + "id": "af09a25a-7aa4-5d40-ac8f-62b23aeea75d", + "status": "wait", + "needs_human": false, + "workplan_id": "a5b7b679-7431-5c9d-b716-a900fcc58811", + "workstream_id": "a5b7b679-7431-5c9d-b716-a900fcc58811" + }, + { + "id": "2f91d01a-e234-5c6f-b200-cfa8f7a6e966", + "status": "done", + "needs_human": false, + "workplan_id": "a5b7b679-7431-5c9d-b716-a900fcc58811", + "workstream_id": "a5b7b679-7431-5c9d-b716-a900fcc58811" + }, + { + "id": "3081a39b-4f0d-55a2-b756-25f6a6915b72", + "status": "done", + "needs_human": false, + "workplan_id": "a5b7b679-7431-5c9d-b716-a900fcc58811", + "workstream_id": "a5b7b679-7431-5c9d-b716-a900fcc58811" + }, + { + "id": "39ef8dbd-09fb-5b25-a2f4-e035c6fa4484", + "status": "wait", + "needs_human": false, + "workplan_id": "a5b7b679-7431-5c9d-b716-a900fcc58811", + "workstream_id": "a5b7b679-7431-5c9d-b716-a900fcc58811" + }, + { + "id": "9e59ef2e-a2cf-5b22-8404-5e98a7450ecb", + "status": "done", + "needs_human": false, + "workplan_id": "a5b7b679-7431-5c9d-b716-a900fcc58811", + "workstream_id": "a5b7b679-7431-5c9d-b716-a900fcc58811" + }, + { + "id": "108c0633-f4a8-56cd-8c3b-18e3b8424f77", + "status": "done", + "needs_human": false, + "workplan_id": "a5b7b679-7431-5c9d-b716-a900fcc58811", + "workstream_id": "a5b7b679-7431-5c9d-b716-a900fcc58811" + } + ] +} diff --git a/docs/changes/2026-11-01-scanner-json-digest/sync-closeout-receipt.json b/docs/changes/2026-11-01-scanner-json-digest/sync-closeout-receipt.json index 39738115..99963ef8 100644 --- a/docs/changes/2026-11-01-scanner-json-digest/sync-closeout-receipt.json +++ b/docs/changes/2026-11-01-scanner-json-digest/sync-closeout-receipt.json @@ -164,5 +164,20 @@ }, "native_policy_changed": false, "native_preflight_receipt_available": false, - "goal_complete": false + "goal_complete": false, + "consistency": { + "result": "warn", + "summary": { + "fail": 0, + "automation_error": 0, + "warn": 6, + "info": 4 + }, + "workplan_id": "a5b7b679-7431-5c9d-b716-a900fcc58811" + }, + "additional_smtp_commits": { + "coulomb-social": "ea09958", + "railiance-platform": "16b4e33", + "both_normal_receiver_acceptances": true + } } diff --git a/workplans/CUST-WP-0083-fleet-sync-and-scanner-remediation.md b/workplans/CUST-WP-0083-fleet-sync-and-scanner-remediation.md index 9e59494a..cd706ad4 100644 --- a/workplans/CUST-WP-0083-fleet-sync-and-scanner-remediation.md +++ b/workplans/CUST-WP-0083-fleet-sync-and-scanner-remediation.md @@ -11,6 +11,7 @@ updated: "2026-11-01" flavor: implementation depends_on: [] related_repos: [repo-manager, railiance-forge, railiance-apps, rapp-flex-auth-secrets-engine, intelligence-radar] +state_hub_workstream_id: "a5b7b679-7431-5c9d-b716-a900fcc58811" --- Founder request: inspect all local changes, commit and synchronize what can be published, explain failures and their class-level remedy, and bring remotes completely up to date. The retired executor-worker archive remains local by explicit founder direction. Its direct intent/code successor is rein-aharness, beneath glas-harness. @@ -21,6 +22,7 @@ Founder request: inspect all local changes, commit and synchronize what can be p id: CUST-WP-0083-T01 status: done priority: high +state_hub_task_id: "790b9295-469d-5b74-90b4-4cffa024f133" ``` Discovered 210 checkouts. Reviewed primary changes, managed clones, linked worktrees and ignored upstream dependencies. Initial inventory and remote observations are preserved in `/tmp/repo-sync-inventory.json`, `/tmp/fleet-fetch-results.json` and the audit below. Retired prototype disposition and missing RApp stub were resolved with the founder; the RApp histories were merged without rewriting either side. @@ -31,6 +33,7 @@ Discovered 210 checkouts. Reviewed primary changes, managed clones, linked workt id: CUST-WP-0083-T02 status: wait priority: high +state_hub_task_id: "c7bf93ed-4d01-5128-85c5-dcba10054274" ``` Seven repositories received source/workplan/session/capture commits, and 16 affected repositories stopped tracking their generated local brief while preserving it on disk. 168 checkout tips have been directly verified equal to remote refs. Intelligence Radar's full original history is now published after bounded normal receiver scans; temporary refs were removed. Custodian smaller-batch commit loop is terminal: 232 initial paths plus 3,553 retry paths were committed, and 139 original paths remain scanner-refused. The clean-file checkpoint was remotely verified at b4dfcd794117236852c111419bc47fa167df1f9b; audit/source metadata is published separately. No index writer remains active. Exact result files are linked in `docs/repository-sync-2026-11-01.md`. Generated-only refreshes and rejected originals remain intact pending their documented dispositions. @@ -41,6 +44,7 @@ Seven repositories received source/workplan/session/capture commits, and 16 affe id: CUST-WP-0083-T03 status: wait priority: high +state_hub_task_id: "a09478f1-59c3-589d-ac7a-5439cc79af09" ``` Generated-only gates, local/remote scanner deadlines and false positives are independently identified. A paired JSON filename/SHA256 profile correction passes 12 local real-scanner tests and the full receiver real-scanner suite, and clears the exact RApp blocked blob. Candidate sources, exact digests, tests and negative coverage are in `docs/changes/2026-11-01-scanner-json-digest/`. It does not adjudicate every other provenance/UUID/fixture finding. Inspect all remaining failed blobs without printing credential values and keep exact originals. Repaired all 17 managed cache routes: 15 matched their current primary name; issue-facade → issue-core and repo-registry → repo-scoping were proven through Git ancestry. Fetches succeeded and every pinned cache HEAD has zero unpublished commits. No cached worktree content or pins were changed. Adopted the staged-source index generator in approval-engine, informed-decision and state-hub; regeneration, check, normal commits and pushes passed. @@ -53,6 +57,7 @@ status: wait priority: high needs_human: true intervention_note: "Run bash /tmp/forge-scanner-preflight.sh in the founder terminal and return the selected receipt; exact native correction and rollback will then be prepared for approval." +state_hub_task_id: "589e1a54-9a4e-5f90-bd29-5c61a6cf8081" ``` Human-lane checkpoint: the current ops-mason-builder identity cannot inspect the forge or perform native administration. The founder returned current deployment/pod identity using their attended admin context. Read-only artifact/config/guard/headroom inspection is prepared as `/tmp/forge-scanner-preflight.sh` and awaits its result. Prepare the exact guarded rollout, verification, rollback and cost/risk assessment from this evidence before requesting approval. The agent must not borrow the founder admin kubeconfig. No local runtime scanner or receiver policy is changed by the existing candidate. Preserve original revisions, failures and any refinements in supervised receipts; no autopilot or scored approval is inferred. @@ -63,6 +68,7 @@ Human-lane checkpoint: the current ops-mason-builder identity cannot inspect the id: CUST-WP-0083-T05 status: wait priority: high +state_hub_task_id: "af09a25a-7aa4-5d40-ac8f-62b23aeea75d" ``` After all live loops are terminal, finish the audit, run required State Hub consistency, commit it through normal hooks, publish all eligible pending history, verify exact remote tips and absence of temporary refs, and inspect final Git status across the full inventory. Give explicit evidence/dispositions for every remaining uncommittable file and class-level suggestions. Do not call the goal complete while required owned-repository publication is blocked or unverified. If actionable work remains when this workplan is finished, hand it to live work records first. @@ -73,6 +79,7 @@ After all live loops are terminal, finish the audit, run required State Hub cons id: CUST-WP-0083-T06 status: done priority: medium +state_hub_task_id: "2f91d01a-e234-5c6f-b200-cfa8f7a6e966" ``` Completed 2026-11-01. Fifteen clones matched primary repository names. Two historical names were resolved by actual commit ancestry: issue-facade → issue-core, repo-registry → repo-scoping. All 17 canonical fetches passed; pins and local files stayed intact, and no pinned HEAD has unpublished commits. Evidence: `/tmp/cache-remote-reconciliation-results.json`, `/tmp/renamed-cache-reconciliation-results.json`. This is route/containment proof, not an assertion that a deliberately pinned checkout must move to latest main. @@ -83,6 +90,7 @@ Completed 2026-11-01. Fifteen clones matched primary repository names. Two histo id: CUST-WP-0083-T07 status: done priority: medium +state_hub_task_id: "3081a39b-4f0d-55a2-b756-25f6a6915b72" ``` Completed 2026-11-01. Approval-engine, informed-decision and state-hub adopted the already-existing staged-source generator. The two opt-in files and regenerated index were committed through normal hooks and pushed in each repository. Generation and `--check` passed. Evidence: `/tmp/generated-adoption-results.json`; commits f41a9ca, b8d35ca and ed2f0e9. Unrelated weekly operating evidence was excluded. This extracts the completed prevention mechanism from T03; T03 retains scanner finding adjudication and the narrow correction proposal. @@ -93,6 +101,7 @@ Completed 2026-11-01. Approval-engine, informed-decision and state-hub adopted t id: CUST-WP-0083-T08 status: wait priority: medium +state_hub_task_id: "39ef8dbd-09fb-5b25-a2f4-e035c6fa4484" ``` The all-ref audit found seven non-current branches with commits absent from remote refs. Four are now published under their existing names without rewriting or merging main: executor-sandbox local-smoke-2026-07, reef-railiance backup-pre-main-reset, rein-aharness assembly-webfetcher-v0.2.0, and Custodian cust-wp-0081-original-unpublished. Normal receiver acceptance and exact remote-tip checks passed. Three histories retain scanner refusals: RApp user-engine's pre-envstrip backup contains captured GPG_KEY fingerprint entries; Apps custody preparation has a JSON SHA256-manifest false positive; coulomb-social's unpublished progress branch hits generic-api-key on documentation prose at docs/usecases/platform-communication.md line 41. The exact introduced blob failed even though commit-diff inspection was clean, showing why diff-only scanning is insufficient. Original historical branches remain intact; do not bypass the receiver or call a raw fingerprint a private key. Propose narrowly scoped, content-bound adjudication for these classes and preserve the complete scanner scope. Receipts: `/tmp/unpublished-branch-inspection-results.json`, `/tmp/extra-branch-push-results.json`, `/tmp/csoc-unpublished-object-inspection.json`. The current mail-address-semantics tip was also rechecked and its push found the remote already up to date. @@ -103,6 +112,7 @@ The all-ref audit found seven non-current branches with commits absent from remo id: CUST-WP-0083-T09 status: done priority: high +state_hub_task_id: "9e59ef2e-a2cf-5b22-8404-5e98a7450ecb" ``` Completed 2026-11-01. The initial successful batches committed 232 paths and the retry committed 3,553 paths, including the archive audit. All clean-file batches passed normal local hooks and remote introduced-object checks, and the completed archive checkpoint b4dfcd794117236852c111419bc47fa167df1f9b was directly equal to remote main. Exactly 139 original paths remain; every one has value-free rule/line diagnostics. There are no unverified or generated-only leaf refusals in the smaller retry. This closes the eligible-file phase of T02, not the remaining held publication or the full goal. @@ -113,6 +123,7 @@ Completed 2026-11-01. The initial successful batches committed 232 paths and the id: CUST-WP-0083-T10 status: done priority: high +state_hub_task_id: "108c0633-f4a8-56cd-8c3b-18e3b8424f77" ``` Completed 2026-11-01. Paired local/receiver rule changes have identical profile content; 12 selected local pinned-Gitleaks tests passed and the full receiver suite passed in 150.087 seconds with the real pinned scanner. The exact RApp rejected source-pin blob passes the candidate. Source/binary digests, negative-test coverage and rollback intent are retained in docs/changes/2026-11-01-scanner-json-digest/. This extracts completed source proof from T03; it is not native admission, authority, activation or a disposition for unrelated findings.