Checked all 7 WARDEN-WP-0012-origin findings against ops-warden's live
catalog before any hand-off. 6 were already shipped weeks before this
migration (2026-07-21) -- the source suggestions just never got closed:
- CUST-IN-0001 -> issue-core-ingestion-api-key: active since 2026-07-02
(CCR-2026-0002/RAILIANCE-WP-0009, audit-verified)
- CUST-IN-0002 -> activity-core-issue-sink: active since 2026-06-18
- CUST-IN-0003 -> openrouter-llm-connect: active since 2026-07-02
(CCR-2026-0003/RAILIANCE-WP-0010, audit-verified)
- CUST-IN-0005 -> key-cape-oidc-login: active since 2026-06-27 (used
directly this session, 2026-07-20, to fetch the forgejo-admin-api-token)
- CUST-IN-0006 -> flex-auth-policy-check: active since 2026-06-18
- CUST-IN-0007 -> railiance-infra-principals: active since 2026-06-18
All 6 closed outcome: absorbed, file + hub in sync, pointing at the
shipped catalog entry. No Forgejo issue opened for these -- the fleet
doesn't use Forgejo issue tracking as a coordination mechanism (retired
2026-07-20), and this file is exactly the sanctioned equivalent.
CUST-IN-0004 (object-storage-sts) is the one real item: routed, not
closed. Its own ops-warden playbook is explicit -- "ops-warden does not
vend object-storage credentials" / "do not ask ops-warden" -- and its
tracking workplan (WARDEN-WP-0012, finished 2026-06-27) already scoped
correctly: T04 delivered the pointer playbook only, not the vending
path. Real owners per that workplan's own table: net-kingdom
(architecture), flex-auth (policy decision), railiance-platform (OpenBao
broker), artifact-store (consumer, ARTIFACT-STORE-WP-0007). References
NK-WP-0007. Left routed with full context for one of those four repos'
owners to pick up -- not implemented here, not ops-warden's to do.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
One-time close-out of the legacy suggestions table, per the
founder-reviewed decision to retire it (fresh intake entity, not a
rename-bridge). At retirement, 10 records were still open (stage:
suggestion, never promoted/declined) -- real signal from other domains'
agents: 7 ops-warden WARDEN-WP-0012 gated routing scenarios, 2
state-hub STATE-WP-0069/0073 items, 1 binky-control repo-classification
finding. Rather than discard the signal, migrated each into a proper
file-backed intake record (CUST-IN-0001..0010) landing in this repo --
the fleet's natural holding ground for cross-domain findings with no
specific owning repo yet, since none of these ever had a file origin
(hub-first creation is exactly the anti-pattern this whole effort
exists to close).
Each carries origin: "legacy-suggestion:<uuid>" back to the retired
record. All 10 registered live against the real hub via C-32 (state_hub_intake_id
written back). WORK-RECORDS.md regenerated to include them.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
