4.1 KiB
| id | type | title | domain | repo | status | owner | topic_slug | created | updated | flavor | depends_on | state_hub_workstream_id |
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| CUST-WP-0079 | workplan | Deterministic security flow: standing authorizations, flow report, and agent re-engagement | infotech | the-custodian | active | claude-code | custodian | 2026-10-11 | 2026-10-11 | implementation | ab288f92-d364-5c24-9362-aee451f266c3 |
Follow-up to history/20261011-netkingdom-security-progress-assessment.md. About 80 % of the
security estate's open tasks were wait, and agent time went into re-reading waits and producing
evidence packets. This plan replaces that loop with (1) standing founder authorizations,
(2) deterministic reports and sync, and (3) a narrow, re-scoped coding-agent goal.
Critical path (everything else is residual until promoted): identity (key-cape, user-engine) → authorization (access-engine + policy-nexus guardrails) → secrets (secrets-engine over OpenBao, response-wrapped delivery) → SecurityCase execution (ops-mason → ops-warden / ArgoCD), proven first on oidc-browser-relying-party (NK-WP-0048-T06, KEY-WP-0038).
Founder decision batch and hub/repo decision sync
id: CUST-WP-0079-T01
status: done
priority: high
state_hub_task_id: "618b32bb-3b30-5c31-b054-65b455d62b0b"
2026-10-11: D1, D2, D3 resolved, plus round 2 (standing build-mode change rule; D10 MFA remainder;
D4 + D5). Recorded in docs/decisions/2026-10-11-security-unblock-decisions.md. 31 open hub
decisions were already resolved in repo decision logs (gate-house, kings-guard, tenant-engine,
security-canon, repo-manager) and were synced. Open hub decisions went from 61 to 22. 26 tasks were
requalified, including fixes for tasks mislabeled as human gates. 10 workplans were demoted to
residual.
Deterministic tooling
id: CUST-WP-0079-T02
status: done
priority: high
state_hub_task_id: "2764581a-ff8f-5a05-90bd-3dc6bd058ae5"
scripts/security_flow_report.py (READY / UNBLOCKED / ATTENDED / STALLED from workplan files),
scripts/requalify_tasks.py (apply task requalifications from a JSON plan),
scripts/sync_resolved_decisions.py (resolve hub decisions that repo logs already record as
resolved or accepted).
Schedule the flow report and decision sync
id: CUST-WP-0079-T03
status: todo
priority: high
state_hub_task_id: "1be0569c-221d-5925-a0ff-fd2af88e52b1"
Run sync_resolved_decisions.py --apply and security_flow_report.py --json daily (activity-core
schedule, or a workstation timer until activity-core has the lane). Post a hub message to the
coding agent only when UNBLOCKED or READY changed, and to the founder only when ATTENDED is
non-empty. Agents must not poll wait tasks themselves.
Encode the standing change rule as a policy-nexus guardrail
id: CUST-WP-0079-T04
status: wait
depends_on: [PNEX-WP-0006]
blocking_reason: "policy-nexus owns guardrail publication; handoff written as PNEX-WP-0006."
priority: high
state_hub_task_id: "5dd52156-09a8-5781-b288-99ae822f59a6"
Canon source written 2026-10-11: canon/standards/build-mode-change-authorization_v0.1.md
(founder-decided). Closes when PNEX-WP-0006 publishes it.
Stop agent-authored index and sync commits
id: CUST-WP-0079-T05
status: todo
priority: medium
state_hub_task_id: "8a3dc219-8982-5903-9407-e1b549d4544c"
WORK-RECORDS.md, source inventories, publication indexes and "projection refresh" files must be
regenerated by a make target in a pre-commit hook or a Forgejo Action, not by agent commits.
Start with the security repos. Done when a week of git log shows no standalone index-only commits
from agents.
Attended window #1
id: CUST-WP-0079-T06
status: wait
needs_human: true
blocking_reason: "Founder runs docs/attended-window/2026-10-11-checklist.md (about 2 h)."
priority: high
state_hub_task_id: "e3da807f-9a6e-513f-82dc-3714a489e7bf"
Re-engage the coding agent with the renewed goal
id: CUST-WP-0079-T07
status: todo
priority: high
state_hub_task_id: "91ec924c-b305-5a63-925d-087a3b927d60"
Replace the Sol goal with the renewed text in the assessment history file (section "Renewed goal"). Re-engage now for the READY lane. It does not depend on T06.