92 lines
6.4 KiB
Diff
92 lines
6.4 KiB
Diff
diff --git a/.custodian-brief.md b/.custodian-brief.md
|
|
index 0cb912a..122e79b 100644
|
|
--- a/.custodian-brief.md
|
|
+++ b/.custodian-brief.md
|
|
@@ -2,17 +2,33 @@
|
|
# Custodian Brief — secrets-engine
|
|
|
|
**Domain:** infotech
|
|
-**Last synced:** 2026-10-11 17:52 UTC
|
|
+**Last synced:** 2026-10-12 06:27 UTC
|
|
**State Hub:** http://127.0.0.1:8000 *(adjust if running on a remote machine)*
|
|
|
|
## Active Workstreams
|
|
|
|
+### Constrain PDP transport and authenticate decision responses
|
|
+Progress: 1/3 done | workplan_id: `7252469d-d7a5-5c18-8911-b511b8c6a736`
|
|
+
|
|
+**Open tasks:**
|
|
+- ! Verify the admitted native consumer and rotation path `85aa4c78`
|
|
+ *(wait: Requires reviewed verification-key admission, source enforcement and exact native rollout receipt; no production trust change is proposed yet.)*
|
|
+- · Implement independently anchored responder authentication `877782e5`
|
|
+
|
|
### Design and prove task-scoped protected OpenBao execution
|
|
Progress: 1/3 done | workplan_id: `5e38aecc-85ca-5f55-94c6-9fbb08604819`
|
|
|
|
**Open tasks:**
|
|
+- ! Define the exact mediated execution contract `b2f0d462`
|
|
+ *(wait: Independent Platform mediated-contract review and identity/approval/PDP owner returns remain required; D3 wrapped primitive source is implemented, no native entitlement is inferred.)*
|
|
- ! Implement and prove one native metadata action `5f8f7c41`
|
|
-- ► Define the exact mediated execution contract `b2f0d462`
|
|
+
|
|
+### Production-safe provisioning, authorization, and lifecycle hardening
|
|
+Progress: 6/7 done | workplan_id: `68a39be1-bd9c-5133-ad64-e7bca892aaf3`
|
|
+
|
|
+**Open tasks:**
|
|
+- ! Resume native production lane adoption `a0a1dd92`
|
|
+ *(wait: Engine approval hardening is complete. Remaining per-lane cutover includes native routing/proxy retirement with ops-warden under SECRETS-WP-0006-T05/T06; the exact OpenRouter key-check receipt does not establish broader recipient readiness.)*
|
|
|
|
### Activate native Claude credential delivery for Glas
|
|
Progress: 2/3 done | workplan_id: `40ccc3b4-d046-5a58-8649-e7935f45c974`
|
|
@@ -26,23 +42,16 @@ Progress: 4/6 done | workplan_id: `31f7f8ea-7f73-516c-8877-f03a13f1db82`
|
|
|
|
**Open tasks:**
|
|
- ! Stage live apply and verification `fb103f1e`
|
|
- *(wait: OpenRouter key-check native acceptance is recorded in SECRETS-WP-0010-T03. Other lanes still need exact approvals, scoped attended apply and per-lane positive/negative/health/revocation evidence.)*
|
|
+ *(wait: Owner work first: publish a reviewed scoped-apply command per lane. Per-lane approvals are no longer needed (D1 standing rule); each lane with a command enters the attended window.)*
|
|
- ! Reconcile routing ownership and retire interim proxies `1431edae`
|
|
*(wait: Needs owner-agreed routing/proxy retirement for each verified lane and custody disposition of the legacy npm pointer; a single approved OpenRouter key-check does not authorize broader routing cutover.)*
|
|
|
|
-### Production-safe provisioning, authorization, and lifecycle hardening
|
|
-Progress: 6/7 done | workplan_id: `68a39be1-bd9c-5133-ad64-e7bca892aaf3`
|
|
-
|
|
-**Open tasks:**
|
|
-- ! Resume native production lane adoption `a0a1dd92`
|
|
- *(wait: Engine approval hardening is complete. Remaining per-lane cutover includes native routing/proxy retirement with ops-warden under SECRETS-WP-0006-T05/T06; the exact OpenRouter key-check receipt does not establish broader recipient readiness.)*
|
|
-
|
|
### Evolve the Lifecycle engine to the accepted security layer model
|
|
Progress: 5/6 done | workplan_id: `9c9e5164-b2f5-5ea2-a557-5368d65e9fe0`
|
|
|
|
**Open tasks:**
|
|
- ! No standing engine credential `d7bc8bdc`
|
|
- *(wait: Positive service-JWT login proof passed 2026-10-10 (SECRETS-WP-0012-T03, docs/evidence/2026-10-10-keycape-openbao-probe.json). Waits on railiance-platform closing RPF-WP-0035-T02 with the CCR-2026-0038 negative checks, then on routing live engine actions through service-jwt instead of bootstrap/env.)*
|
|
+ *(wait: Published JWT contract and positive login/revocation are delivered. Native KEY-WP-0039-T02 claim negatives, CCR-2026-0038 effective-policy/capability/expiry/use checks and MASON-WP-0009-T05 remain. Login-self-only grants no protected-operation authority: agree and implement separately reviewed task-scoped backend execution entitlement, then prove functional steady-state service-identity adoption without bootstrap/env fallback.)*
|
|
|
|
## Inbox Hygiene
|
|
|
|
diff --git a/WORK-RECORDS.md b/WORK-RECORDS.md
|
|
index 70e5831..a467a0e 100644
|
|
--- a/WORK-RECORDS.md
|
|
+++ b/WORK-RECORDS.md
|
|
@@ -22,6 +22,7 @@
|
|
| workplan | SECRETS-WP-0011 | finished | — | workplans/SECRETS-WP-0011-multi-lane-exec-owner-delivery.md |
|
|
| workplan | SECRETS-WP-0012 | finished | — | workplans/SECRETS-WP-0012-keycape-openbao-consumer-custody.md |
|
|
| workplan | SECRETS-WP-0013 | proposed | — | workplans/SECRETS-WP-0013-task-scoped-openbao-execution.md |
|
|
+| workplan | SECRETS-WP-0014 | active | — | workplans/SECRETS-WP-0014-pdp-transport-and-responder-authentication.md |
|
|
| task | SECRETS-WP-ADHOC-2026-08-21-T01 | done | — | workplans/ADHOC-2026-08-21.md |
|
|
| task | SECRETS-WP-ADHOC-2026-08-23-T01 | done | — | workplans/ADHOC-2026-08-23.md |
|
|
| task | SECRETS-WP-0001-T01 | done | — | workplans/SECRETS-WP-0001-statehub-bootstrap.md |
|
|
@@ -83,9 +84,12 @@
|
|
| task | SECRETS-WP-0012-T02 | cancel | — | workplans/SECRETS-WP-0012-keycape-openbao-consumer-custody.md |
|
|
| task | SECRETS-WP-0012-T03 | done | — | workplans/SECRETS-WP-0012-keycape-openbao-consumer-custody.md |
|
|
| task | SECRETS-WP-0012-T04 | done | — | workplans/SECRETS-WP-0012-keycape-openbao-consumer-custody.md |
|
|
-| task | SECRETS-WP-0013-T01 | progress | — | workplans/SECRETS-WP-0013-task-scoped-openbao-execution.md |
|
|
+| task | SECRETS-WP-0013-T01 | wait | — | workplans/SECRETS-WP-0013-task-scoped-openbao-execution.md |
|
|
| task | SECRETS-WP-0013-T02 | done | — | workplans/SECRETS-WP-0013-task-scoped-openbao-execution.md |
|
|
| task | SECRETS-WP-0013-T03 | wait | — | workplans/SECRETS-WP-0013-task-scoped-openbao-execution.md |
|
|
+| task | SECRETS-WP-0014-T01 | done | — | workplans/SECRETS-WP-0014-pdp-transport-and-responder-authentication.md |
|
|
+| task | SECRETS-WP-0014-T02 | todo | — | workplans/SECRETS-WP-0014-pdp-transport-and-responder-authentication.md |
|
|
+| task | SECRETS-WP-0014-T03 | wait | — | workplans/SECRETS-WP-0014-pdp-transport-and-responder-authentication.md |
|
|
| intake | SECRETS-IN-0001 | closed | — | intakes/intakes.md |
|
|
| intake | SECRETS-IN-0002 | closed | — | intakes/intakes.md |
|
|
| intake | SECRETS-IN-0003 | closed | — | intakes/intakes.md |
|