the-custodian/workplans/CUST-WP-0079-deterministic-security-flow.md

id	type	title	domain	repo	status	owner	topic_slug	created	updated	flavor	depends_on	state_hub_workstream_id
CUST-WP-0079	workplan	Deterministic security flow: standing authorizations, flow report, and agent re-engagement	infotech	the-custodian	active	claude-code	custodian	2026-10-11	2026-10-11	implementation		ab288f92-d364-5c24-9362-aee451f266c3

Follow-up to history/20261011-netkingdom-security-progress-assessment.md. About 80 % of the security estate's open tasks were wait, and agent time went into re-reading waits and producing evidence packets. This plan replaces that loop with (1) standing founder authorizations, (2) deterministic reports and sync, and (3) a narrow, re-scoped coding-agent goal.

Critical path (everything else is residual until promoted): identity (key-cape, user-engine) → authorization (access-engine + policy-nexus guardrails) → secrets (secrets-engine over OpenBao, response-wrapped delivery) → SecurityCase execution (ops-mason → ops-warden / ArgoCD), proven first on oidc-browser-relying-party (NK-WP-0048-T06, KEY-WP-0038).

Founder decision batch and hub/repo decision sync

id: CUST-WP-0079-T01
status: done
priority: high
state_hub_task_id: "618b32bb-3b30-5c31-b054-65b455d62b0b"

2026-10-11: D1, D2, D3 resolved, plus round 2 (standing build-mode change rule; D10 MFA remainder; D4 + D5). Recorded in docs/decisions/2026-10-11-security-unblock-decisions.md. 31 open hub decisions were already resolved in repo decision logs (gate-house, kings-guard, tenant-engine, security-canon, repo-manager) and were synced. Open hub decisions went from 61 to 22. 26 tasks were requalified, including fixes for tasks mislabeled as human gates. 10 workplans were demoted to residual.

Deterministic tooling

id: CUST-WP-0079-T02
status: done
priority: high
state_hub_task_id: "2764581a-ff8f-5a05-90bd-3dc6bd058ae5"

scripts/security_flow_report.py (READY / UNBLOCKED / ATTENDED / STALLED from workplan files), scripts/requalify_tasks.py (apply task requalifications from a JSON plan), scripts/sync_resolved_decisions.py (resolve hub decisions that repo logs already record as resolved or accepted).

Schedule the flow report and decision sync

id: CUST-WP-0079-T03
status: wait
priority: high
state_hub_task_id: "1be0569c-221d-5925-a0ff-fd2af88e52b1"
blocked_on: message-from:activity-core
blocking_reason: "Awaiting daily schedule owner acceptance; workstation user service bus unavailable. Handoff 117e538e-da06-48b8-ba68-b82300a832e7."

Run sync_resolved_decisions.py --apply and security_flow_report.py --json daily (activity-core schedule, or a workstation timer until activity-core has the lane). Post a hub message to the coding agent only when UNBLOCKED or READY changed, and to the founder only when ATTENDED is non-empty. Agents must not poll wait tasks themselves.

Implementation (2026-10-11): scripts/security_flow_daily.py runs both commands, includes the-custodian in the default security estate, checkpoints each delivered recipient, and notifies the coding agent only when READY/UNBLOCKED changes. Empty ATTENDED lists never message the founder. User timer units are in infra/security-flow/; make security-flow-check passes nine tests including interrupted delivery and retry. Live hub dry-run succeeds. Schedule activation handoff 117e538e-da06-48b8-ba68-b82300a832e7 to activity-core is attached to case:cross-owner:CUST-WP-0079-T03:activity-core (infra/security-flow/scheduling-handoff.json); no owner acceptance or foreign dependency is invented. Schedule activation remains pending: workstation systemctl --user cannot connect to its user bus (No data available), so checked-in units alone do not establish daily execution.

Encode the standing change rule as a policy-nexus guardrail

id: CUST-WP-0079-T04
status: wait
depends_on: [PNEX-WP-0006]
blocking_reason: "policy-nexus owns guardrail publication; handoff written as PNEX-WP-0006."
priority: high
state_hub_task_id: "5dd52156-09a8-5781-b288-99ae822f59a6"

Canon source written 2026-10-11: canon/standards/build-mode-change-authorization_v0.1.md (founder-decided). Closes when PNEX-WP-0006 publishes it.

Stop agent-authored index and sync commits

id: CUST-WP-0079-T05
status: progress
priority: medium
state_hub_task_id: "8a3dc219-8982-5903-9407-e1b549d4544c"

WORK-RECORDS.md, source inventories, publication indexes and "projection refresh" files must be regenerated by a make target in a pre-commit hook or a Forgejo Action, not by agent commits. Start with the security repos. Done when a week of git log shows no standalone index-only commits from agents.

Implementation (2026-10-11): scripts/check_generated_only_commit.py checks staged files or every commit in a revision range. Forgejo workflow generated-commit-guard.yaml rejects standalone WORK-RECORDS, source-inventory, publication-index, projection-refresh, generated briefs and explicit evidence/decision-packet commits regardless of author; a later source commit cannot hide an earlier generated-only commit. make generated-commit-check provides the local hook entry point. The CI suite covers the rejection using a real temporary git repository. Consumer generator adoption and the required week of clean logs remain open; this task is not claimed complete.

The local guard is installed; make generated-commit-hook reproduces that installation and refuses to replace a different hook. The consistency CLI has no no-commit/no-push mode: its first invocation unexpectedly published brief-only ebaa38b, retained as a failed acceptance observation. Its subsequent invocation committed the already reviewed, staged implementation as 6fe7201; that commit includes source code. Future generated-only commits are rejected locally and in CI. The full Custodian suite passes 77 tests.

The default flow report now includes Custodian and activity-core, both required by the renewed critical path. Cross-owner completion can therefore unblock the platform activation task without an agent polling its wait body. Human gates also retain their intervention note in the generated report instead of a blank reason. CLI regression checks cover the actual owner completion transition and the default Custodian lane.

Attended window #1

id: CUST-WP-0079-T06
status: wait
needs_human: true
blocking_reason: "Partly done 2026-10-11: list cut from 14 to 3; U05-U07 accepted, U08 waits on KEY-WP-0040-T01. Remaining founder acts: USER-WP-0026-T03 readback, RPF-WP-0044-T08 coulombcore check, the U08 re-run, and Sol's added RPF-WP-0044-T04 issuer login."
priority: high
state_hub_task_id: "e3da807f-9a6e-513f-82dc-3714a489e7bf"

Re-engage the coding agent with the renewed goal

id: CUST-WP-0079-T07
status: done
priority: high
state_hub_task_id: "91ec924c-b305-5a63-925d-087a3b927d60"

Replace the Sol goal with the renewed text in the assessment history file (section "Renewed goal"). Re-engage now for the READY lane. It does not depend on T06.

Completed 2026-10-11: the renewed critical-path goal is active in thread 01a126e1-76f8-7643-8cf3-e93336539ade; its attached text was read before execution. Work resumed from READY/UNBLOCKED, with three workers pinned to eligible workplans and the accepted build-mode authorization in force. This closes re-engagement only, not the live critical-path goal.