121 lines
4.1 KiB
Markdown
121 lines
4.1 KiB
Markdown
---
|
|
id: CUST-WP-0079
|
|
type: workplan
|
|
title: "Deterministic security flow: standing authorizations, flow report, and agent re-engagement"
|
|
domain: infotech
|
|
repo: the-custodian
|
|
status: active
|
|
owner: claude-code
|
|
topic_slug: custodian
|
|
created: "2026-10-11"
|
|
updated: "2026-10-11"
|
|
flavor: implementation
|
|
depends_on: []
|
|
state_hub_workstream_id: "ab288f92-d364-5c24-9362-aee451f266c3"
|
|
---
|
|
|
|
Follow-up to `history/20261011-netkingdom-security-progress-assessment.md`. About 80 % of the
|
|
security estate's open tasks were `wait`, and agent time went into re-reading waits and producing
|
|
evidence packets. This plan replaces that loop with (1) standing founder authorizations,
|
|
(2) deterministic reports and sync, and (3) a narrow, re-scoped coding-agent goal.
|
|
|
|
Critical path (everything else is residual until promoted):
|
|
identity (key-cape, user-engine) → authorization (access-engine + policy-nexus guardrails) →
|
|
secrets (secrets-engine over OpenBao, response-wrapped delivery) → SecurityCase execution
|
|
(ops-mason → ops-warden / ArgoCD), proven first on oidc-browser-relying-party (NK-WP-0048-T06,
|
|
KEY-WP-0038).
|
|
|
|
## Founder decision batch and hub/repo decision sync
|
|
|
|
```task
|
|
id: CUST-WP-0079-T01
|
|
status: done
|
|
priority: high
|
|
state_hub_task_id: "618b32bb-3b30-5c31-b054-65b455d62b0b"
|
|
```
|
|
|
|
2026-10-11: D1, D2, D3 resolved, plus round 2 (standing build-mode change rule; D10 MFA remainder;
|
|
D4 + D5). Recorded in `docs/decisions/2026-10-11-security-unblock-decisions.md`. 31 open hub
|
|
decisions were already resolved in repo decision logs (gate-house, kings-guard, tenant-engine,
|
|
security-canon, repo-manager) and were synced. Open hub decisions went from 61 to 22. 26 tasks were
|
|
requalified, including fixes for tasks mislabeled as human gates. 10 workplans were demoted to
|
|
residual.
|
|
|
|
## Deterministic tooling
|
|
|
|
```task
|
|
id: CUST-WP-0079-T02
|
|
status: done
|
|
priority: high
|
|
state_hub_task_id: "2764581a-ff8f-5a05-90bd-3dc6bd058ae5"
|
|
```
|
|
|
|
`scripts/security_flow_report.py` (READY / UNBLOCKED / ATTENDED / STALLED from workplan files),
|
|
`scripts/requalify_tasks.py` (apply task requalifications from a JSON plan),
|
|
`scripts/sync_resolved_decisions.py` (resolve hub decisions that repo logs already record as
|
|
resolved or accepted).
|
|
|
|
## Schedule the flow report and decision sync
|
|
|
|
```task
|
|
id: CUST-WP-0079-T03
|
|
status: todo
|
|
priority: high
|
|
state_hub_task_id: "1be0569c-221d-5925-a0ff-fd2af88e52b1"
|
|
```
|
|
|
|
Run `sync_resolved_decisions.py --apply` and `security_flow_report.py --json` daily (activity-core
|
|
schedule, or a workstation timer until activity-core has the lane). Post a hub message to the
|
|
coding agent only when UNBLOCKED or READY changed, and to the founder only when ATTENDED is
|
|
non-empty. Agents must not poll wait tasks themselves.
|
|
|
|
## Encode the standing change rule as a policy-nexus guardrail
|
|
|
|
```task
|
|
id: CUST-WP-0079-T04
|
|
status: wait
|
|
depends_on: [PNEX-WP-0006]
|
|
blocking_reason: "policy-nexus owns guardrail publication; handoff written as PNEX-WP-0006."
|
|
priority: high
|
|
state_hub_task_id: "5dd52156-09a8-5781-b288-99ae822f59a6"
|
|
```
|
|
|
|
Canon source written 2026-10-11: `canon/standards/build-mode-change-authorization_v0.1.md`
|
|
(founder-decided). Closes when PNEX-WP-0006 publishes it.
|
|
|
|
## Stop agent-authored index and sync commits
|
|
|
|
```task
|
|
id: CUST-WP-0079-T05
|
|
status: todo
|
|
priority: medium
|
|
state_hub_task_id: "8a3dc219-8982-5903-9407-e1b549d4544c"
|
|
```
|
|
|
|
WORK-RECORDS.md, source inventories, publication indexes and "projection refresh" files must be
|
|
regenerated by a `make` target in a pre-commit hook or a Forgejo Action, not by agent commits.
|
|
Start with the security repos. Done when a week of git log shows no standalone index-only commits
|
|
from agents.
|
|
|
|
## Attended window #1
|
|
|
|
```task
|
|
id: CUST-WP-0079-T06
|
|
status: wait
|
|
needs_human: true
|
|
blocking_reason: "Founder runs docs/attended-window/2026-10-11-checklist.md (about 2 h)."
|
|
priority: high
|
|
state_hub_task_id: "e3da807f-9a6e-513f-82dc-3714a489e7bf"
|
|
```
|
|
|
|
## Re-engage the coding agent with the renewed goal
|
|
|
|
```task
|
|
id: CUST-WP-0079-T07
|
|
status: todo
|
|
priority: high
|
|
state_hub_task_id: "91ec924c-b305-5a63-925d-087a3b927d60"
|
|
```
|
|
|
|
Replace the Sol goal with the renewed text in the assessment history file (section "Renewed
|
|
goal"). Re-engage now for the READY lane. It does not depend on T06.
|