1535 lines
68 KiB
JSON
1535 lines
68 KiB
JSON
[
|
|
{
|
|
"repo": "security-canon",
|
|
"head": "1664a6def20be2759a1e575024563efd27c9f36f",
|
|
"plans": []
|
|
},
|
|
{
|
|
"repo": "net-kingdom",
|
|
"head": "d552bf253c398548f2eae8f4101981c1329dcdc1",
|
|
"plans": [
|
|
{
|
|
"path": "workplans/NK-WP-0011-enterprise-federation-saml.md",
|
|
"id": "NK-WP-0011",
|
|
"status": "active",
|
|
"flavor": "residual",
|
|
"title": "Enterprise Federation & SAML \u2014 Expanded-Mode Keycloak Identity Broker",
|
|
"tasks": [
|
|
{
|
|
"id": "NK-WP-0011-T02",
|
|
"state_hub_task_id": "2fe6f100-3a5d-563e-b033-7d7b846ae487",
|
|
"status": "wait",
|
|
"priority": "high",
|
|
"blocking_reason": "ADR-0009 adoption trigger absent; then railiance-platform/rapp-postgres must admit the database consumer and return backup/restore evidence.",
|
|
"needs_human": "true",
|
|
"decision_id": "8a5d1eb8-b665-4d25-9742-a15ecfc87c0c"
|
|
},
|
|
{
|
|
"id": "NK-WP-0011-T03",
|
|
"state_hub_task_id": "32d1411b-10a4-5a8b-8f43-99ac46d83908",
|
|
"status": "wait",
|
|
"priority": "high",
|
|
"blocking_reason": "ADR-0009 adoption trigger and named package/runtime owner absent; requires T02 database admission and governed OpenBao/ESO role plus immutable issuer assignment.",
|
|
"depends_on": "- NK-WP-0011-T02"
|
|
},
|
|
{
|
|
"id": "NK-WP-0011-T04",
|
|
"state_hub_task_id": "6697a994-7343-5ea8-8b37-bc3b921e5a9b",
|
|
"status": "wait",
|
|
"priority": "high",
|
|
"blocking_reason": "Named tenant/upstream IdP owner/federation need absent; requires admitted broker and owner-reviewed tenant-scoped claim mappings plus actual login evidence.",
|
|
"depends_on": "- NK-WP-0011-T03"
|
|
},
|
|
{
|
|
"id": "NK-WP-0011-T05",
|
|
"state_hub_task_id": "d845380d-3dbc-5e59-8f2b-5a4d1b32d89d",
|
|
"status": "wait",
|
|
"priority": "medium",
|
|
"blocking_reason": "Adoption trigger absent; requires per-IdP assurance trust mapping and reviewed privileged step-up delivery from issuer/package and access-engine owners.",
|
|
"depends_on": "- NK-WP-0011-T04"
|
|
},
|
|
{
|
|
"id": "NK-WP-0011-T06",
|
|
"state_hub_task_id": "9cb7fd93-c16e-5102-83ce-195b3aa87446",
|
|
"status": "wait",
|
|
"priority": "high",
|
|
"blocking_reason": "Requires admitted live broker, canonical tenant issuer selection and dedicated test-client conformance/coexistence evidence; adoption trigger absent.",
|
|
"depends_on": "- NK-WP-0011-T03"
|
|
},
|
|
{
|
|
"id": "NK-WP-0011-T07",
|
|
"state_hub_task_id": "38998c68-29bf-50d2-8c8d-0c75184d5833",
|
|
"status": "wait",
|
|
"priority": "high",
|
|
"blocking_reason": "Requires tenant-engine tier/issuer ownership and access-engine boundary/freshness enforcement evidence after adoption trigger and broker admission.",
|
|
"depends_on": "- NK-WP-0011-T03"
|
|
},
|
|
{
|
|
"id": "NK-WP-0011-T08",
|
|
"state_hub_task_id": "e5f44ddc-9645-5f61-b84c-da5ab9cccb6d",
|
|
"status": "wait",
|
|
"priority": "medium",
|
|
"blocking_reason": "Requires admitted database/broker, named recovery and audit owners, off-host restore and observed audit/break-glass receipts; adoption trigger absent.",
|
|
"depends_on": "- NK-WP-0011-T02"
|
|
},
|
|
{
|
|
"id": "NK-WP-0011-T09",
|
|
"status": "wait",
|
|
"priority": "medium",
|
|
"state_hub_task_id": "d9dc4292-6b66-5797-9ff9-a1a4a556278e",
|
|
"blocking_reason": "Requires named tenant and admitted package owner, canonical tier contract and isolated subject/issuer-preserving upgrade/rollback drill; adoption trigger absent.",
|
|
"depends_on": "- NK-WP-0011-T03"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"path": "workplans/NK-WP-0022-railiance01-identity-cutover-and-coulombcore-retirement.md",
|
|
"id": "NK-WP-0022",
|
|
"status": "blocked",
|
|
"flavor": "implementation",
|
|
"title": "Cut over NetKingdom identity to railiance01 and retire CoulombCore",
|
|
"tasks": [
|
|
{
|
|
"id": "NK-WP-0022-T08",
|
|
"status": "wait",
|
|
"needs_human": "true",
|
|
"decision_id": "5d8dcdb5-6d7b-463e-bb39-0a4737331403",
|
|
"blocking_reason": "Founder 2026-10-11: coulombcore is retired and the machine reused (D4 batch approved). Order: host-side inventory (containers, on-disk manifests; no kube API, certs expired 2026-08-31), then stop k3s for good and wipe for reuse. Executes after Sol's passing railiance01 restore/restart drill receipt. Never rotate certs or restart k3s there first.",
|
|
"priority": "medium",
|
|
"state_hub_task_id": "42a3b4c0-3481-5cfa-bdc2-66d05e751829"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"path": "workplans/NK-WP-0027-reef-placement-reconciliation.md",
|
|
"id": "NK-WP-0027",
|
|
"status": "active",
|
|
"flavor": "residual",
|
|
"title": "Reconcile reef placement and security-zone canon dependencies",
|
|
"tasks": [
|
|
{
|
|
"id": "NK-WP-0027-T02",
|
|
"status": "wait",
|
|
"blocked_on": "message-from:repo-manager",
|
|
"blocking_reason": "Requires repo-manager acceptance of the reef provider carrier/schema, then railiance-infra authored ceilings, conditions and evidence in the authoritative reef declaration.",
|
|
"priority": "medium",
|
|
"state_hub_task_id": "5b35b646-a525-55da-852a-6005613d42ea"
|
|
},
|
|
{
|
|
"id": "NK-WP-0027-T03",
|
|
"status": "wait",
|
|
"depends_on": "[NK-WP-0027-T02]",
|
|
"blocking_reason": "Mechanical join of reef ceilings to consumer V declarations waits on T02.",
|
|
"priority": "low",
|
|
"state_hub_task_id": "e3f0bb0f-0c85-5cb9-a5ab-75f668cd3447"
|
|
},
|
|
{
|
|
"id": "NK-WP-0027-T06",
|
|
"status": "wait",
|
|
"blocked_on": "message-from:info-tech-canon",
|
|
"blocking_reason": "Requires InfoTechCanon ruling on public disclosure classification versus synthetic provenance, then ops-warden authoritative dataclass_floor mapping and tests; no public-to-synthetic alias.",
|
|
"priority": "high",
|
|
"state_hub_task_id": "bf8b3e1d-7ee0-5ad0-8705-5a580a9fb546"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"path": "workplans/NK-WP-0031-deterministic-posture-feedback.md",
|
|
"id": "NK-WP-0031",
|
|
"status": "active",
|
|
"flavor": "residual",
|
|
"title": "Implement deterministic posture and evidence feedback",
|
|
"tasks": [
|
|
{
|
|
"id": "NK-WP-0031-T04",
|
|
"status": "wait",
|
|
"blocked_on": "message-from:audit-core",
|
|
"blocking_reason": "audit-core tenancy.yaml must publish structured authoritative owner, observation/expiry and replacement-action metadata for WH-ENG-20260822-AUDIT-E2-03. Re-evaluate with explicit current as-of; later recovery prose does not renew E2.",
|
|
"priority": "high",
|
|
"state_hub_task_id": "7d2029d2-db8d-526e-ab73-a0751becb193"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"path": "workplans/NK-WP-0035-emission-cadence-security-profile.md",
|
|
"id": "NK-WP-0035",
|
|
"status": "active",
|
|
"flavor": "residual",
|
|
"title": "Publish the NetKingdom emission-cadence security profile",
|
|
"tasks": [
|
|
{
|
|
"id": "NK-WP-0035-T04",
|
|
"status": "wait",
|
|
"blocked_on": "message-from:approval-engine",
|
|
"blocking_reason": "Approval Engine and Qonto owner declarations now pass the published schema and supplied-inventory profile; local-identity incompatibility is retained. Requires actual sender cadence mappings, lifecycle delivery/readback/reconciliation and Kings Guard operational feed evidence.",
|
|
"priority": "high",
|
|
"state_hub_task_id": "e3fbc8b8-00d5-57ce-ba0c-19b58044c950"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"path": "workplans/NK-WP-0040-execution-attribution-receipt.md",
|
|
"id": "NK-WP-0040",
|
|
"status": "active",
|
|
"flavor": "residual",
|
|
"title": "Define an execution-attribution receipt for Railiance runs",
|
|
"tasks": [
|
|
{
|
|
"id": "NK-WP-0040-T02",
|
|
"status": "wait",
|
|
"blocked_on": "message-from:railiance-master",
|
|
"blocking_reason": "Audit-core accepted evidence custody and published field/admission requirements in AUDIT-WP-0014-T01. Still needs Railiance owner confirmation of exact emitter and wire binding before canonical schema/validator implementation, followed by actual emission/readback and attribution/clock/unknown-case acceptance.",
|
|
"priority": "medium",
|
|
"state_hub_task_id": "963120c1-7c72-5806-942b-6f49e4c66e54"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"path": "workplans/NK-WP-0048-security-case-types.md",
|
|
"id": "NK-WP-0048",
|
|
"status": "active",
|
|
"flavor": "implementation",
|
|
"title": "Establish SecurityCaseTypes so that known security cases are light",
|
|
"tasks": [
|
|
{
|
|
"id": "NK-WP-0048-T06",
|
|
"status": "wait",
|
|
"depends_on": "[NK-WP-0048-T05, NK-WP-0048-T08, NK-WP-0048-T09, MASON-WP-0010-T03, WARDEN-WP-0044-T03]",
|
|
"blocking_reason": "Type1.2 architecture has a confirmed source-only founder acknowledgment; canonical1.1 remains unchanged/default and the1.2 reference case stays proposed. Needs explicit version selection/reference-source integration without normal admission bypass, closed owner adapters plus global/native receipt verifier (WARDEN-WP-0044-T03), independently verified six-object structural materialization and CCR42 claims/created-only provenance, exact broker/case/source reconciliation, then separately authorized native mint/delivery and attended registry/consumer verification. Source acknowledgment, a bundle or local tests do not prove implemented/materialized/live status.",
|
|
"priority": "high",
|
|
"state_hub_task_id": "d9b26bcf-a7c6-59a2-92a0-f913d76a203c"
|
|
},
|
|
{
|
|
"id": "NK-WP-0048-T07",
|
|
"status": "wait",
|
|
"depends_on": "[NK-WP-0048-T06]",
|
|
"blocking_reason": "The next types follow once the first one is proven end to end.",
|
|
"priority": "medium",
|
|
"state_hub_task_id": "c3c9c3ae-4f23-5ba7-9e6f-e63bcf29b9f7"
|
|
}
|
|
]
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"repo": "gate-house",
|
|
"head": "bc890c4d050a2e726ce8988a8260ab9caea133e3",
|
|
"plans": [
|
|
{
|
|
"path": "workplans/GH-WP-0004-section-11-layer-declarations.md",
|
|
"id": "GH-WP-0004",
|
|
"status": "active",
|
|
"flavor": "implementation",
|
|
"title": "\u00a711 layer declarations \u2014 amendment set and estate closure",
|
|
"tasks": [
|
|
{
|
|
"id": "GH-WP-0004-T06",
|
|
"status": "progress",
|
|
"priority": "medium",
|
|
"state_hub_task_id": "62ac1f55-d3fc-59bd-84a5-8baec5de6bac"
|
|
}
|
|
]
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"repo": "ops-mason",
|
|
"head": "d86ad141befb6800468f5132d4c7c9ce2f852bb5",
|
|
"plans": [
|
|
{
|
|
"path": "workplans/MASON-WP-0004-credential-inventory-descriptions.md",
|
|
"id": "MASON-WP-0004",
|
|
"status": "blocked",
|
|
"flavor": "planning",
|
|
"title": "Describe every stored credential so the store is navigable",
|
|
"tasks": [
|
|
{
|
|
"id": "MASON-WP-0004-T03",
|
|
"status": "wait",
|
|
"depends_on": "[MASON-WP-0004-T01]",
|
|
"blocked_on": "owners",
|
|
"blocking_reason": "Owners fill the gaps in manifests/custody-descriptions.yaml for the 9 draft entries (asked 2026-10-09).",
|
|
"priority": "low",
|
|
"state_hub_task_id": "fff26914-d854-5854-b350-d7241812fb04"
|
|
},
|
|
{
|
|
"id": "MASON-WP-0004-T04",
|
|
"status": "wait",
|
|
"depends_on": "[MASON-WP-0004-T03]",
|
|
"blocking_reason": "After T03. A scheduled --undescribed report needs an unattended metadata-read credential and a named reader; survey grants are human-minted and expire within an hour.",
|
|
"priority": "low",
|
|
"state_hub_task_id": "9a0cea06-eb63-54ad-963d-db4ea79c7c66"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"path": "workplans/MASON-WP-0005-fluid-telegram-operator-credential-lane.md",
|
|
"id": "MASON-WP-0005",
|
|
"status": "blocked",
|
|
"flavor": "planning",
|
|
"title": "Construct the fluid-telegram operator credential lane",
|
|
"tasks": [
|
|
{
|
|
"id": "MASON-WP-0005-T05",
|
|
"status": "progress",
|
|
"depends_on": "[MASON-WP-0005-T04]",
|
|
"blocked_on": "human",
|
|
"blocking_reason": "ops-mason checks and the non-member refusal pass (2026-10-09). tegwick has no MFA factor: it enrolls through user-engine self-service MFA (message ab89a591, USER-WP-0028-T03), then the founder runs scripts/verify-fluid-telegram-lane.sh member; fluid-telegram runs the salt create-once probe (FT-WP-0002).",
|
|
"priority": "high",
|
|
"state_hub_task_id": "4c205be7-4f1f-5dd1-aafa-fc112fdd640e"
|
|
},
|
|
{
|
|
"id": "MASON-WP-0005-T06",
|
|
"status": "wait",
|
|
"depends_on": "[MASON-WP-0005-T05]",
|
|
"blocking_reason": "After T05 verification; only ops-warden activates the entry.",
|
|
"priority": "medium",
|
|
"state_hub_task_id": "09eae088-808d-5342-b100-292e13958ee3"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"path": "workplans/MASON-WP-0006-readiness-tier-check.md",
|
|
"id": "MASON-WP-0006",
|
|
"status": "blocked",
|
|
"flavor": "implementation",
|
|
"title": "Check the target's readiness tier before a direct Kubernetes apply",
|
|
"tasks": [
|
|
{
|
|
"id": "MASON-WP-0006-T06",
|
|
"status": "wait",
|
|
"decision_id": "89f1058f-33bc-47a8-8a49-0b44d426c67e",
|
|
"blocked_on": "message-from:railiance-platform",
|
|
"blocking_reason": "Plan-approval exception accepted under D2; closes when policy-nexus ArgoCD onboarding is confirmed.",
|
|
"priority": "medium",
|
|
"depends_on": "[RAPP-POLICY-NEXUS-WP-0002-T05]",
|
|
"state_hub_task_id": "49dd5f9a-307b-5baf-809e-bd3893c73341"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"path": "workplans/MASON-WP-0009-keycape-secrets-engine-openbao-client-custody.md",
|
|
"id": "MASON-WP-0009",
|
|
"status": "blocked",
|
|
"flavor": "planning",
|
|
"title": "Place the KeyCape secrets-engine-openbao client secret in OpenBao",
|
|
"tasks": [
|
|
{
|
|
"id": "MASON-WP-0009-T05",
|
|
"status": "progress",
|
|
"blocked_on": "human",
|
|
"blocking_reason": "ops-mason checks complete (policies, roles, invariant ii, login proof). Owner-run: live operator/ESO token capability checks and a non-member refusal; ops-warden activates the proposed pointer.",
|
|
"priority": "medium",
|
|
"state_hub_task_id": "1b1a0566-add7-59c1-94b0-6bb81d2d1537"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"path": "workplans/MASON-WP-0010-security-case-materialization.md",
|
|
"id": "MASON-WP-0010",
|
|
"status": "blocked",
|
|
"flavor": "implementation",
|
|
"title": "Materialize SecurityCases from their type, with acceptance as the only gate",
|
|
"tasks": [
|
|
{
|
|
"id": "MASON-WP-0010-T03",
|
|
"status": "progress",
|
|
"depends_on": "[MASON-WP-0010-T02]",
|
|
"blocked_on": "message-from:railiance-platform",
|
|
"blocking_reason": "Typed exact structural evidence request is prepared. Native materialization waits on independently authenticated policy/role/layout/catalog observations and CCR42 consumer binding/application. Mint, delivery and first live verification are follow-through, not structural prerequisites.",
|
|
"priority": "high",
|
|
"state_hub_task_id": "56cea6be-c613-586c-80cd-125340b374da"
|
|
},
|
|
{
|
|
"id": "MASON-WP-0010-T04",
|
|
"status": "wait",
|
|
"depends_on": "[MASON-WP-0010-T03]",
|
|
"blocking_reason": "After T03, and only once a type fits: secrets-engine-openbao is a service (JWT) client, which oidc-browser-relying-party does not cover.",
|
|
"priority": "medium",
|
|
"state_hub_task_id": "f6ad0d3c-8f47-5fdf-8115-6ca9d8a1fead"
|
|
}
|
|
]
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"repo": "ops-warden",
|
|
"head": "6d2f1be9691b19e826898a2166ae4451e4802ae2",
|
|
"plans": [
|
|
{
|
|
"path": "workplans/WARDEN-WP-0027-credential-governance-lockdown.md",
|
|
"id": "WARDEN-WP-0027",
|
|
"status": "blocked",
|
|
"flavor": "implementation",
|
|
"title": "Tamper-resistant credential governance + mass rotation/lockdown (Strand B)",
|
|
"tasks": [
|
|
{
|
|
"id": "WARDEN-WP-0027-T02",
|
|
"status": "todo",
|
|
"decision_id": "1591daa1-6e85-4dfd-aadd-5a9fe1ef47fa",
|
|
"priority": "medium",
|
|
"state_hub_task_id": "cae498ee-6307-5d32-9f1b-a471cfcc2536"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"path": "workplans/WARDEN-WP-0034-layer-model-v07-conformance.md",
|
|
"id": "WARDEN-WP-0034",
|
|
"status": "active",
|
|
"flavor": "residual",
|
|
"title": "Layer model v0.7 conformance \u2014 state the deadline, bind the agent boundary, steward the estate's newest rule",
|
|
"tasks": [
|
|
{
|
|
"id": "WARDEN-WP-0034-T05",
|
|
"status": "wait",
|
|
"blocked_on": "message-from:ops-mason",
|
|
"blocking_reason": "Two items to route, not absorb: ops-mason has published no stance map; the second is another repository's to own.",
|
|
"priority": "low",
|
|
"state_hub_task_id": "7d1b3c82-9b96-5087-a53a-496212909029"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"path": "workplans/WARDEN-WP-0037-whynot-design-forgejo-npm-lane.md",
|
|
"id": "WARDEN-WP-0037",
|
|
"status": "blocked",
|
|
"flavor": "planning",
|
|
"title": "Repoint the whynot-design npm lane to Forgejo",
|
|
"tasks": [
|
|
{
|
|
"id": "WARDEN-WP-0037-T03",
|
|
"status": "wait",
|
|
"priority": "high",
|
|
"decision_id": "1591daa1-6e85-4dfd-aadd-5a9fe1ef47fa",
|
|
"depends_on": "[SECRETS-WP-0006-T06]",
|
|
"blocking_reason": "Hold kept by D3 until SECRETS-WP-0006-T06 moves publishing off the legacy whynot-design npm path; then rotate and prove a fresh publish.",
|
|
"intervention_note": "HOLD (founder, 2026-09-21): do not rotate yet. secrets-engine exec reads the ungoverned legacy path secret/coulomb/whynot-design/npm/publish (field npm_token); this runbook writes the governed path platform/workloads/coulomb/whynot-design/npm-publish (NPM_AUTH_TOKEN). A rotation now would not reach the live publish path. Resume after SECRETS-WP-0006-T06 moves the lane. Then: rotate the dedicated Forgejo package token, and prove a fresh publish and exact npm view through this lane.",
|
|
"state_hub_task_id": "a8b1b855-ab34-5835-b9fd-5f48bc0b6817"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"path": "workplans/WARDEN-WP-0040-unknown-zone-fail-closed-adoption.md",
|
|
"id": "WARDEN-WP-0040",
|
|
"status": "active",
|
|
"flavor": "residual",
|
|
"title": "Adopt unknown -> fail_closed behind signing-target classification coverage",
|
|
"tasks": [
|
|
{
|
|
"id": "WARDEN-WP-0040-T01",
|
|
"status": "wait",
|
|
"blocked_on": "message-from:ops-bridge",
|
|
"blocking_reason": "Warden's own declaration cannot classify the repair-path target workloads; the owner must declare the continuity actor/target and its z2-continuity resolution (see 2026-09-28 review).",
|
|
"priority": "high",
|
|
"state_hub_task_id": "611f0901-9fb5-5954-8dd0-a860c5f0cbec"
|
|
},
|
|
{
|
|
"id": "WARDEN-WP-0040-T02",
|
|
"status": "wait",
|
|
"blocked_on": "message-from:ops-bridge",
|
|
"blocking_reason": "Owners of agt-codex-interhub-bootstrap (ops-hub) and agt-state-hub-bridge (ops-bridge) must publish authoritative workload identity declarations; atm-backup-daily declared by activity-core and compiled 2026-10-09 (z2-protected, admission unsatisfied: M1 below M2 floor).",
|
|
"priority": "high",
|
|
"state_hub_task_id": "54ad4864-7bcf-592e-a187-9239a81a0b11"
|
|
},
|
|
{
|
|
"id": "WARDEN-WP-0040-T03",
|
|
"status": "wait",
|
|
"depends_on": "[WARDEN-WP-0040-T01]",
|
|
"blocking_reason": "Gated on T01 and on layer model v0.8 (or successor) reaching accepted; never convert against a proposed standard.",
|
|
"priority": "high",
|
|
"state_hub_task_id": "93eaf1f2-daaa-5e22-8804-85ca9433571c"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"path": "workplans/WARDEN-WP-0044-security-case-follow-through.md",
|
|
"id": "WARDEN-WP-0044",
|
|
"status": "active",
|
|
"flavor": "implementation",
|
|
"title": "Follow through on KnownSecurityCases along their type's route",
|
|
"tasks": [
|
|
{
|
|
"id": "WARDEN-WP-0044-T03",
|
|
"status": "progress",
|
|
"depends_on": "[WARDEN-WP-0044-T02, MASON-WP-0010-T03]",
|
|
"blocking_reason": "Local durable execution kernel and injected failure harness implemented. Native acceptance still requires authenticated owner machine descriptors/adapters, actual Forgejo materialization receipt, contained session integration, ordered verification and first native run.",
|
|
"priority": "high",
|
|
"state_hub_task_id": "bcbf6c91-2c04-5c16-ae8c-5d6c06fd6b89"
|
|
},
|
|
{
|
|
"id": "WARDEN-WP-0044-T04",
|
|
"status": "wait",
|
|
"depends_on": "[WARDEN-WP-0044-T03]",
|
|
"blocking_reason": "Catalog integration follows a proven run.",
|
|
"priority": "medium",
|
|
"state_hub_task_id": "4a0fa4a7-5ca9-518a-ab92-a79a5e2cf93e"
|
|
}
|
|
]
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"repo": "key-cape",
|
|
"head": "f8ea591ba4bdb8718457faac2264641fd98de2ce",
|
|
"plans": [
|
|
{
|
|
"path": "workplans/KEY-WP-0038-forgejo-oidc-client.md",
|
|
"id": "KEY-WP-0038",
|
|
"status": "active",
|
|
"flavor": "implementation",
|
|
"title": "Forgejo as a NetKingdom OIDC client, so the forge can close",
|
|
"tasks": [
|
|
{
|
|
"id": "KEY-WP-0038-T02",
|
|
"status": "wait",
|
|
"depends_on": "[KEY-WP-0038-T01, NK-WP-0048-T06]",
|
|
"blocking_reason": "Registration runs as the first KnownSecurityCase of type oidc-browser-relying-party (NK-WP-0048-T06), not as a hand-built rollout.",
|
|
"priority": "high",
|
|
"state_hub_task_id": "ddcfb482-8f33-5c81-9ce8-84be8fa5dc30"
|
|
},
|
|
{
|
|
"id": "KEY-WP-0038-T03",
|
|
"status": "wait",
|
|
"depends_on": "[KEY-WP-0038-T02]",
|
|
"blocking_reason": "Claims are verified against the registered client.",
|
|
"priority": "high",
|
|
"state_hub_task_id": "40ddaa29-7245-508c-ad48-ddc063e25115"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"path": "workplans/KEY-WP-0039-openbao-negative-probe-tokens.md",
|
|
"id": "KEY-WP-0039",
|
|
"status": "active",
|
|
"flavor": "implementation",
|
|
"title": "Negative-check tokens for the secrets-engine OpenBao JWT role",
|
|
"tasks": [
|
|
{
|
|
"id": "KEY-WP-0039-T02",
|
|
"status": "wait",
|
|
"depends_on": "[KEY-WP-0039-T01, KEY-WP-0038-T02, KEY-WP-0038-T03]",
|
|
"blocking_reason": "Ordered identity gate: Forgejo first SecurityCase registration/claims proof, then NetKingdom registry session and attended human/coding-agent custody; registration authorization already resolved.",
|
|
"priority": "medium",
|
|
"state_hub_task_id": "03da4c38-1dac-53b1-8b0b-e697df48e9d3"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"path": "workplans/KEY-WP-0040-mfa-attended-run-findings.md",
|
|
"id": "KEY-WP-0040",
|
|
"status": "ready",
|
|
"flavor": "implementation",
|
|
"title": "Fix findings from the first attended MFA run (factor recovery preview, OTP prompt help)",
|
|
"tasks": [
|
|
{
|
|
"id": "KEY-WP-0040-T01",
|
|
"status": "todo",
|
|
"priority": "high",
|
|
"state_hub_task_id": "b385602d-714a-5fdb-b40b-bd870420f28e"
|
|
},
|
|
{
|
|
"id": "KEY-WP-0040-T02",
|
|
"status": "todo",
|
|
"priority": "medium",
|
|
"state_hub_task_id": "3ad155dd-15ef-5522-bdf9-c78832728553"
|
|
}
|
|
]
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"repo": "user-engine",
|
|
"head": "85a419d6c5d0b4434d3ca7f33bde3092f5838f79",
|
|
"plans": [
|
|
{
|
|
"path": "workplans/USER-WP-0026-account-recovery.md",
|
|
"id": "USER-WP-0026",
|
|
"status": "blocked",
|
|
"flavor": "implementation",
|
|
"title": "Account recovery and visible identity and access",
|
|
"tasks": [
|
|
{
|
|
"id": "USER-WP-0026-T03",
|
|
"status": "wait",
|
|
"needs_human": "true",
|
|
"blocking_reason": "Signed-in readback live and correct for the deny path (tegwick: Informed Decision - Not available, founder-confirmed correct; docs/evidence/2026-10-11-signed-in-application-readback.md). Remaining: attended positive check with a net-kingdom-admins account (expect Available), then catalogue-management restoration before customers (FLEX-IN-0003).",
|
|
"priority": "high",
|
|
"state_hub_task_id": "95e9a6d4-7e57-5483-97c5-3f4a45bb6767"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"path": "workplans/USER-WP-0027-account-journey-clarity.md",
|
|
"id": "USER-WP-0027",
|
|
"status": "blocked",
|
|
"flavor": "implementation",
|
|
"title": "Clear account state and complete user, tenant-admin and platform-admin journeys",
|
|
"tasks": [
|
|
{
|
|
"id": "USER-WP-0027-T04",
|
|
"status": "wait",
|
|
"blocking_reason": "U05-U07 accepted 2026-10-11 (docs/evidence/2026-10-11-mfa-attended-u05-u08.md); P04 live recovery (U08) blocked by KEY-WP-0040-T01.",
|
|
"priority": "high",
|
|
"depends_on": "[KEY-WP-0040-T01]",
|
|
"state_hub_task_id": "9657abcb-690e-5323-8ff3-58253298ce7b"
|
|
},
|
|
{
|
|
"id": "USER-WP-0027-T06",
|
|
"status": "wait",
|
|
"depends_on": "[USER-WP-0026-T03, USER-WP-0027-T04, VERGABE-WP-0019]",
|
|
"blocking_reason": "Full journey matrix needs authoritative application access (USER-WP-0026-T03), factor recovery (T04) and preserves VERGABE-WP-0019 real-user acceptance.",
|
|
"priority": "high",
|
|
"state_hub_task_id": "550886ca-f916-5637-9639-b4134b0da939"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"path": "workplans/USER-WP-0028-user-journey-acceptance.md",
|
|
"id": "USER-WP-0028",
|
|
"status": "blocked",
|
|
"flavor": "implementation",
|
|
"title": "User account journeys and recovery",
|
|
"tasks": [
|
|
{
|
|
"id": "USER-WP-0028-T02",
|
|
"status": "wait",
|
|
"depends_on": "[USER-WP-0026-T03]",
|
|
"blocking_reason": "U09 reuses USER-WP-0026-T03 actual signed-in readback acceptance. T05 separately needs selection of the exact authoritative mutation fact and owner, then scoped mutation/revocation acceptance. Access readback delivers no generic grant API and FLEX-WP-0035 remains finished.",
|
|
"priority": "high",
|
|
"state_hub_task_id": "5d1bf977-034d-5448-b4fb-5a8b630af6ba"
|
|
},
|
|
{
|
|
"id": "USER-WP-0028-T03",
|
|
"status": "wait",
|
|
"blocking_reason": "U05-U07 accepted in the attended run of 2026-10-11 (docs/evidence/2026-10-11-mfa-attended-u05-u08.md). U08 blocked by the recovery-preview defect KEY-WP-0040-T01; re-run steps 6.3 onwards after the fix with platform-root as operator. Also fix the vague 'sign-in service's recovery instructions' wording on /security (F3).",
|
|
"priority": "high",
|
|
"depends_on": "[KEY-WP-0040-T01]",
|
|
"state_hub_task_id": "40e46e52-31ac-5abd-8793-04c1b7b82df3"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"path": "workplans/USER-WP-0035-onboarding-handoff-findings.md",
|
|
"id": "USER-WP-0035",
|
|
"status": "blocked",
|
|
"flavor": "implementation",
|
|
"title": "Onboarding handoff findings from the 2026-09-23 operator run",
|
|
"tasks": [
|
|
{
|
|
"id": "USER-WP-0035-T02",
|
|
"status": "wait",
|
|
"priority": "high",
|
|
"needs_human": "false",
|
|
"blocked_on": "message-from:email-connect",
|
|
"blocking_reason": "Existing mail service lacks an admitted provider password-setup template and recipient-bound opaque issuer handoff. EMAIL-IN-0001 and NET-IN-0005 request exact owner implementation records; no new founder choice or credential request.",
|
|
"state_hub_task_id": "fae614ba-ffc0-511d-9d22-2d91fbab057f"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"path": "workplans/USER-WP-0037-hub-authority-lookup.md",
|
|
"id": "USER-WP-0037",
|
|
"status": "blocked",
|
|
"flavor": "",
|
|
"title": "Read-only account authority for Hub integration",
|
|
"tasks": [
|
|
{
|
|
"id": "USER-WP-0037-T03",
|
|
"status": "wait",
|
|
"blocked_on": "message-from:state-hub",
|
|
"blocking_reason": "T02 delivered empty no-grant custody integration; real independently authenticated Hub caller credential admission and withdrawal/outage/private integration acceptance remain with state-hub (original f3bcc516; renewed request 350c3e12-284c-43a7-9ab1-116df8bcc007). Hub repository registration is not caller admission.",
|
|
"priority": "high",
|
|
"state_hub_task_id": "c5d67725-c685-50f6-9db8-28114a34014b"
|
|
}
|
|
]
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"repo": "tenant-engine",
|
|
"head": "1dabbcf47d87d27d118dcf3147d9e3588a807e0c",
|
|
"plans": [
|
|
{
|
|
"path": "workplans/TEN-WP-0012-external-conformance-waits.md",
|
|
"id": "TEN-WP-0012",
|
|
"status": "blocked",
|
|
"flavor": "residual",
|
|
"title": "Track the two external dispositions tenant-engine is waiting on",
|
|
"tasks": [
|
|
{
|
|
"id": "TEN-WP-0012-T01",
|
|
"status": "wait",
|
|
"flavor": "residual",
|
|
"priority": "medium",
|
|
"state_hub_task_id": "7898c1aa-b5de-54cf-87b7-67b727b5d0b2"
|
|
},
|
|
{
|
|
"id": "TEN-WP-0012-T02",
|
|
"status": "wait",
|
|
"flavor": "residual",
|
|
"priority": "low",
|
|
"state_hub_task_id": "f7d27d7c-f599-5d0e-b60b-9c3ad2b27b87"
|
|
}
|
|
]
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"repo": "role-engine",
|
|
"head": "d231241dbfeeb541b34243f4022883aa6417a1eb",
|
|
"plans": []
|
|
},
|
|
{
|
|
"repo": "zone-engine",
|
|
"head": "b5a6f88a82b125ebc82c0484bec1ea541e4f95d0",
|
|
"plans": []
|
|
},
|
|
{
|
|
"repo": "access-engine",
|
|
"head": "16ca97b2776789f730cc7049a2d6533612faaccd",
|
|
"plans": [
|
|
{
|
|
"path": "workplans/ADHOC-2026-10-03.md",
|
|
"id": "FLEX-WP-ADHOC-2026-10-03",
|
|
"status": "blocked",
|
|
"flavor": "",
|
|
"title": "2026-10-03 secret-read evaluator for ops-warden fetch checks",
|
|
"tasks": [
|
|
{
|
|
"id": "FLEX-WP-ADHOC-2026-10-03-T02",
|
|
"status": "wait",
|
|
"priority": "high",
|
|
"blocking_reason": "Install accepted retroactively (877c268b); steps 6-7 follow WARDEN-WP-0039-T03 token receipts and fetch URL.",
|
|
"depends_on": "[WARDEN-WP-0039-T03]",
|
|
"state_hub_task_id": "aa00b29f-fc1a-51e2-a373-0e3c72c1d6f4",
|
|
"decision_id": "877c268b-2089-42f1-a811-d98f549c1cb2"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"path": "workplans/FLEX-WP-0020-repository-identity-migration.md",
|
|
"id": "FLEX-WP-0020",
|
|
"status": "blocked",
|
|
"flavor": "planning",
|
|
"title": "Repository identity migration from flex-auth to access-engine",
|
|
"tasks": [
|
|
{
|
|
"id": "FLEX-WP-0020-T11",
|
|
"status": "wait",
|
|
"blocked_on": "message-from:sbom-nexus",
|
|
"blocking_reason": "Cleanup approved conditionally (e071b34e): runs once the listed soak evidence, SBOM-IN-0001 receipt and residual handoffs exist.",
|
|
"priority": "high",
|
|
"state_hub_task_id": "46d8318b-d1fb-52e3-b632-52230ed1438f",
|
|
"decision_id": "e071b34e-c4d4-49d0-824d-2c58bb0ae496"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"path": "workplans/FLEX-WP-0031-decision-record-emission.md",
|
|
"id": "FLEX-WP-0031",
|
|
"status": "active",
|
|
"flavor": "residual",
|
|
"title": "The decision record has a declared emission guarantee and nothing that delivers it",
|
|
"tasks": [
|
|
{
|
|
"id": "FLEX-WP-0031-T02",
|
|
"status": "wait",
|
|
"blocked_on": "message-from:audit-core",
|
|
"blocking_reason": "GH-WP-0004-T12 refused the load-bearing failure-path exception (GH-DEC-2026-024). AUDIT-IN-0006 sender rows and governed token delivery remain pending.",
|
|
"priority": "high",
|
|
"state_hub_task_id": "89661908-ca9a-5e4a-a0a5-62d1a9e02568"
|
|
},
|
|
{
|
|
"id": "FLEX-WP-0031-T06",
|
|
"status": "wait",
|
|
"depends_on": "[FLEX-WP-0031-T02]",
|
|
"blocked_on": "message-from:audit-core",
|
|
"blocking_reason": "Receiver counts use accepted_at, while local counts use commit time; audit-core must supply compatible window semantics or durable acceptance timestamps before a valid comparator can be implemented.",
|
|
"priority": "high",
|
|
"state_hub_task_id": "bf92a951-3b69-59dd-8907-f6748c91a264"
|
|
},
|
|
{
|
|
"id": "FLEX-WP-0031-T04",
|
|
"status": "wait",
|
|
"depends_on": "[FLEX-WP-0031-T08, FLEX-WP-0031-T06]",
|
|
"blocking_reason": "G2 needs T08 native heartbeat/drain and silence-finding evidence plus T06 reconciliation; local tests cannot close the delivery gap.",
|
|
"priority": "medium",
|
|
"state_hub_task_id": "423b3090-1b72-58fd-9353-5c907c7683bb"
|
|
},
|
|
{
|
|
"id": "FLEX-WP-0031-T08",
|
|
"status": "wait",
|
|
"priority": "high",
|
|
"depends_on": "[FLEX-WP-0031-T02]",
|
|
"needs_human": "true",
|
|
"blocking_reason": "Needs admitted sender/token mounts, founder approval of exact image/PVC/network rollout, and audit-core observer evidence; no production delivery is enabled.",
|
|
"state_hub_task_id": "b3b52b30-c73d-5a90-9935-d98afe5a9eaf"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"path": "workplans/FLEX-WP-0036-runtime-rename-access-engine.md",
|
|
"id": "FLEX-WP-0036",
|
|
"status": "active",
|
|
"flavor": "",
|
|
"title": "Runtime rename: flex-auth to access-engine, run side by side, consumers switch one at a time",
|
|
"tasks": [
|
|
{
|
|
"id": "FLEX-WP-0036-T01",
|
|
"status": "wait",
|
|
"needs_human": "true",
|
|
"intervention_note": "Exact new runtime principals/naming are included in the single daily red batch with the nine TokenReview grants; no per-item question.",
|
|
"priority": "high",
|
|
"state_hub_task_id": "4f9a796d-832f-5936-8a34-eb980f6e1b57"
|
|
},
|
|
{
|
|
"id": "FLEX-WP-0036-T02",
|
|
"status": "progress",
|
|
"priority": "high",
|
|
"depends_on": "[FLEX-WP-0036-T01]",
|
|
"state_hub_task_id": "8f597899-677e-544b-ad58-26aab2614312"
|
|
},
|
|
{
|
|
"id": "FLEX-WP-0036-T03",
|
|
"status": "wait",
|
|
"priority": "high",
|
|
"depends_on": "[FLEX-WP-0036-T01, FLEX-WP-0036-T04, RPF-WP-0044-T07]",
|
|
"state_hub_task_id": "487525e5-c89e-586e-8e9b-54ac6da0804e"
|
|
},
|
|
{
|
|
"id": "FLEX-WP-0036-T04",
|
|
"status": "wait",
|
|
"needs_human": "true",
|
|
"intervention_note": "New public coulomb/access-engine image package publication is included in the single daily red batch. Local source/build checks pass; paired publication has not run.",
|
|
"priority": "medium",
|
|
"depends_on": "[FLEX-WP-0036-T01]",
|
|
"state_hub_task_id": "ff7fd369-326f-5044-aaa4-96c5f45c80e9"
|
|
},
|
|
{
|
|
"id": "FLEX-WP-0036-T05",
|
|
"status": "wait",
|
|
"priority": "medium",
|
|
"depends_on": "[FLEX-WP-0036-T03, FLEX-WP-0036-T04]",
|
|
"state_hub_task_id": "13b93d7a-8341-5c76-9ae8-0f36b45b10fc"
|
|
},
|
|
{
|
|
"id": "FLEX-WP-0036-T06",
|
|
"status": "wait",
|
|
"priority": "medium",
|
|
"depends_on": "[FLEX-WP-0036-T02, FLEX-WP-0036-T05]",
|
|
"state_hub_task_id": "f0470e5c-3ea7-506c-b8bb-3ade0b57ff88"
|
|
},
|
|
{
|
|
"id": "FLEX-WP-0036-T07",
|
|
"status": "todo",
|
|
"priority": "medium",
|
|
"depends_on": "[FLEX-WP-0036-T06]",
|
|
"state_hub_task_id": "e46c9c8e-a114-5c49-b035-22fdbd6a435b"
|
|
},
|
|
{
|
|
"id": "FLEX-WP-0036-T08",
|
|
"status": "todo",
|
|
"priority": "low",
|
|
"depends_on": "[FLEX-WP-0036-T06]",
|
|
"state_hub_task_id": "be5440aa-4584-5e4f-9459-242ecf5c7199"
|
|
}
|
|
]
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"repo": "approval-engine",
|
|
"head": "e1649617e8ad321f79632d5fd33e973ae5d5ae51",
|
|
"plans": [
|
|
{
|
|
"path": "workplans/APPROVAL-WP-0002-production-readiness-and-consumer-adoption.md",
|
|
"id": "APPROVAL-WP-0002",
|
|
"status": "blocked",
|
|
"flavor": "residual",
|
|
"title": "Production readiness and consumer adoption",
|
|
"tasks": [
|
|
{
|
|
"id": "APPROVAL-WP-0002-T01",
|
|
"status": "wait",
|
|
"flavor": "residual",
|
|
"priority": "high",
|
|
"blocked_on": "message-from:key-cape",
|
|
"needs_human": "true",
|
|
"blocking_reason": "Source records verified tenant provenance in schema v6. Existing native requester/human review evidence is delivered; await revision-pinned issuer/profile receipt from key-cape/informed-decision and founder-approved v6 release/migration with native entry/outbox readback.",
|
|
"intervention_note": "Founder per-change approval is required before promoting the schema-v6 image and migrating production; no live change is authorized by this review.",
|
|
"state_hub_task_id": "dc4523f5-e0af-5734-a0ef-07aa7f2b2a27"
|
|
},
|
|
{
|
|
"id": "APPROVAL-WP-0002-T04",
|
|
"status": "wait",
|
|
"flavor": "residual",
|
|
"priority": "high",
|
|
"blocked_on": "message-from:audit-core",
|
|
"blocking_reason": "Sender custody, native synthetic delivery/readback and service deployment are delivered. Await audit-core acceptance of current cadence/class inventory, actual lifecycle drain and reconciliation accounting for occurrence/acceptance-time lag, duplicates and boundaries, class-silence/lag findings and scoped bearer-revocation receipt. Existing AUDIT-WP-0009 implementation is complete and reused.",
|
|
"state_hub_task_id": "777a5cf5-c1db-5e07-8de6-ab109db5ccdc"
|
|
},
|
|
{
|
|
"id": "APPROVAL-WP-0002-T05",
|
|
"status": "wait",
|
|
"flavor": "residual",
|
|
"priority": "high",
|
|
"blocked_on": "message-from:secrets-engine",
|
|
"blocking_reason": "Engine deployment and consumer read/consume credential delivery are delivered. Await secrets-engine named served PEP revision/route/identities and native exact-binding consume-before-side-effect/failure proof; requester/reviewer admission must match that act. Live T-06 additionally requires a complete engagement and plane admission with window/technique.",
|
|
"state_hub_task_id": "3196fb77-3df0-5358-ae12-2d07bac12041"
|
|
}
|
|
]
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"repo": "secrets-engine",
|
|
"head": "0db6adef69c21aa91bf74ecee3b72a8479123309",
|
|
"plans": [
|
|
{
|
|
"path": "workplans/SECRETS-WP-0006-catalog-lane-adoption.md",
|
|
"id": "SECRETS-WP-0006",
|
|
"status": "blocked",
|
|
"flavor": "implementation",
|
|
"title": "Adopt concrete OpenBao credential lanes from ops-warden",
|
|
"tasks": [
|
|
{
|
|
"id": "SECRETS-WP-0006-T05",
|
|
"status": "wait",
|
|
"blocked_on": "message-from:railiance-platform",
|
|
"blocking_reason": "Owner work first: publish a reviewed scoped-apply command per lane. Per-lane approvals are no longer needed (D1 standing rule); each lane with a command enters the attended window.",
|
|
"priority": "high",
|
|
"state_hub_task_id": "fb103f1e-2ff7-5de5-9a2c-191a19c43542"
|
|
},
|
|
{
|
|
"id": "SECRETS-WP-0006-T06",
|
|
"status": "wait",
|
|
"depends_on": "[SECRETS-WP-0006-T05]",
|
|
"blocked_on": "message-from:ops-warden",
|
|
"blocking_reason": "Needs owner-agreed routing/proxy retirement for each verified lane and custody disposition of the legacy npm pointer; a single approved OpenRouter key-check does not authorize broader routing cutover.",
|
|
"priority": "medium",
|
|
"state_hub_task_id": "1431edae-5791-5892-8c4b-829419b537d2"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"path": "workplans/SECRETS-WP-0007-production-lifecycle-hardening.md",
|
|
"id": "SECRETS-WP-0007",
|
|
"status": "blocked",
|
|
"flavor": "implementation",
|
|
"title": "Production-safe provisioning, authorization, and lifecycle hardening",
|
|
"tasks": [
|
|
{
|
|
"id": "SECRETS-WP-0007-T07",
|
|
"status": "wait",
|
|
"depends_on": "[SECRETS-WP-0006-T05, SECRETS-WP-0006-T06]",
|
|
"blocking_reason": "Engine approval hardening is complete. Remaining per-lane cutover includes native routing/proxy retirement with ops-warden under SECRETS-WP-0006-T05/T06; the exact OpenRouter key-check receipt does not establish broader recipient readiness.",
|
|
"priority": "high",
|
|
"state_hub_task_id": "a0a1dd92-d703-5a95-b488-d895f34d5cf7"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"path": "workplans/SECRETS-WP-0008-layer-model-lifecycle-conformance.md",
|
|
"id": "SECRETS-WP-0008",
|
|
"status": "blocked",
|
|
"flavor": "implementation",
|
|
"title": "Evolve the Lifecycle engine to the accepted security layer model",
|
|
"tasks": [
|
|
{
|
|
"id": "SECRETS-WP-0008-T06",
|
|
"status": "wait",
|
|
"depends_on": "[RPF-WP-0035-T02]",
|
|
"blocking_reason": "Published JWT contract and positive login/revocation are delivered. Native KEY-WP-0039-T02 claim negatives, CCR-2026-0038 effective-policy/capability/expiry/use checks and MASON-WP-0009-T05 remain. Login-self-only grants no protected-operation authority: agree and implement separately reviewed task-scoped backend execution entitlement, then prove functional steady-state service-identity adoption without bootstrap/env fallback.",
|
|
"priority": "medium",
|
|
"state_hub_task_id": "d7bc8bdc-a0f8-5058-a640-374ef9859148"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"path": "workplans/SECRETS-WP-0009-glas-claude-native-delivery.md",
|
|
"id": "SECRETS-WP-0009",
|
|
"status": "blocked",
|
|
"flavor": "implementation",
|
|
"title": "Activate native Claude credential delivery for Glas",
|
|
"tasks": [
|
|
{
|
|
"id": "SECRETS-WP-0009-T03",
|
|
"status": "wait",
|
|
"blocked_on": "message-from:glas-harness",
|
|
"blocking_reason": "Next owner action: reconcile held parent reservation 6efa9436-6a91-47c0-94e5-b31b5a0e7e3a (EUR 10, observed USD still null) from existing provider records. No corrected runtime digest is admitted; do not retry or replay consumed approvals.",
|
|
"priority": "high",
|
|
"state_hub_task_id": "f8069c8a-ad6b-5d0b-9a36-c2326699437d"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"path": "workplans/SECRETS-WP-0013-task-scoped-openbao-execution.md",
|
|
"id": "SECRETS-WP-0013",
|
|
"status": "proposed",
|
|
"flavor": "planning",
|
|
"title": "Design and prove task-scoped protected OpenBao execution",
|
|
"tasks": [
|
|
{
|
|
"id": "SECRETS-WP-0013-T01",
|
|
"status": "wait",
|
|
"needs_human": "false",
|
|
"blocked_on": "message-from:railiance-platform",
|
|
"blocking_reason": "Independent Platform mediated-contract review and identity/approval/PDP owner returns remain required; D3 wrapped primitive source is implemented, no native entitlement is inferred.",
|
|
"priority": "high",
|
|
"state_hub_task_id": "b2f0d462-a542-518b-a26b-b7ec07b3c7c1"
|
|
},
|
|
{
|
|
"id": "SECRETS-WP-0013-T03",
|
|
"status": "wait",
|
|
"depends_on": "[SECRETS-WP-0013-T01, RPF-WP-0035-T12]",
|
|
"wait_reason": "Wait for independent execution-contract acceptance and Platform task-scoped entitlement design/materialization, then exact founder native go.",
|
|
"priority": "high",
|
|
"state_hub_task_id": "5f8f7c41-5921-543f-a7c6-0b1350ea6d82"
|
|
}
|
|
]
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"repo": "audit-core",
|
|
"head": "f1e715326b3ffd956623a84fa7ab0ce5ab3fbcf9",
|
|
"plans": [
|
|
{
|
|
"path": "workplans/AUDIT-WP-0013-cross-repo-sender-admission.md",
|
|
"id": "AUDIT-WP-0013",
|
|
"status": "blocked",
|
|
"flavor": "",
|
|
"title": "Complete flex-auth and Qonto sender admission",
|
|
"tasks": [
|
|
{
|
|
"id": "AUDIT-WP-0013-T02",
|
|
"status": "wait",
|
|
"priority": "high",
|
|
"blocking_reason": "flex-auth must return final per-pin cadence/scope/selector payloads; ops-warden routing catalog and railiance-platform attended seed/delivery are not supplied.",
|
|
"blocked_on": "message-from:flex-auth",
|
|
"state_hub_task_id": "fff70081-0d6e-5e16-917a-c7cc3204ad53"
|
|
},
|
|
{
|
|
"id": "AUDIT-WP-0013-T05",
|
|
"status": "wait",
|
|
"priority": "high",
|
|
"blocking_reason": "rapp-qonto must supply the actual collector binding, scope/selectors, mapping/lag rules and receiver receipts; qonto-assistant must approve classification and per-class cadence.",
|
|
"blocked_on": "message-from:rapp-qonto",
|
|
"state_hub_task_id": "76b59808-abc3-5b8d-b31a-e3fb611f2cbe"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"path": "workplans/AUDIT-WP-0014-execution-attribution-receipt.md",
|
|
"id": "AUDIT-WP-0014",
|
|
"status": "blocked",
|
|
"flavor": "",
|
|
"title": "Validate canonical execution-attribution receipts on ingest",
|
|
"tasks": [
|
|
{
|
|
"id": "AUDIT-WP-0014-T02",
|
|
"status": "wait",
|
|
"priority": "high",
|
|
"blocking_reason": "NetKingdom NK-WP-0040-T02 must return the versioned receipt schema, validator and fixtures; Railiance must confirm its emitting source and wire binding.",
|
|
"blocked_on": "message-from:net-kingdom",
|
|
"state_hub_task_id": "33efb421-8dd7-5311-8447-9d6ca00992ba"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"path": "workplans/AUDIT-WP-0015-independent-evidence-returns.md",
|
|
"id": "AUDIT-WP-0015",
|
|
"status": "blocked",
|
|
"flavor": "",
|
|
"title": "Obtain independent chain-head and refreshed tenancy evidence",
|
|
"tasks": [
|
|
{
|
|
"id": "AUDIT-WP-0015-T01",
|
|
"status": "wait",
|
|
"priority": "high",
|
|
"blocking_reason": "resource-control and rapp-postgres must name a current chain-head custody owner/task and return offsite upload/readback receipts with cadence and failure handling.",
|
|
"blocked_on": "message-from:resource-control",
|
|
"state_hub_task_id": "5fa2bfe4-df47-58a1-9240-80e2ad224617"
|
|
},
|
|
{
|
|
"id": "AUDIT-WP-0015-T02",
|
|
"status": "wait",
|
|
"priority": "high",
|
|
"blocking_reason": "access-engine must confirm a tenant-A flex-auth identity without tenant-B authority, or Whitehat must supply a separately approved future engagement; asm-t08 surface owner inputs remain missing.",
|
|
"blocked_on": "message-from:access-engine",
|
|
"state_hub_task_id": "e8a9cd4f-0267-524a-8ddd-5e1cec33e3af"
|
|
}
|
|
]
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"repo": "kings-guard",
|
|
"head": "af02e2547598d6ec0e83f482d9ea3ef943ea67b7",
|
|
"plans": [
|
|
{
|
|
"path": "workplans/KG-WP-0005-qonto-source-cadence-admission.md",
|
|
"id": "KG-WP-0005",
|
|
"status": "active",
|
|
"flavor": "residual",
|
|
"title": "Admit and validate qonto-assistant source completeness evidence",
|
|
"tasks": [
|
|
{
|
|
"id": "KG-WP-0005-T03",
|
|
"status": "wait",
|
|
"blocked_on": "message-from:qonto-assistant",
|
|
"blocking_reason": "Operational evidence from an authorized deployed qonto-assistant process; local source-path proof does not substitute.",
|
|
"priority": "medium",
|
|
"state_hub_task_id": "d2f59a1b-ee01-51b5-b9b6-6e7875d6c988"
|
|
}
|
|
]
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"repo": "maturity-engine",
|
|
"head": "2f1de542cc8f24a79452f906d99f95be39d8b6a9",
|
|
"plans": []
|
|
},
|
|
{
|
|
"repo": "policy-nexus",
|
|
"head": "f784f017b0822f34c785f0b34c7c55fcf39c9d99",
|
|
"plans": [
|
|
{
|
|
"path": "workplans/PNEX-WP-0006-build-mode-change-authorization.md",
|
|
"id": "PNEX-WP-0006",
|
|
"status": "blocked",
|
|
"flavor": "implementation",
|
|
"title": "Publish the build-mode change authorization guardrail",
|
|
"tasks": [
|
|
{
|
|
"id": "PNEX-WP-0006-T01",
|
|
"status": "wait",
|
|
"priority": "high",
|
|
"needs_human": "true",
|
|
"intervention_note": "Public publication is red-lane; add PNEX-WP-0006 to the single daily founder batch. Local code and tests are prepared; no per-item approval request.",
|
|
"state_hub_task_id": "ee3c6f88-91b5-5dac-94e7-d1b05b0276bc"
|
|
},
|
|
{
|
|
"id": "PNEX-WP-0006-T02",
|
|
"status": "wait",
|
|
"priority": "high",
|
|
"needs_human": "true",
|
|
"intervention_note": "Public publication is red-lane; add PNEX-WP-0006 to the single daily founder batch. Local code and tests are prepared; no per-item approval request.",
|
|
"state_hub_task_id": "92247888-82ad-52ca-962f-1a578adeb9f7"
|
|
}
|
|
]
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"repo": "railiance-platform",
|
|
"head": "7c79293831e2f46ad93f2ef689d9129b2ac0e139",
|
|
"plans": [
|
|
{
|
|
"path": "workplans/RPF-WP-0015-audit-core-custody-and-recovery-coordination.md",
|
|
"id": "RPF-WP-0015",
|
|
"status": "active",
|
|
"flavor": "residual",
|
|
"title": "Coordinate audit-core temporary custody and recovery exercises",
|
|
"tasks": [
|
|
{
|
|
"id": "RPF-WP-0015-T02",
|
|
"status": "wait",
|
|
"blocked_on": "message-from:audit-core",
|
|
"blocking_reason": "Value-safe lease revoke/expire exercise must be coordinated with rapp-postgres and audit-core.",
|
|
"priority": "high",
|
|
"state_hub_task_id": "fda4262a-56f6-5f06-a070-8fe7e1297209"
|
|
},
|
|
{
|
|
"id": "RPF-WP-0015-T03",
|
|
"status": "wait",
|
|
"needs_human": "true",
|
|
"decision_id": "2fd5849c-240e-4d0a-bf07-5ebf8dfce3fd",
|
|
"blocked_on": "message-from:railiance-infra",
|
|
"blocking_reason": "Single-node outage exercise needs operator access and a declared restart order coordinated with railiance-infra, railiance-cluster, audit-core and the OpenBao package owner.",
|
|
"priority": "high",
|
|
"state_hub_task_id": "ba729d18-f053-539f-86ef-5cb8ad4cce45"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"path": "workplans/RPF-WP-0027-keycape-live-secret-exposure-recovery.md",
|
|
"id": "RPF-WP-0027",
|
|
"status": "blocked",
|
|
"flavor": "implementation",
|
|
"title": "Coordinate KeyCape live Secret exposure recovery",
|
|
"tasks": [
|
|
{
|
|
"id": "RPF-WP-0027-T03",
|
|
"status": "wait",
|
|
"blocked_on": "message-from:net-kingdom",
|
|
"blocking_reason": "Owner work first: NetKingdom packages the complete resolver sequence as one receipt-producing command; then it enters the attended-window checklist (D1 standing rule).",
|
|
"priority": "high",
|
|
"state_hub_task_id": "714ae011-903d-55e2-ac47-801b8ef879d1"
|
|
},
|
|
{
|
|
"id": "RPF-WP-0027-T06",
|
|
"status": "wait",
|
|
"blocking_reason": "Owner work first: the OpenBao owner confirms mount/path/fields and writer/reader authority and publishes the non-secret routing receipt; the handoff enters the attended window only when a command exists.",
|
|
"priority": "high",
|
|
"blocked_on": "message-from:rapp-openbao",
|
|
"state_hub_task_id": "3b9748c4-2906-5ba7-9d34-0a7067a59283"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"path": "workplans/RPF-WP-0035-credential-lane-implementation.md",
|
|
"id": "RPF-WP-0035",
|
|
"status": "blocked",
|
|
"flavor": "implementation",
|
|
"title": "Implement reviewed credential lanes with separate owner gates",
|
|
"tasks": [
|
|
{
|
|
"id": "RPF-WP-0035-T02",
|
|
"status": "wait",
|
|
"decision_id": "62aa95e4-3ccc-4867-8806-5e3db005b483",
|
|
"depends_on": "[KEY-WP-0039-T02, MASON-WP-0009-T05]",
|
|
"blocking_reason": "Agent work, not a human gate: claim refusals (KEY-WP-0039-T02 probe) and capabilities-self deny, then ops-mason MASON-WP-0009-T05.",
|
|
"priority": "high",
|
|
"state_hub_task_id": "e0c82ea9-05a5-537e-8fbf-67534263572e"
|
|
},
|
|
{
|
|
"id": "RPF-WP-0035-T03",
|
|
"status": "wait",
|
|
"decision_id": "62aa95e4-3ccc-4867-8806-5e3db005b483",
|
|
"blocking_reason": "Founder session done 2026-10-09; waits on ops-mason verification (MASON-WP-0005-T05) and the FT-WP-0002 owner salt CAS probe.",
|
|
"priority": "high",
|
|
"depends_on": "[MASON-WP-0005-T05, FT-WP-0002]",
|
|
"state_hub_task_id": "f47e5bc5-6f3c-54bb-aa35-260ad03892ba"
|
|
},
|
|
{
|
|
"id": "RPF-WP-0035-T07",
|
|
"status": "wait",
|
|
"decision_id": "1591daa1-6e85-4dfd-aadd-5a9fe1ef47fa",
|
|
"blocking_reason": "Hold kept by D3 until SECRETS-WP-0006-T06 moves publishing off the legacy whynot-design npm path; then rotate and prove a fresh publish.",
|
|
"priority": "high",
|
|
"depends_on": "[SECRETS-WP-0006-T06]",
|
|
"state_hub_task_id": "0dd7c9a5-65a0-53fc-b6c3-5ad96ee56f7b"
|
|
},
|
|
{
|
|
"id": "RPF-WP-0035-T08",
|
|
"status": "wait",
|
|
"decision_id": "ab85ae8a-12a0-4945-ae64-1d3d86d5b26f",
|
|
"blocking_reason": "Approved conditionally (ab85ae8a, standing change rule): executes once independent archive readback and the interim bearer revocation receipt exist; owner work with audit-core.",
|
|
"priority": "high",
|
|
"assignee": "railiance-platform",
|
|
"intervention_note": "null",
|
|
"blocked_on": "message-from:audit-core",
|
|
"state_hub_task_id": "0ef52c26-2669-5cd1-8149-b1f6fcdda6cb"
|
|
},
|
|
{
|
|
"id": "RPF-WP-0035-T10",
|
|
"status": "wait",
|
|
"priority": "medium",
|
|
"blocked_on": "message-from:approval-engine",
|
|
"blocking_reason": "Blue lane under the standing change rule (removing access, with reviewed order, rollback and receipts): executes once approval-engine confirms there is no presenter. No founder window needed.",
|
|
"state_hub_task_id": "af2d4dba-f83a-5819-9a8b-671bae799364"
|
|
},
|
|
{
|
|
"id": "RPF-WP-0035-T12",
|
|
"status": "progress",
|
|
"priority": "high",
|
|
"depends_on": "[RPF-WP-0035-T11]",
|
|
"state_hub_task_id": "914bf383-c13f-5247-9af0-91d7e3a4784a"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"path": "workplans/RPF-WP-0036-platform-service-assurance.md",
|
|
"id": "RPF-WP-0036",
|
|
"status": "blocked",
|
|
"flavor": "implementation",
|
|
"title": "Close S3 service assurance and ownership gaps",
|
|
"tasks": [
|
|
{
|
|
"id": "RPF-WP-0036-T03",
|
|
"status": "wait",
|
|
"decision_id": "89f1058f-33bc-47a8-8a49-0b44d426c67e",
|
|
"depends_on": "[ACTIVITY-WP-0042]",
|
|
"needs_human": "false",
|
|
"blocking_reason": "D2 accepts the activity-core scheduling role; ACTIVITY-WP-0042 must supply the implemented bounded scheduler and scoped custody/execution proof before recurring backup/restore work can execute. No new founder go-ahead is required.",
|
|
"priority": "high",
|
|
"state_hub_task_id": "d64446fb-870b-5ae9-9628-f1fb9d06c5a4"
|
|
},
|
|
{
|
|
"id": "RPF-WP-0036-T04",
|
|
"status": "wait",
|
|
"depends_on": "[RTEL-WP-0002]",
|
|
"blocked_on": "message-from:railiance-telemetry",
|
|
"blocking_reason": "Needs a concrete receiving contract from railiance-telemetry (RTEL-WP-0002) before health transport is accepted; unmonitored state retained meanwhile.",
|
|
"priority": "high",
|
|
"state_hub_task_id": "5351e0e4-6263-58f0-afb2-7c78c4cd6f68"
|
|
},
|
|
{
|
|
"id": "RPF-WP-0036-T06",
|
|
"status": "wait",
|
|
"blocked_on": "message-from:railiance-forge",
|
|
"blocking_reason": "Owner-ready handoffs to railiance-forge, rapp-openbao and the ArgoCD bootstrap owner await acceptance; S3 custody contracts stay here until then.",
|
|
"priority": "medium",
|
|
"state_hub_task_id": "3b74f79c-7366-5d00-bf0e-31c0464a8f33"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"path": "workplans/RPF-WP-0038-forgejo-scaleway-primary-coverage.md",
|
|
"id": "RPF-WP-0038",
|
|
"status": "blocked",
|
|
"flavor": "implementation",
|
|
"title": "Close Forgejo primary backup coverage on Scaleway",
|
|
"tasks": [
|
|
{
|
|
"id": "RPF-WP-0038-T04",
|
|
"status": "todo",
|
|
"priority": "high",
|
|
"state_hub_task_id": "a4807df0-ec96-58f1-9cbd-42b1dcde0d6f"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"path": "workplans/RPF-WP-0043-policy-nexus-argocd-onboarding.md",
|
|
"id": "RPF-WP-0043",
|
|
"status": "blocked",
|
|
"flavor": "planning",
|
|
"title": "Onboard rapp-policy-nexus to the ArgoCD production lane",
|
|
"tasks": [
|
|
{
|
|
"id": "RPF-WP-0043-T03",
|
|
"status": "wait",
|
|
"decision_id": "89f1058f-33bc-47a8-8a49-0b44d426c67e",
|
|
"blocking_reason": "Steps 1 and 3 done 2026-10-11 (docs/evidence/2026-10-11-policy-nexus-adoption-readonly-precheck.json, no stop condition). Step 2 render diff needs the railiance-apps values path from RAPP-POLICY-NEXUS-WP-0002-T02; agents can run it read-only via the k3s tunnel.",
|
|
"priority": "high",
|
|
"depends_on": "[RAPP-POLICY-NEXUS-WP-0002-T02]",
|
|
"state_hub_task_id": "2afb1aac-66dd-5e1e-92e1-fc020a59a927"
|
|
},
|
|
{
|
|
"id": "RPF-WP-0043-T04",
|
|
"status": "wait",
|
|
"decision_id": "89f1058f-33bc-47a8-8a49-0b44d426c67e",
|
|
"depends_on": "[RPF-WP-0043-T03, RPF-WP-0044-T07]",
|
|
"blocking_reason": "Merge approved by D2; runs once T03 diff and root automation (RPF-WP-0044-T07) are proven.",
|
|
"priority": "high",
|
|
"state_hub_task_id": "8638fa73-439d-5dcd-85c7-81aa125170e1"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"path": "workplans/RPF-WP-0044-argocd-phase-b-adopt-existing-applications.md",
|
|
"id": "RPF-WP-0044",
|
|
"status": "blocked",
|
|
"flavor": "planning",
|
|
"title": "ArgoCD phase B: adopt the four existing Applications on railiance01",
|
|
"tasks": [
|
|
{
|
|
"id": "RPF-WP-0044-T04",
|
|
"status": "wait",
|
|
"needs_human": "true",
|
|
"intervention_note": "Orange attended Platform OpenBao OIDC/MFA login for the already D2-approved exact repository reader; no second source-scope approval.",
|
|
"decision_id": "89f1058f-33bc-47a8-8a49-0b44d426c67e",
|
|
"priority": "high",
|
|
"state_hub_task_id": "0e619658-0453-51ed-b9a0-bed28b5544fd"
|
|
},
|
|
{
|
|
"id": "RPF-WP-0044-T06",
|
|
"status": "wait",
|
|
"decision_id": "89f1058f-33bc-47a8-8a49-0b44d426c67e",
|
|
"priority": "medium",
|
|
"depends_on": "[RPF-WP-0044-T04, RPF-WP-0044-T05]",
|
|
"needs_human": "false",
|
|
"blocking_reason": "Ordered D2 adoption: issue-core T04 must provide automated Argo health/diff and private/authenticated smoke proof; target-revenue T05 is already proven. No further founder approval is required.",
|
|
"state_hub_task_id": "4ca54868-c31f-5e3d-b7d3-a15b84c15f80"
|
|
},
|
|
{
|
|
"id": "RPF-WP-0044-T07",
|
|
"status": "wait",
|
|
"decision_id": "89f1058f-33bc-47a8-8a49-0b44d426c67e",
|
|
"depends_on": "[RPF-WP-0044-T03, RPF-WP-0044-T04, RPF-WP-0044-T05, RPF-WP-0044-T06]",
|
|
"blocking_reason": "Restore prune/selfHeal once T03-T06 have automated proof; no further founder go-ahead (D2).",
|
|
"priority": "medium",
|
|
"state_hub_task_id": "844ff115-def2-55ca-ab01-413ba7e6857d"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"path": "workplans/RPF-WP-0048-activity-core-gitops-adoption.md",
|
|
"id": "RPF-WP-0048",
|
|
"status": "blocked",
|
|
"flavor": "",
|
|
"title": "Adopt activity-core application runtime into railiance01 GitOps",
|
|
"tasks": [
|
|
{
|
|
"id": "RPF-WP-0048-T02",
|
|
"status": "wait",
|
|
"decision_id": "89f1058f-33bc-47a8-8a49-0b44d426c67e",
|
|
"depends_on": "[ACTIVITY-WP-0041-T03]",
|
|
"priority": "high",
|
|
"state_hub_task_id": "63b44949-39f8-52fd-ab63-e618b67ef992"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"path": "workplans/RPF-WP-0053-coulomb-paired-backup-admission.md",
|
|
"id": "RPF-WP-0053",
|
|
"status": "proposed",
|
|
"flavor": "",
|
|
"title": "Admit Coulomb paired archives and independent email-ledger recovery",
|
|
"tasks": [
|
|
{
|
|
"id": "RPF-WP-0053-T01",
|
|
"status": "progress",
|
|
"priority": "high",
|
|
"state_hub_task_id": "ceb58abf-77ef-5d75-a65b-fc67bfd9aa54"
|
|
},
|
|
{
|
|
"id": "RPF-WP-0053-T02",
|
|
"status": "todo",
|
|
"priority": "high",
|
|
"intervention_note": "Platform must admit the exact Scaleway primary archive caller/prefix, reconcile its current custody front door and retention/capacity, and deliver bounded credentials before activation.",
|
|
"state_hub_task_id": "b06f1a44-1a55-588c-9c6c-3c1e290544df"
|
|
},
|
|
{
|
|
"id": "RPF-WP-0053-T03",
|
|
"status": "todo",
|
|
"priority": "high",
|
|
"intervention_note": "Needs T01/T02 owner admission and founder go for the exact first quiescence/upload and schedule; independent offsite retrieval and recovery proof remain required.",
|
|
"state_hub_task_id": "871c14da-2940-5be6-8ce8-953973422064"
|
|
},
|
|
{
|
|
"id": "RPF-WP-0053-T04",
|
|
"status": "todo",
|
|
"priority": "high",
|
|
"state_hub_task_id": "687fd36d-98a9-5c10-833e-b6bda51fa07b"
|
|
},
|
|
{
|
|
"id": "RPF-WP-0053-T05",
|
|
"status": "progress",
|
|
"priority": "high",
|
|
"needs_human": "true",
|
|
"intervention_note": "email-connect primary.env is delivered from the accepted reader. Retention, capacity, independent receipts, escrow and the first capture remain open. Coulomb node delivery was not requested.",
|
|
"state_hub_task_id": "3f744ce6-28e4-5496-8d21-7231271a7bc8"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"path": "workplans/RPF-WP-0055-keycape-client-secret-rotation-residual.md",
|
|
"id": "RPF-WP-0055",
|
|
"status": "backlog",
|
|
"flavor": "residual",
|
|
"title": "KeyCape client-secret rotation after first-generation lane acceptance",
|
|
"tasks": [
|
|
{
|
|
"id": "RPF-WP-0055-T01",
|
|
"status": "todo",
|
|
"priority": "low",
|
|
"state_hub_task_id": "4b9c94fb-1251-5f12-b227-1d9d999cd8ed"
|
|
}
|
|
]
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"repo": "glas-harness",
|
|
"head": "5ce4f38aedfd27cc783131f18480df02e2951514",
|
|
"plans": [
|
|
{
|
|
"path": "workplans/GLAS-WP-0012-first-local-profile-production-proof.md",
|
|
"id": "GLAS-WP-0012",
|
|
"status": "blocked",
|
|
"flavor": "implementation",
|
|
"title": "Prove the first local rein profile end to end",
|
|
"tasks": [
|
|
{
|
|
"id": "GLAS-WP-0012-T02",
|
|
"status": "wait",
|
|
"depends_on": "[SAND-WP-0014-T05]",
|
|
"blocking_reason": "Dependency: sand-boxer SAND-WP-0014-T05 with rein-aharness and its credential owner.",
|
|
"priority": "high",
|
|
"state_hub_task_id": "4209f564-a9ee-57f9-9522-3708988801ef"
|
|
},
|
|
{
|
|
"id": "GLAS-WP-0012-T03",
|
|
"status": "wait",
|
|
"depends_on": "[GLAS-WP-0012-T02, SECRETS-WP-0009-T03]",
|
|
"priority": "high",
|
|
"blocking_reason": "Await the rebuilt runtime artifact carrying profile 1.1.1 started through its owner on railiance01 (SECRETS-WP-0009-T03 step B2).",
|
|
"state_hub_task_id": "c660808a-1724-555c-bc59-7318870d3591"
|
|
},
|
|
{
|
|
"id": "GLAS-WP-0012-T04",
|
|
"status": "wait",
|
|
"depends_on": "[GLAS-WP-0012-T03]",
|
|
"blocking_reason": "Depends on T03.",
|
|
"priority": "high",
|
|
"state_hub_task_id": "3e791432-8f37-54bd-a44a-55eeff11ac19"
|
|
},
|
|
{
|
|
"id": "GLAS-WP-0012-T05",
|
|
"status": "wait",
|
|
"depends_on": "[GLAS-WP-0012-T04]",
|
|
"blocking_reason": "Depends on T04.",
|
|
"priority": "high",
|
|
"state_hub_task_id": "f7635cf6-e044-52d4-8242-0512e0ccbd7b"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"path": "workplans/GLAS-WP-0015-production-dependency-coordination.md",
|
|
"id": "GLAS-WP-0015",
|
|
"status": "blocked",
|
|
"flavor": "implementation",
|
|
"title": "Drive owner returns for the first production Glas profile",
|
|
"tasks": [
|
|
{
|
|
"id": "GLAS-WP-0015-T03",
|
|
"status": "wait",
|
|
"needs_human": "true",
|
|
"decision_id": "62aa95e4-3ccc-4867-8806-5e3db005b483",
|
|
"blocked_on": "message-from:secrets-engine",
|
|
"priority": "high",
|
|
"blocking_reason": "Await owner returns: secrets-engine config, holder admission, lane approvals and scoped delivery; operator input on placement and spend bounds.",
|
|
"state_hub_task_id": "68fcc1b4-537b-5f5e-afb5-063c44e5e4db"
|
|
}
|
|
]
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"repo": "repo-manager",
|
|
"head": "78d91efc76ddaf778365e445dc8fb5b6c924a274",
|
|
"plans": [
|
|
{
|
|
"path": "workplans/RMGR-WP-0020-bounded-freshness-runner.md",
|
|
"id": "RMGR-WP-0020",
|
|
"status": "blocked",
|
|
"flavor": "implementation",
|
|
"title": "Bounded Forge-sourced freshness runner via Activity Core",
|
|
"tasks": [
|
|
{
|
|
"id": "RMGR-WP-0020-T04",
|
|
"status": "wait",
|
|
"blocking_reason": "Runner deployed in the Activity Core worker (Argo a86a143); apply trials need the read-only Forgejo token (draft CCR-2026-0034)",
|
|
"priority": "high",
|
|
"state_hub_task_id": "8941af6b-f2c1-5ad1-bb13-a757b3f71c12"
|
|
},
|
|
{
|
|
"id": "RMGR-WP-0020-T05",
|
|
"status": "wait",
|
|
"blocking_reason": "Proof follows the T04 trials and the memo 4 schedule",
|
|
"priority": "medium",
|
|
"state_hub_task_id": "f01fb241-8f35-52ba-9119-86c9cc359528"
|
|
}
|
|
]
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"repo": "railiance-forge",
|
|
"head": "e395e5e9c196fe7cea9cd2be513554e493e675ee",
|
|
"plans": []
|
|
}
|
|
]
|