From db05c1310dcd3fe36a2e04cdbe43170c9681f75c Mon Sep 17 00:00:00 2001 From: tegwick Date: Mon, 19 Oct 2026 13:30:58 +0200 Subject: [PATCH] build: adopt staged records and retain reviewed setup delivery handoff Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a15374-f59f-7a31-86d2-d23b5d2ed181 --- .custodian-brief.md | 8 +-- .generated-work-records.json | 1 + .generated-work-records.mk | 8 +++ Makefile | 7 +++ SCOPE.md | 17 ++++++ WORK-RECORDS.md | 7 ++- .../coordination-case.json | 26 ++++++++ .../local-settings-preservation.json | 8 +++ .../source-boundary.json | 60 +++++++++++++++++++ .../source-review-2026-10-19.json | 46 ++++++++++++++ ...SER-WP-0035-onboarding-handoff-findings.md | 25 +++++++- 11 files changed, 203 insertions(+), 10 deletions(-) create mode 100644 .generated-work-records.json create mode 100644 .generated-work-records.mk create mode 100644 docs/evidence/2026-10-11-setup-link-owner-handoff/coordination-case.json create mode 100644 docs/evidence/2026-10-11-setup-link-owner-handoff/local-settings-preservation.json create mode 100644 docs/evidence/2026-10-11-setup-link-owner-handoff/source-boundary.json create mode 100644 docs/evidence/2026-10-11-setup-link-owner-handoff/source-review-2026-10-19.json diff --git a/.custodian-brief.md b/.custodian-brief.md index dfae8a3..be42e7a 100644 --- a/.custodian-brief.md +++ b/.custodian-brief.md @@ -2,7 +2,7 @@ # Custodian Brief — user-engine **Domain:** communication -**Last synced:** 2026-10-14 21:42 UTC +**Last synced:** 2026-10-15 03:24 UTC **State Hub:** http://127.0.0.1:8000 *(adjust if running on a remote machine)* ## Active Workstreams @@ -13,12 +13,6 @@ Progress: 0/1 done | workplan_id: `5ce5f3eb-e1dd-59bc-9cce-b0172431b9f0` **Open tasks:** - · Remove or replace unfixed-HIGH OS packages in the runtime image `59584b44` -### Sign-in diagnosis: account-site and Authelia uid on the account page -Progress: 1/2 done | workplan_id: `04ba7f02-4138-54a3-b8c3-c1dd9c34262a` - -**Open tasks:** -- · Deploy and record evidence for NK-WP-0051 `9ffe39bd` - ### User account journeys and recovery Progress: 1/3 done | workplan_id: `145df9d5-a7e9-5d20-8280-9d3ea069838b` diff --git a/.generated-work-records.json b/.generated-work-records.json new file mode 100644 index 0000000..b443ed6 --- /dev/null +++ b/.generated-work-records.json @@ -0,0 +1 @@ +{"version":1,"repo_slug":"user-engine"} diff --git a/.generated-work-records.mk b/.generated-work-records.mk new file mode 100644 index 0000000..002854a --- /dev/null +++ b/.generated-work-records.mk @@ -0,0 +1,8 @@ +# Explicit opt-in recipe; no environment files or external make includes. +CUSTODIAN_SOURCE ?= /home/worsch/the-custodian +GENERATED_REPO_SLUG ?= user-engine +.PHONY: generated-work-records generated-work-records-check +generated-work-records: + python3 "$(CUSTODIAN_SOURCE)/scripts/generate_staged_work_records.py" --repo . --repo-slug "$(GENERATED_REPO_SLUG)" +generated-work-records-check: + python3 "$(CUSTODIAN_SOURCE)/scripts/generate_staged_work_records.py" --repo . --repo-slug "$(GENERATED_REPO_SLUG)" --check diff --git a/Makefile b/Makefile index 6d22e4e..6c8e66e 100644 --- a/Makefile +++ b/Makefile @@ -26,3 +26,10 @@ test-journeys: .PHONY: test-browser-journeys test-browser-journeys: PYTHONDONTWRITEBYTECODE=1 $(PYTHON) scripts/browser_journeys.py + +# CUST-WP-0079-T05: staged-source generation; hook uses the isolated recipe. +.PHONY: generated-work-records generated-work-records-check +generated-work-records: + $(MAKE) --no-print-directory -f .generated-work-records.mk generated-work-records +generated-work-records-check: + $(MAKE) --no-print-directory -f .generated-work-records.mk generated-work-records-check diff --git a/SCOPE.md b/SCOPE.md index 0cc2663..3d57c23 100644 --- a/SCOPE.md +++ b/SCOPE.md @@ -196,3 +196,20 @@ Still aspirational, and deliberately not started here: Those remain INTENT, not a hole in SCOPE. Layer-conformance rows above are met by `USER-WP-0024`; the §13.1 inventory row is gate-house's. + + +## Repository maintenance reuse + +The tracked `.generated-work-records.json` adopts the Custodian staged-source +adapter for WORK-RECORDS.md. `make generated-work-records` uses the existing +State Hub renderer through `.generated-work-records.mk`; the shared pre-commit +hook runs this isolated recipe only for opted-in repositories. The corresponding +`make generated-work-records-check` is read-only. Canonical repository identity +is explicit and does not depend on the checkout directory. + +Unstaged source changes are preserved; conflicts and unstaged generated-file +changes stop the commit. For `git commit --only`, generate first and include +WORK-RECORDS.md with the selected source paths. Existing generated-only guards +and exact-scope secret scans remain in place. This is repository maintenance, +not a runtime service, authorization decision, deployment or publication. +Other index generators and hub-derived briefs retain their owner boundaries. diff --git a/WORK-RECORDS.md b/WORK-RECORDS.md index 6addaac..db4f905 100644 --- a/WORK-RECORDS.md +++ b/WORK-RECORDS.md @@ -49,6 +49,7 @@ | workplan | USER-WP-0036 | finished | — | workplans/USER-WP-0036-account-situational-awareness.md | | workplan | USER-WP-0037 | blocked | — | workplans/USER-WP-0037-hub-authority-lookup.md | | workplan | USER-WP-0038 | ready | — | workplans/USER-WP-0038-runtime-image-os-package-hardening.md | +| workplan | USER-WP-0039 | finished | — | workplans/USER-WP-0039-sign-in-diagnosis-session-uids.md | | task | USER-WP-ADHOC-2026-09-06-T01 | done | — | workplans/ADHOC-2026-09-06.md | | task | USER-WP-ADHOC-2026-10-09-T01 | done | — | workplans/ADHOC-2026-10-09.md | | task | USER-WP-ADHOC-2026-10-09-T02 | done | — | workplans/ADHOC-2026-10-09.md | @@ -233,13 +234,15 @@ | task | USER-WP-0034-T01 | done | — | workplans/USER-WP-0034-access-engine-repository-rename-handoff.md | | task | USER-WP-0034-T02 | done | — | workplans/USER-WP-0034-access-engine-repository-rename-handoff.md | | task | USER-WP-0035-T01 | done | — | workplans/USER-WP-0035-onboarding-handoff-findings.md | -| task | USER-WP-0035-T02 | todo | — | workplans/USER-WP-0035-onboarding-handoff-findings.md | +| task | USER-WP-0035-T02 | wait | — | workplans/USER-WP-0035-onboarding-handoff-findings.md | | task | USER-WP-0036-T01 | done | — | workplans/USER-WP-0036-account-situational-awareness.md | | task | USER-WP-0036-T02 | done | — | workplans/USER-WP-0036-account-situational-awareness.md | | task | USER-WP-0036-T03 | done | — | workplans/USER-WP-0036-account-situational-awareness.md | | task | USER-WP-0037-T01 | done | — | workplans/USER-WP-0037-hub-authority-lookup.md | | task | USER-WP-0037-T02 | done | — | workplans/USER-WP-0037-hub-authority-lookup.md | -| task | USER-WP-0038-T01 | todo | — | workplans/USER-WP-0038-runtime-image-os-package-hardening.md | | task | USER-WP-0037-T03 | wait | — | workplans/USER-WP-0037-hub-authority-lookup.md | +| task | USER-WP-0038-T01 | todo | — | workplans/USER-WP-0038-runtime-image-os-package-hardening.md | +| task | USER-WP-0039-T01 | done | — | workplans/USER-WP-0039-sign-in-diagnosis-session-uids.md | +| task | USER-WP-0039-T02 | done | — | workplans/USER-WP-0039-sign-in-diagnosis-session-uids.md | | intake | USER-IN-0001 | answered | — | intakes/intakes.md | | intake | USER-IN-0002 | open | — | intakes/intakes.md | diff --git a/docs/evidence/2026-10-11-setup-link-owner-handoff/coordination-case.json b/docs/evidence/2026-10-11-setup-link-owner-handoff/coordination-case.json new file mode 100644 index 0000000..51c0c06 --- /dev/null +++ b/docs/evidence/2026-10-11-setup-link-owner-handoff/coordination-case.json @@ -0,0 +1,26 @@ +{ + "scenario_type": "cross_owner_wait", + "case_id": "USER-WP-0035-T02-setup-link-owner-handoff", + "beneficiary_workplan_id": "USER-WP-0035", + "beneficiary_task_id": "USER-WP-0035-T02", + "beneficiary_repo": "user-engine", + "obligor_repos": [ + "email-connect", + "net-kingdom" + ], + "obligor_intake_ids": [ + "EMAIL-IN-0001", + "NET-IN-0005" + ], + "obligor_workplan_id": null, + "state": "waiting", + "reason": "Owners return supported handoff and exact implementation work records; absent foreign task ID qualifies owner-response wait, not a fabricated dependency.", + "owner_response_qualifier": "message-from:email-connect", + "driver_workplan_id": null, + "projection_status": "local_preparation_not_published", + "needs_human": false, + "schema_version": "cross-owner-wait-receipt/v0.1", + "case_binding_status": "pending-owner-work-record", + "native_case_registered": false, + "automatic_wakeup": false +} diff --git a/docs/evidence/2026-10-11-setup-link-owner-handoff/local-settings-preservation.json b/docs/evidence/2026-10-11-setup-link-owner-handoff/local-settings-preservation.json new file mode 100644 index 0000000..d0719a6 --- /dev/null +++ b/docs/evidence/2026-10-11-setup-link-owner-handoff/local-settings-preservation.json @@ -0,0 +1,8 @@ +{ + "original_path": ".claude/settings.local.json.", + "preserved_path": "/home/worsch/.local/state/custodian-preserved/user-engine/settings.local.json.inactive-2026-10-19", + "sha256": "b70496e3978a7e45304ad6e2042f81953bc8d6ac518aa82fcab36c4e5c754243", + "disposition": "inactive local permission artifact preserved outside checkout; not renamed into active settings", + "permissions_activated": false, + "date": "2026-10-19" +} diff --git a/docs/evidence/2026-10-11-setup-link-owner-handoff/source-boundary.json b/docs/evidence/2026-10-11-setup-link-owner-handoff/source-boundary.json new file mode 100644 index 0000000..e2274b1 --- /dev/null +++ b/docs/evidence/2026-10-11-setup-link-owner-handoff/source-boundary.json @@ -0,0 +1,60 @@ +{ + "schema": "user-setup-delivery-source-boundary/v1", + "task": "USER-WP-0035-T02", + "source_artifacts": { + "caller_policy": { + "path": "/home/worsch/email-connect/src/email_connect/callers.py", + "sha256": "06fe961b9030dba2c0b26b92f8097e8fbd24e205d5fa79642aa9af60382886dc" + }, + "mail_receiver": { + "path": "/home/worsch/email-connect/src/email_connect/transactional.py", + "sha256": "36fdfd8cb58f10148cd491a7e34d7aea798e4289fce760af70a48776bede204d" + }, + "setup_issuer": { + "path": "/home/worsch/net-kingdom/identity-provisioner/password_setup.py", + "sha256": "53012fc708384fc9cd0fff4f3fa5f204ab85866db91d726457dd130799e88ca0" + }, + "provider_handler": { + "path": "/home/worsch/net-kingdom/identity-provisioner/server.py", + "sha256": "3f75c79b3adb876ce1a57b7796d9b03efe77292722d3981ce8850ce15e23e773" + }, + "user_adapter": { + "path": "/home/worsch/user-engine/src/user_engine/adapters/provisioning.py", + "sha256": "a033a891d8e0e2595d177877ac8615814190fe2c97b67059c7e3b63a87e25b51" + }, + "user_portal": { + "path": "/home/worsch/user-engine/src/user_engine/web.py", + "sha256": "c5fbd412102238219f3b231557815fb30c0a7f822c28a371bcffc63076456a14" + } + }, + "source_checks": { + "scoped_templates": [ + "family_invitation.resent", + "family_member.invited" + ], + "receiver_events": [ + "family_invitation.resent", + "family_member.invited" + ], + "setup_template_supported": false, + "existing_mail_lane_missing": false, + "provider_returns_single_use_setup_url": true, + "provider_default_ttl_seconds": 900, + "provider_reissue_revokes_prior_grant": true, + "provider_restart_invalidates_grants": true, + "provider_to_mail_supported_handoff_present": false, + "authelia_reset_mail_is_different_issuer": true + }, + "disposition": "owner_preparation_required", + "owner_intakes": [ + "EMAIL-IN-0001", + "NET-IN-0005" + ], + "only_eligible_task_inspected": "USER-WP-0035-T02", + "runtime_claims": false, + "live_calls": false, + "mail_sent": false, + "credentials_or_grants_read": false, + "raw_setup_url_output": false, + "new_founder_choice_required": false +} diff --git a/docs/evidence/2026-10-11-setup-link-owner-handoff/source-review-2026-10-19.json b/docs/evidence/2026-10-11-setup-link-owner-handoff/source-review-2026-10-19.json new file mode 100644 index 0000000..548597a --- /dev/null +++ b/docs/evidence/2026-10-11-setup-link-owner-handoff/source-review-2026-10-19.json @@ -0,0 +1,46 @@ +{ + "observed_at": "2026-10-19", + "historical_receipt": "source-boundary.json", + "source_checks_revalidated": true, + "new_source_artifacts": { + "caller_policy": { + "path": "/home/worsch/email-connect/src/email_connect/callers.py", + "sha256": "06fe961b9030dba2c0b26b92f8097e8fbd24e205d5fa79642aa9af60382886dc", + "unchanged_since_historical_receipt": true + }, + "mail_receiver": { + "path": "/home/worsch/email-connect/src/email_connect/transactional.py", + "sha256": "36fdfd8cb58f10148cd491a7e34d7aea798e4289fce760af70a48776bede204d", + "unchanged_since_historical_receipt": true + }, + "setup_issuer": { + "path": "/home/worsch/net-kingdom/identity-provisioner/password_setup.py", + "sha256": "53012fc708384fc9cd0fff4f3fa5f204ab85866db91d726457dd130799e88ca0", + "unchanged_since_historical_receipt": true + }, + "provider_handler": { + "path": "/home/worsch/net-kingdom/identity-provisioner/server.py", + "sha256": "b61c83da6c7ce20fa2790d5bb00aeca6a91dccd133526bc559ed26562f90eb29", + "unchanged_since_historical_receipt": false + }, + "user_adapter": { + "path": "/home/worsch/user-engine/src/user_engine/adapters/provisioning.py", + "sha256": "a033a891d8e0e2595d177877ac8615814190fe2c97b67059c7e3b63a87e25b51", + "unchanged_since_historical_receipt": true + }, + "user_portal": { + "path": "/home/worsch/user-engine/src/user_engine/web.py", + "sha256": "24c509c7f69255ff0656fbbc84aa9f71357df2fc1db337880422d644bceae394", + "unchanged_since_historical_receipt": false + } + }, + "finding": "Current caller/receiver still permit only invitation/resend; provider emits ephemeral setup URL and portal displays provider-owned handoff. Supported issuer-to-mail contract remains absent.", + "live_calls": false, + "mail_sent": false, + "credentials_or_grants_read": false, + "owner_intakes": [ + "EMAIL-IN-0001", + "NET-IN-0005" + ], + "acceptance": "source-boundary handoff only; no native delivery acceptance" +} diff --git a/workplans/USER-WP-0035-onboarding-handoff-findings.md b/workplans/USER-WP-0035-onboarding-handoff-findings.md index 0cd8532..ceb925e 100644 --- a/workplans/USER-WP-0035-onboarding-handoff-findings.md +++ b/workplans/USER-WP-0035-onboarding-handoff-findings.md @@ -49,8 +49,11 @@ No claim about password or factor state is added, and no delivery is claimed. ```task id: USER-WP-0035-T02 -status: todo +status: wait priority: high +needs_human: false +blocked_on: message-from:email-connect +blocking_reason: "Existing mail service lacks an admitted provider password-setup template and recipient-bound opaque issuer handoff. EMAIL-IN-0001 and NET-IN-0005 request exact owner implementation records; no new founder choice or credential request." state_hub_task_id: "fae614ba-ffc0-511d-9d22-2d91fbab057f" ``` @@ -73,3 +76,23 @@ The latest attended onboarding record still uses out-of-band handoff. No message was sent and no setup-link secret was copied into an event or work record. 2026-10-03: human gate routed to hub decision 62aa95e4-3ccc-4867-8806-5e3db005b483 (D1: Attended OpenBao provisioning window: one session clears the pending credential lanes) by CUST-WP-0075; resolving that decision raises C-40 here. +2026-10-11 source-boundary review: the scoped receiver and transactional sender +accept only family-member invitation/resend events, while NetKingdom's +identity-provisioner returns its own ephemeral password-setup URL. Neither the +completed EMAIL-WP-0008 caller admission nor NK-WP-0047 Authelia reset-mail +acceptance supplies this separate setup delivery capability. Owner intakes +EMAIL-IN-0001 and NET-IN-0005 request the fixed recipient-bound handoff and exact +implementation task IDs; replace the owner-response qualifier with those IDs +once supplied. The cross-owner case is retained at +`docs/evidence/2026-10-11-setup-link-owner-handoff/coordination-case.json`. +No mail was sent, no credential/grant was read and no secret link entered an +outbox/event/work record. U04/T02 external-blocked acceptance remains unchanged. + + +2026-10-19 reconciliation: reviewed the pending source handoff against current +caller policy, receiver, provider handler and User Engine portal. Invitation-only +mail admission and the provider-owned setup URL boundary remain unchanged. The +historical October 11 receipt is retained; `source-review-2026-10-19.json` records +current hashes and distinguishes changed handler/portal source from old evidence. +EMAIL-IN-0001 and NET-IN-0005 remain preparation requests, not owner acceptance +or a runtime delivery claim. T02 remains waiting on the named owner return.