From 504f444aa7ec3a573a695cfa94810b509fcc776e Mon Sep 17 00:00:00 2001 From: crake-b242 Date: Sat, 22 Aug 2026 11:33:48 +0200 Subject: [PATCH 1/3] docs: prepare claim-fence arming packet --- .../reusable-workflow-contract.md | 49 + .../agent-commands/claude/commands.md | 54 ++ .../agent-commands/claude/guidance.json | 199 ++++ .../agent-commands/claude/skills.md | 30 + .../agent-commands/codex/commands.md | 54 ++ .../agent-commands/codex/guidance.json | 199 ++++ .../agent-commands/codex/skills.md | 30 + .../analysis.json | 462 ++++++++++ .../governance-handoff.json | 271 ++++++ .../ship-verdict.json | 23 + .../2723-fence-arming-premise-rot/ship.json | 322 +++++++ .../2723-fence-arming-premise-rot/summary.md | 32 + .../2723-fence-arming-premise-rot/verify.json | 685 ++++++++++++++ .../work-model.json | 869 ++++++++++++++++++ scripts/repos.sh | 19 +- work/2723-fence-arming-premise-rot/charter.md | 44 + .../checklist.md | 49 + .../clarifications.md | 45 + .../evidence.yml | 308 +++++++ work/2723-fence-arming-premise-rot/plan.md | 79 ++ work/2723-fence-arming-premise-rot/spec.md | 42 + work/2723-fence-arming-premise-rot/tasks.yml | 136 +++ 22 files changed, 3991 insertions(+), 10 deletions(-) create mode 100644 readiness/2723-fence-arming-premise-rot/agent-commands/claude/commands.md create mode 100644 readiness/2723-fence-arming-premise-rot/agent-commands/claude/guidance.json create mode 100644 readiness/2723-fence-arming-premise-rot/agent-commands/claude/skills.md create mode 100644 readiness/2723-fence-arming-premise-rot/agent-commands/codex/commands.md create mode 100644 readiness/2723-fence-arming-premise-rot/agent-commands/codex/guidance.json create mode 100644 readiness/2723-fence-arming-premise-rot/agent-commands/codex/skills.md create mode 100644 readiness/2723-fence-arming-premise-rot/analysis.json create mode 100644 readiness/2723-fence-arming-premise-rot/governance-handoff.json create mode 100644 readiness/2723-fence-arming-premise-rot/ship-verdict.json create mode 100644 readiness/2723-fence-arming-premise-rot/ship.json create mode 100644 readiness/2723-fence-arming-premise-rot/summary.md create mode 100644 readiness/2723-fence-arming-premise-rot/verify.json create mode 100644 readiness/2723-fence-arming-premise-rot/work-model.json create mode 100644 work/2723-fence-arming-premise-rot/charter.md create mode 100644 work/2723-fence-arming-premise-rot/checklist.md create mode 100644 work/2723-fence-arming-premise-rot/clarifications.md create mode 100644 work/2723-fence-arming-premise-rot/evidence.yml create mode 100644 work/2723-fence-arming-premise-rot/plan.md create mode 100644 work/2723-fence-arming-premise-rot/spec.md create mode 100644 work/2723-fence-arming-premise-rot/tasks.yml diff --git a/docs/coordination/reusable-workflow-contract.md b/docs/coordination/reusable-workflow-contract.md index 1f0ae42dd..3db97a0cc 100644 --- a/docs/coordination/reusable-workflow-contract.md +++ b/docs/coordination/reusable-workflow-contract.md @@ -406,6 +406,55 @@ FS.GG.Net's real caller and **this repository's own** `kit-materialize.yml`, and either job is caught by name. That is stronger than a dry run — it needs no credential, and it fails on the pull request that would break it rather than on the nightly sweep afterwards. +### Arming record: `claim-fence` on `.github/main` + +This is the durable slice-8 packet for the GitHub-native executor fence ([#2723](https://github.com/FS-GG/.github/issues/2723)). +It records the decision and the evidence; it does not pretend a blocked administrative write happened. + +1. **Producer landed and observed for more than one claim-lease window.** The exact context is + `claim-fence`, produced directly by `.github/workflows/fsgg-claim-fence.yml` on this repository (it + is not a nested reusable-workflow context). The earliest complete workflow census entry is run + [31969788185](https://github.com/FS-GG/.github/actions/runs/31969788185), which reported a successful + `claim-fence` check on immutable head `0a0d6b052490b26fc6cbab8cf2619bfaae9ab809` at + `2026-08-16T20:11:03Z`. A six-page, 597-run census at `2026-08-22T09:18:30Z` put the observe-only + interval beyond five days, comfortably above the 120-minute default lease. +2. **Static producibility passes.** Against this checkout and an offline classic-protection payload + requiring only `claim-fence`, `scripts/check-required-contexts.py` reported `ok claim-fence` and + one audited context among 20 contexts reported on every pull request. The workflow has no `paths:` + filter and decides applicability inside the job, so unrelated pull requests receive a real check. +3. **The verdict has a bounded moving input.** The pull-request head and declared claim generation are + immutable inputs; the live claim may move, and a mismatch is the intended red result. The accepted + residual is the design's stale-green window when no merge queue re-evaluates that result at merge + time. +4. **Merge-queue decision: do not enable it in this slice.** The live `rules/branches/main` response + was `[]` on 2026-08-22. Enabling a queue changes how every pull request merges and remains a separate + repository decision. Arming without it still refuses ungrounded executors, while accepting the + stale-green residual above; this is deliberate, not an assertion that AC1's strongest form is met. +5. **Apply is a post-merge obligation and is presently blocked.** A complete open-pull-request census + on 2026-08-22 found three `item/-*` pull requests: [#2821](https://github.com/FS-GG/.github/pull/2821) + and [#2818](https://github.com/FS-GG/.github/pull/2818) had no authorization marker, while + [#2809](https://github.com/FS-GG/.github/pull/2809)'s marker named head `2fb051d9…` rather than its + current `ff04546b…`. Therefore the zero-unmarked-in-flight precondition is false and **nothing is + armed by this change**. After this document lands, the claim holder must repeat the complete census; + only when it is empty (or every item PR carries a current marker) may it run the hub-only dry run and + apply: + + ```sh + scripts/repos.sh require-context --context claim-fence --receives labels --only FS-GG/.github + scripts/repos.sh require-context --context claim-fence --receives labels --only FS-GG/.github --apply + ``` + + The recorded dry run on 2026-08-22 selected exactly `FS-GG/.github`, read the seven-context before + set, and reported `1 would-add, 0 unchanged, 0 failed`. The apply is complete only when its built-in + read-back reports `claim-fence` in the exact after-set. The separately measured dispatch App + installation grant includes `administration: write`; a workflow `GITHUB_TOKEN` still cannot hold + that permission. + +Rollback preserves a reporting context before it weakens protection: first set the producer back to +observe-only/non-binding behavior, then run `unrequire-context` with the exact confirmation, and finally +read both classic protection and rulesets. Never delete or silence the producer before removing a +required context: a missing required check is a permanent wait, not a red verdict. + ## The on-demand materialize, and why one still never writes `main` > **DECISION ([#1845](https://github.com/FS-GG/.github/issues/1845), 2026-07-28). A materialize can be diff --git a/readiness/2723-fence-arming-premise-rot/agent-commands/claude/commands.md b/readiness/2723-fence-arming-premise-rot/agent-commands/claude/commands.md new file mode 100644 index 000000000..a31ed1e8d --- /dev/null +++ b/readiness/2723-fence-arming-premise-rot/agent-commands/claude/commands.md @@ -0,0 +1,54 @@ +# Agent commands for claude (generated) + +Generated from `readiness/2723-fence-arming-premise-rot/work-model.json`. This is a generated projection of the +normalized work model, not an authored source of truth. See `guidance.json`. + +## T001 — Implement requirement FR-001 +- Stage: specify +- Purpose: Carry out lifecycle task T001 (done) covering AC-001, FR-001, PD-001. +- Related: AC-001, FR-001, PD-001 + +## T002 — Implement requirement FR-002 +- Stage: specify +- Purpose: Carry out lifecycle task T002 (done) covering AC-001, FR-002, PD-002. +- Related: AC-001, FR-002, PD-002 + +## T003 — Implement requirement FR-003 +- Stage: specify +- Purpose: Carry out lifecycle task T003 (done) covering AC-001, FR-003, PD-003. +- Related: AC-001, FR-003, PD-003 + +## T004 — Implement clarification decision DEC-001 +- Stage: specify +- Purpose: Carry out lifecycle task T004 (done) covering DEC-001. +- Related: DEC-001 + +## T005 — Implement clarification decision DEC-002 +- Stage: specify +- Purpose: Carry out lifecycle task T005 (done) covering DEC-002. +- Related: DEC-002 + +## T006 — Implement clarification decision DEC-003 +- Stage: specify +- Purpose: Carry out lifecycle task T006 (done) covering DEC-003. +- Related: DEC-003 + +## T007 — Update contract surface PC-001 +- Stage: specify +- Purpose: Carry out lifecycle task T007 (done) covering PC-001, PD-001. +- Related: PC-001, PD-001 + +## T008 — Record verification evidence VO-001 +- Stage: specify +- Purpose: Carry out lifecycle task T008 (done) covering PC-001, PD-001, VO-001. +- Related: PC-001, PD-001, VO-001 + +## T009 — Handle migration posture PM-001 +- Stage: specify +- Purpose: Carry out lifecycle task T009 (done) covering PC-001, PM-001. +- Related: PC-001, PM-001 + +## T010 — Refresh generated view impact GV-001 +- Stage: specify +- Purpose: Carry out lifecycle task T010 (done) covering GV-001, PD-001. +- Related: GV-001, PD-001 diff --git a/readiness/2723-fence-arming-premise-rot/agent-commands/claude/guidance.json b/readiness/2723-fence-arming-premise-rot/agent-commands/claude/guidance.json new file mode 100644 index 000000000..59660d65f --- /dev/null +++ b/readiness/2723-fence-arming-premise-rot/agent-commands/claude/guidance.json @@ -0,0 +1,199 @@ +{ + "schemaVersion": 1, + "viewVersion": "1.0", + "workId": "2723-fence-arming-premise-rot", + "targetId": "claude", + "generator": "FS.GG.SDD.Artifacts/1.1.0", + "generated": true, + "sources": [ + { + "path": "readiness/2723-fence-arming-premise-rot/work-model.json", + "kind": "workModel", + "digest": { + "algorithm": "sha256", + "value": "69e1a04e67bc3339aebff00a2f992126379cecc39af6f5c51193856247c2ca0b" + }, + "schemaVersion": 1, + "schemaStatus": "current" + } + ], + "behaviorModelDigest": { + "algorithm": "sha256", + "value": "527a14bcd46ffa462c47bd7c51b466c3f4842b4492e2ba6a49374a06a06ad6b6" + }, + "commands": [ + { + "id": "T001", + "title": "Implement requirement FR-001", + "stage": "specify", + "purpose": "Carry out lifecycle task T001 (done) covering AC-001, FR-001, PD-001.", + "relatedIds": [ + "AC-001", + "FR-001", + "PD-001" + ] + }, + { + "id": "T002", + "title": "Implement requirement FR-002", + "stage": "specify", + "purpose": "Carry out lifecycle task T002 (done) covering AC-001, FR-002, PD-002.", + "relatedIds": [ + "AC-001", + "FR-002", + "PD-002" + ] + }, + { + "id": "T003", + "title": "Implement requirement FR-003", + "stage": "specify", + "purpose": "Carry out lifecycle task T003 (done) covering AC-001, FR-003, PD-003.", + "relatedIds": [ + "AC-001", + "FR-003", + "PD-003" + ] + }, + { + "id": "T004", + "title": "Implement clarification decision DEC-001", + "stage": "specify", + "purpose": "Carry out lifecycle task T004 (done) covering DEC-001.", + "relatedIds": [ + "DEC-001" + ] + }, + { + "id": "T005", + "title": "Implement clarification decision DEC-002", + "stage": "specify", + "purpose": "Carry out lifecycle task T005 (done) covering DEC-002.", + "relatedIds": [ + "DEC-002" + ] + }, + { + "id": "T006", + "title": "Implement clarification decision DEC-003", + "stage": "specify", + "purpose": "Carry out lifecycle task T006 (done) covering DEC-003.", + "relatedIds": [ + "DEC-003" + ] + }, + { + "id": "T007", + "title": "Update contract surface PC-001", + "stage": "specify", + "purpose": "Carry out lifecycle task T007 (done) covering PC-001, PD-001.", + "relatedIds": [ + "PC-001", + "PD-001" + ] + }, + { + "id": "T008", + "title": "Record verification evidence VO-001", + "stage": "specify", + "purpose": "Carry out lifecycle task T008 (done) covering PC-001, PD-001, VO-001.", + "relatedIds": [ + "PC-001", + "PD-001", + "VO-001" + ] + }, + { + "id": "T009", + "title": "Handle migration posture PM-001", + "stage": "specify", + "purpose": "Carry out lifecycle task T009 (done) covering PC-001, PM-001.", + "relatedIds": [ + "PC-001", + "PM-001" + ] + }, + { + "id": "T010", + "title": "Refresh generated view impact GV-001", + "stage": "specify", + "purpose": "Carry out lifecycle task T010 (done) covering GV-001, PD-001.", + "relatedIds": [ + "GV-001", + "PD-001" + ] + } + ], + "skills": [ + { + "id": "automated-tests", + "title": "automated-tests", + "capability": "Required by tasks: T008.", + "relatedIds": [ + "T008" + ] + }, + { + "id": "deterministic-json", + "title": "deterministic-json", + "capability": "Required by tasks: T010.", + "relatedIds": [ + "T010" + ] + }, + { + "id": "fsharp", + "title": "fsharp", + "capability": "Required by tasks: T001, T002, T003, T004, T005, T006, T007.", + "relatedIds": [ + "T001", + "T002", + "T003", + "T004", + "T005", + "T006", + "T007" + ] + }, + { + "id": "implementation", + "title": "implementation", + "capability": "Required by tasks: T001, T002, T003, T004, T005, T006.", + "relatedIds": [ + "T001", + "T002", + "T003", + "T004", + "T005", + "T006" + ] + }, + { + "id": "readiness-evidence", + "title": "readiness-evidence", + "capability": "Required by tasks: T008.", + "relatedIds": [ + "T008" + ] + }, + { + "id": "schema-versioning", + "title": "schema-versioning", + "capability": "Required by tasks: T009.", + "relatedIds": [ + "T009" + ] + } + ], + "renderedFiles": [ + { + "path": "readiness/2723-fence-arming-premise-rot/agent-commands/claude/commands.md", + "kind": "commands" + }, + { + "path": "readiness/2723-fence-arming-premise-rot/agent-commands/claude/skills.md", + "kind": "skills" + } + ], + "diagnostics": [] +} \ No newline at end of file diff --git a/readiness/2723-fence-arming-premise-rot/agent-commands/claude/skills.md b/readiness/2723-fence-arming-premise-rot/agent-commands/claude/skills.md new file mode 100644 index 000000000..499013b4a --- /dev/null +++ b/readiness/2723-fence-arming-premise-rot/agent-commands/claude/skills.md @@ -0,0 +1,30 @@ +# Agent skills for claude (generated) + +Generated from `readiness/2723-fence-arming-premise-rot/work-model.json`. This is a generated projection of the +normalized work model, not an authored source of truth. See `guidance.json`. + +For public-impact F# work, author or update the compiled `.fsi` signature before implementation hardens the surface. Prefer simple modules, functions, records, and discriminated unions; keep effects at explicit boundaries. + +## automated-tests — automated-tests +- Capability: Required by tasks: T008. +- Related: T008 + +## deterministic-json — deterministic-json +- Capability: Required by tasks: T010. +- Related: T010 + +## fsharp — fsharp +- Capability: Required by tasks: T001, T002, T003, T004, T005, T006, T007. +- Related: T001, T002, T003, T004, T005, T006, T007 + +## implementation — implementation +- Capability: Required by tasks: T001, T002, T003, T004, T005, T006. +- Related: T001, T002, T003, T004, T005, T006 + +## readiness-evidence — readiness-evidence +- Capability: Required by tasks: T008. +- Related: T008 + +## schema-versioning — schema-versioning +- Capability: Required by tasks: T009. +- Related: T009 diff --git a/readiness/2723-fence-arming-premise-rot/agent-commands/codex/commands.md b/readiness/2723-fence-arming-premise-rot/agent-commands/codex/commands.md new file mode 100644 index 000000000..f577ce69f --- /dev/null +++ b/readiness/2723-fence-arming-premise-rot/agent-commands/codex/commands.md @@ -0,0 +1,54 @@ +# Agent commands for codex (generated) + +Generated from `readiness/2723-fence-arming-premise-rot/work-model.json`. This is a generated projection of the +normalized work model, not an authored source of truth. See `guidance.json`. + +## T001 — Implement requirement FR-001 +- Stage: specify +- Purpose: Carry out lifecycle task T001 (done) covering AC-001, FR-001, PD-001. +- Related: AC-001, FR-001, PD-001 + +## T002 — Implement requirement FR-002 +- Stage: specify +- Purpose: Carry out lifecycle task T002 (done) covering AC-001, FR-002, PD-002. +- Related: AC-001, FR-002, PD-002 + +## T003 — Implement requirement FR-003 +- Stage: specify +- Purpose: Carry out lifecycle task T003 (done) covering AC-001, FR-003, PD-003. +- Related: AC-001, FR-003, PD-003 + +## T004 — Implement clarification decision DEC-001 +- Stage: specify +- Purpose: Carry out lifecycle task T004 (done) covering DEC-001. +- Related: DEC-001 + +## T005 — Implement clarification decision DEC-002 +- Stage: specify +- Purpose: Carry out lifecycle task T005 (done) covering DEC-002. +- Related: DEC-002 + +## T006 — Implement clarification decision DEC-003 +- Stage: specify +- Purpose: Carry out lifecycle task T006 (done) covering DEC-003. +- Related: DEC-003 + +## T007 — Update contract surface PC-001 +- Stage: specify +- Purpose: Carry out lifecycle task T007 (done) covering PC-001, PD-001. +- Related: PC-001, PD-001 + +## T008 — Record verification evidence VO-001 +- Stage: specify +- Purpose: Carry out lifecycle task T008 (done) covering PC-001, PD-001, VO-001. +- Related: PC-001, PD-001, VO-001 + +## T009 — Handle migration posture PM-001 +- Stage: specify +- Purpose: Carry out lifecycle task T009 (done) covering PC-001, PM-001. +- Related: PC-001, PM-001 + +## T010 — Refresh generated view impact GV-001 +- Stage: specify +- Purpose: Carry out lifecycle task T010 (done) covering GV-001, PD-001. +- Related: GV-001, PD-001 diff --git a/readiness/2723-fence-arming-premise-rot/agent-commands/codex/guidance.json b/readiness/2723-fence-arming-premise-rot/agent-commands/codex/guidance.json new file mode 100644 index 000000000..a3641a5fa --- /dev/null +++ b/readiness/2723-fence-arming-premise-rot/agent-commands/codex/guidance.json @@ -0,0 +1,199 @@ +{ + "schemaVersion": 1, + "viewVersion": "1.0", + "workId": "2723-fence-arming-premise-rot", + "targetId": "codex", + "generator": "FS.GG.SDD.Artifacts/1.1.0", + "generated": true, + "sources": [ + { + "path": "readiness/2723-fence-arming-premise-rot/work-model.json", + "kind": "workModel", + "digest": { + "algorithm": "sha256", + "value": "69e1a04e67bc3339aebff00a2f992126379cecc39af6f5c51193856247c2ca0b" + }, + "schemaVersion": 1, + "schemaStatus": "current" + } + ], + "behaviorModelDigest": { + "algorithm": "sha256", + "value": "527a14bcd46ffa462c47bd7c51b466c3f4842b4492e2ba6a49374a06a06ad6b6" + }, + "commands": [ + { + "id": "T001", + "title": "Implement requirement FR-001", + "stage": "specify", + "purpose": "Carry out lifecycle task T001 (done) covering AC-001, FR-001, PD-001.", + "relatedIds": [ + "AC-001", + "FR-001", + "PD-001" + ] + }, + { + "id": "T002", + "title": "Implement requirement FR-002", + "stage": "specify", + "purpose": "Carry out lifecycle task T002 (done) covering AC-001, FR-002, PD-002.", + "relatedIds": [ + "AC-001", + "FR-002", + "PD-002" + ] + }, + { + "id": "T003", + "title": "Implement requirement FR-003", + "stage": "specify", + "purpose": "Carry out lifecycle task T003 (done) covering AC-001, FR-003, PD-003.", + "relatedIds": [ + "AC-001", + "FR-003", + "PD-003" + ] + }, + { + "id": "T004", + "title": "Implement clarification decision DEC-001", + "stage": "specify", + "purpose": "Carry out lifecycle task T004 (done) covering DEC-001.", + "relatedIds": [ + "DEC-001" + ] + }, + { + "id": "T005", + "title": "Implement clarification decision DEC-002", + "stage": "specify", + "purpose": "Carry out lifecycle task T005 (done) covering DEC-002.", + "relatedIds": [ + "DEC-002" + ] + }, + { + "id": "T006", + "title": "Implement clarification decision DEC-003", + "stage": "specify", + "purpose": "Carry out lifecycle task T006 (done) covering DEC-003.", + "relatedIds": [ + "DEC-003" + ] + }, + { + "id": "T007", + "title": "Update contract surface PC-001", + "stage": "specify", + "purpose": "Carry out lifecycle task T007 (done) covering PC-001, PD-001.", + "relatedIds": [ + "PC-001", + "PD-001" + ] + }, + { + "id": "T008", + "title": "Record verification evidence VO-001", + "stage": "specify", + "purpose": "Carry out lifecycle task T008 (done) covering PC-001, PD-001, VO-001.", + "relatedIds": [ + "PC-001", + "PD-001", + "VO-001" + ] + }, + { + "id": "T009", + "title": "Handle migration posture PM-001", + "stage": "specify", + "purpose": "Carry out lifecycle task T009 (done) covering PC-001, PM-001.", + "relatedIds": [ + "PC-001", + "PM-001" + ] + }, + { + "id": "T010", + "title": "Refresh generated view impact GV-001", + "stage": "specify", + "purpose": "Carry out lifecycle task T010 (done) covering GV-001, PD-001.", + "relatedIds": [ + "GV-001", + "PD-001" + ] + } + ], + "skills": [ + { + "id": "automated-tests", + "title": "automated-tests", + "capability": "Required by tasks: T008.", + "relatedIds": [ + "T008" + ] + }, + { + "id": "deterministic-json", + "title": "deterministic-json", + "capability": "Required by tasks: T010.", + "relatedIds": [ + "T010" + ] + }, + { + "id": "fsharp", + "title": "fsharp", + "capability": "Required by tasks: T001, T002, T003, T004, T005, T006, T007.", + "relatedIds": [ + "T001", + "T002", + "T003", + "T004", + "T005", + "T006", + "T007" + ] + }, + { + "id": "implementation", + "title": "implementation", + "capability": "Required by tasks: T001, T002, T003, T004, T005, T006.", + "relatedIds": [ + "T001", + "T002", + "T003", + "T004", + "T005", + "T006" + ] + }, + { + "id": "readiness-evidence", + "title": "readiness-evidence", + "capability": "Required by tasks: T008.", + "relatedIds": [ + "T008" + ] + }, + { + "id": "schema-versioning", + "title": "schema-versioning", + "capability": "Required by tasks: T009.", + "relatedIds": [ + "T009" + ] + } + ], + "renderedFiles": [ + { + "path": "readiness/2723-fence-arming-premise-rot/agent-commands/codex/commands.md", + "kind": "commands" + }, + { + "path": "readiness/2723-fence-arming-premise-rot/agent-commands/codex/skills.md", + "kind": "skills" + } + ], + "diagnostics": [] +} \ No newline at end of file diff --git a/readiness/2723-fence-arming-premise-rot/agent-commands/codex/skills.md b/readiness/2723-fence-arming-premise-rot/agent-commands/codex/skills.md new file mode 100644 index 000000000..68df5bdc6 --- /dev/null +++ b/readiness/2723-fence-arming-premise-rot/agent-commands/codex/skills.md @@ -0,0 +1,30 @@ +# Agent skills for codex (generated) + +Generated from `readiness/2723-fence-arming-premise-rot/work-model.json`. This is a generated projection of the +normalized work model, not an authored source of truth. See `guidance.json`. + +For public-impact F# work, author or update the compiled `.fsi` signature before implementation hardens the surface. Prefer simple modules, functions, records, and discriminated unions; keep effects at explicit boundaries. + +## automated-tests — automated-tests +- Capability: Required by tasks: T008. +- Related: T008 + +## deterministic-json — deterministic-json +- Capability: Required by tasks: T010. +- Related: T010 + +## fsharp — fsharp +- Capability: Required by tasks: T001, T002, T003, T004, T005, T006, T007. +- Related: T001, T002, T003, T004, T005, T006, T007 + +## implementation — implementation +- Capability: Required by tasks: T001, T002, T003, T004, T005, T006. +- Related: T001, T002, T003, T004, T005, T006 + +## readiness-evidence — readiness-evidence +- Capability: Required by tasks: T008. +- Related: T008 + +## schema-versioning — schema-versioning +- Capability: Required by tasks: T009. +- Related: T009 diff --git a/readiness/2723-fence-arming-premise-rot/analysis.json b/readiness/2723-fence-arming-premise-rot/analysis.json new file mode 100644 index 000000000..d7dc7e988 --- /dev/null +++ b/readiness/2723-fence-arming-premise-rot/analysis.json @@ -0,0 +1,462 @@ +{ + "schemaVersion": 1, + "viewVersion": "1.0", + "workId": "2723-fence-arming-premise-rot", + "stage": "analyze", + "status": "implementationReady", + "generator": "FS.GG.SDD.Artifacts/1.1.0", + "sources": [ + { + "path": ".fsgg/agents.yml", + "kind": "agentsConfig", + "digest": { + "algorithm": "sha256", + "value": "c67035b1cf31b6fa802c10f761eeb1e5bf5d198c38d159b54fac299957b5aac3" + }, + "schemaVersion": 1, + "schemaStatus": "current" + }, + { + "path": ".fsgg/project.yml", + "kind": "projectConfig", + "digest": { + "algorithm": "sha256", + "value": "ef78f002b33ce22f738bac2c0dbf716db729a7d3ae3e4a68a4ce4b93810ced66" + }, + "schemaVersion": 1, + "schemaStatus": "current" + }, + { + "path": ".fsgg/sdd.yml", + "kind": "sddConfig", + "digest": { + "algorithm": "sha256", + "value": "fe5a7c270a975153e80ab0d08a610c9b302585dcb0b5f7c654841ceced9272cb" + }, + "schemaVersion": 1, + "schemaStatus": "current" + }, + { + "path": "readiness/2723-fence-arming-premise-rot/work-model.json", + "kind": "workModel", + "digest": { + "algorithm": "sha256", + "value": "69e1a04e67bc3339aebff00a2f992126379cecc39af6f5c51193856247c2ca0b" + }, + "schemaVersion": 1, + "schemaStatus": "current" + }, + { + "path": "work/2723-fence-arming-premise-rot/checklist.md", + "kind": "checklist", + "digest": { + "algorithm": "sha256", + "value": "102e2b9535d2ab976eb0229a4f2c72ef9e85c5d494233da28306a6d65d801fa9" + }, + "schemaVersion": 1, + "schemaStatus": "current" + }, + { + "path": "work/2723-fence-arming-premise-rot/clarifications.md", + "kind": "clarification", + "digest": { + "algorithm": "sha256", + "value": "d14483cfd6a8cf8e3c82b47a730cbc158c4e5382b7a63802b901062b84caf842" + }, + "schemaVersion": 1, + "schemaStatus": "current" + }, + { + "path": "work/2723-fence-arming-premise-rot/plan.md", + "kind": "plan", + "digest": { + "algorithm": "sha256", + "value": "0eb6e6700f912065c2986475dde1fa59d2a7eb9ff58dcb660285061018212877" + }, + "schemaVersion": 1, + "schemaStatus": "current" + }, + { + "path": "work/2723-fence-arming-premise-rot/spec.md", + "kind": "specification", + "digest": { + "algorithm": "sha256", + "value": "29f2cb8a7ec153c14b98f7c1bc63db3b2b1b72dfa71d3c98409659fa8473abdf" + }, + "schemaVersion": 1, + "schemaStatus": "current" + }, + { + "path": "work/2723-fence-arming-premise-rot/tasks.yml", + "kind": "tasks", + "digest": { + "algorithm": "sha256", + "value": "476b7455c315389f9701220eeac136770247ed15c187ab2d7191224a7a2991c7" + }, + "schemaVersion": 1, + "schemaStatus": "current" + } + ], + "sourceRelationships": [ + { + "id": "AR001", + "sourcePath": "work/2723-fence-arming-premise-rot/checklist.md", + "targetPath": "work/2723-fence-arming-premise-rot/plan.md", + "sourceId": null, + "targetId": null, + "relationship": "planSourceChecklist", + "state": "current", + "diagnosticIds": [] + }, + { + "id": "AR002", + "sourcePath": "work/2723-fence-arming-premise-rot/checklist.md", + "targetPath": "work/2723-fence-arming-premise-rot/tasks.yml", + "sourceId": null, + "targetId": null, + "relationship": "taskSourceChecklist", + "state": "current", + "diagnosticIds": [] + }, + { + "id": "AR003", + "sourcePath": "work/2723-fence-arming-premise-rot/clarifications.md", + "targetPath": "work/2723-fence-arming-premise-rot/checklist.md", + "sourceId": null, + "targetId": null, + "relationship": "checklistSourceClarifications", + "state": "current", + "diagnosticIds": [] + }, + { + "id": "AR004", + "sourcePath": "work/2723-fence-arming-premise-rot/clarifications.md", + "targetPath": "work/2723-fence-arming-premise-rot/tasks.yml", + "sourceId": "DEC-001", + "targetId": null, + "relationship": "clarificationDisposition", + "state": "current", + "diagnosticIds": [] + }, + { + "id": "AR005", + "sourcePath": "work/2723-fence-arming-premise-rot/clarifications.md", + "targetPath": "work/2723-fence-arming-premise-rot/tasks.yml", + "sourceId": "DEC-002", + "targetId": null, + "relationship": "clarificationDisposition", + "state": "current", + "diagnosticIds": [] + }, + { + "id": "AR006", + "sourcePath": "work/2723-fence-arming-premise-rot/clarifications.md", + "targetPath": "work/2723-fence-arming-premise-rot/tasks.yml", + "sourceId": "DEC-003", + "targetId": null, + "relationship": "clarificationDisposition", + "state": "current", + "diagnosticIds": [] + }, + { + "id": "AR007", + "sourcePath": "work/2723-fence-arming-premise-rot/clarifications.md", + "targetPath": "work/2723-fence-arming-premise-rot/plan.md", + "sourceId": null, + "targetId": null, + "relationship": "planSourceClarifications", + "state": "current", + "diagnosticIds": [] + }, + { + "id": "AR008", + "sourcePath": "work/2723-fence-arming-premise-rot/clarifications.md", + "targetPath": "work/2723-fence-arming-premise-rot/tasks.yml", + "sourceId": null, + "targetId": null, + "relationship": "taskSourceClarifications", + "state": "current", + "diagnosticIds": [] + }, + { + "id": "AR009", + "sourcePath": "work/2723-fence-arming-premise-rot/plan.md", + "targetPath": "work/2723-fence-arming-premise-rot/tasks.yml", + "sourceId": "PC-001", + "targetId": null, + "relationship": "contractDisposition", + "state": "current", + "diagnosticIds": [] + }, + { + "id": "AR010", + "sourcePath": "work/2723-fence-arming-premise-rot/plan.md", + "targetPath": "work/2723-fence-arming-premise-rot/tasks.yml", + "sourceId": "GV-001", + "targetId": null, + "relationship": "generatedViewDisposition", + "state": "current", + "diagnosticIds": [] + }, + { + "id": "AR011", + "sourcePath": "work/2723-fence-arming-premise-rot/plan.md", + "targetPath": "work/2723-fence-arming-premise-rot/tasks.yml", + "sourceId": "PM-001", + "targetId": null, + "relationship": "migrationDisposition", + "state": "current", + "diagnosticIds": [] + }, + { + "id": "AR012", + "sourcePath": "work/2723-fence-arming-premise-rot/plan.md", + "targetPath": "work/2723-fence-arming-premise-rot/tasks.yml", + "sourceId": "PD-001", + "targetId": null, + "relationship": "planDecisionDisposition", + "state": "current", + "diagnosticIds": [] + }, + { + "id": "AR013", + "sourcePath": "work/2723-fence-arming-premise-rot/plan.md", + "targetPath": "work/2723-fence-arming-premise-rot/tasks.yml", + "sourceId": "PD-002", + "targetId": null, + "relationship": "planDecisionDisposition", + "state": "current", + "diagnosticIds": [] + }, + { + "id": "AR014", + "sourcePath": "work/2723-fence-arming-premise-rot/plan.md", + "targetPath": "work/2723-fence-arming-premise-rot/tasks.yml", + "sourceId": "PD-003", + "targetId": null, + "relationship": "planDecisionDisposition", + "state": "current", + "diagnosticIds": [] + }, + { + "id": "AR015", + "sourcePath": "work/2723-fence-arming-premise-rot/plan.md", + "targetPath": "work/2723-fence-arming-premise-rot/tasks.yml", + "sourceId": null, + "targetId": null, + "relationship": "taskSourcePlan", + "state": "current", + "diagnosticIds": [] + }, + { + "id": "AR016", + "sourcePath": "work/2723-fence-arming-premise-rot/plan.md", + "targetPath": "work/2723-fence-arming-premise-rot/tasks.yml", + "sourceId": "VO-001", + "targetId": null, + "relationship": "verificationDisposition", + "state": "current", + "diagnosticIds": [] + }, + { + "id": "AR017", + "sourcePath": "work/2723-fence-arming-premise-rot/spec.md", + "targetPath": "work/2723-fence-arming-premise-rot/tasks.yml", + "sourceId": "AC-001", + "targetId": null, + "relationship": "acceptanceDisposition", + "state": "current", + "diagnosticIds": [] + }, + { + "id": "AR018", + "sourcePath": "work/2723-fence-arming-premise-rot/spec.md", + "targetPath": "work/2723-fence-arming-premise-rot/checklist.md", + "sourceId": null, + "targetId": null, + "relationship": "checklistSourceSpec", + "state": "current", + "diagnosticIds": [] + }, + { + "id": "AR019", + "sourcePath": "work/2723-fence-arming-premise-rot/spec.md", + "targetPath": "work/2723-fence-arming-premise-rot/plan.md", + "sourceId": null, + "targetId": null, + "relationship": "planSourceSpec", + "state": "current", + "diagnosticIds": [] + }, + { + "id": "AR020", + "sourcePath": "work/2723-fence-arming-premise-rot/spec.md", + "targetPath": "work/2723-fence-arming-premise-rot/tasks.yml", + "sourceId": "FR-001", + "targetId": null, + "relationship": "requirementDisposition", + "state": "current", + "diagnosticIds": [] + }, + { + "id": "AR021", + "sourcePath": "work/2723-fence-arming-premise-rot/spec.md", + "targetPath": "work/2723-fence-arming-premise-rot/tasks.yml", + "sourceId": "FR-002", + "targetId": null, + "relationship": "requirementDisposition", + "state": "current", + "diagnosticIds": [] + }, + { + "id": "AR022", + "sourcePath": "work/2723-fence-arming-premise-rot/spec.md", + "targetPath": "work/2723-fence-arming-premise-rot/tasks.yml", + "sourceId": "FR-003", + "targetId": null, + "relationship": "requirementDisposition", + "state": "current", + "diagnosticIds": [] + }, + { + "id": "AR023", + "sourcePath": "work/2723-fence-arming-premise-rot/spec.md", + "targetPath": "work/2723-fence-arming-premise-rot/clarifications.md", + "sourceId": null, + "targetId": null, + "relationship": "sourceSpec", + "state": "current", + "diagnosticIds": [] + }, + { + "id": "AR024", + "sourcePath": "work/2723-fence-arming-premise-rot/spec.md", + "targetPath": "work/2723-fence-arming-premise-rot/tasks.yml", + "sourceId": null, + "targetId": null, + "relationship": "taskSourceSpec", + "state": "current", + "diagnosticIds": [] + }, + { + "id": "AR025", + "sourcePath": "work/2723-fence-arming-premise-rot/tasks.yml", + "targetPath": "work/2723-fence-arming-premise-rot/tasks.yml", + "sourceId": "T004", + "targetId": "T001", + "relationship": "taskDependency", + "state": "current", + "diagnosticIds": [] + }, + { + "id": "AR026", + "sourcePath": "work/2723-fence-arming-premise-rot/tasks.yml", + "targetPath": "work/2723-fence-arming-premise-rot/tasks.yml", + "sourceId": "T005", + "targetId": "T001", + "relationship": "taskDependency", + "state": "current", + "diagnosticIds": [] + }, + { + "id": "AR027", + "sourcePath": "work/2723-fence-arming-premise-rot/tasks.yml", + "targetPath": "work/2723-fence-arming-premise-rot/tasks.yml", + "sourceId": "T006", + "targetId": "T001", + "relationship": "taskDependency", + "state": "current", + "diagnosticIds": [] + }, + { + "id": "AR028", + "sourcePath": "work/2723-fence-arming-premise-rot/tasks.yml", + "targetPath": "work/2723-fence-arming-premise-rot/tasks.yml", + "sourceId": "T007", + "targetId": "T001", + "relationship": "taskDependency", + "state": "current", + "diagnosticIds": [] + }, + { + "id": "AR029", + "sourcePath": "work/2723-fence-arming-premise-rot/tasks.yml", + "targetPath": "work/2723-fence-arming-premise-rot/tasks.yml", + "sourceId": "T008", + "targetId": "T001", + "relationship": "taskDependency", + "state": "current", + "diagnosticIds": [] + }, + { + "id": "AR030", + "sourcePath": "work/2723-fence-arming-premise-rot/tasks.yml", + "targetPath": "work/2723-fence-arming-premise-rot/tasks.yml", + "sourceId": "T009", + "targetId": "T001", + "relationship": "taskDependency", + "state": "current", + "diagnosticIds": [] + }, + { + "id": "AR031", + "sourcePath": "work/2723-fence-arming-premise-rot/tasks.yml", + "targetPath": "work/2723-fence-arming-premise-rot/tasks.yml", + "sourceId": "T010", + "targetId": "T001", + "relationship": "taskDependency", + "state": "current", + "diagnosticIds": [] + } + ], + "readiness": { + "status": "implementationReady", + "readyCount": 31, + "advisoryCount": 0, + "warningCount": 0, + "blockingCount": 0, + "staleSourceCount": 0, + "missingDispositionCount": 0, + "malformedSourceCount": 0, + "generatedViewFindingCount": 0, + "acceptedDeferralCount": 0 + }, + "findings": [], + "generatedViews": [ + { + "path": "readiness/2723-fence-arming-premise-rot/work-model.json", + "kind": "workModel", + "currency": "current", + "diagnosticIds": [] + } + ], + "optionalBoundaryFacts": [ + { + "path": ".fsgg/policy.yml", + "relationship": "optionalGovernancePolicy", + "requiredBySdd": false, + "state": "notEvaluated", + "diagnosticIds": [] + }, + { + "path": ".fsgg/capabilities.yml", + "relationship": "optionalGovernanceCapabilities", + "requiredBySdd": false, + "state": "notEvaluated", + "diagnosticIds": [] + }, + { + "path": ".fsgg/tooling.yml", + "relationship": "optionalGovernanceTooling", + "requiredBySdd": false, + "state": "notEvaluated", + "diagnosticIds": [] + } + ], + "diagnostics": [], + "nextAction": { + "actionId": "analysis.next.implement", + "command": null, + "reason": "Lifecycle sources are current and ready for implementation." + } +} \ No newline at end of file diff --git a/readiness/2723-fence-arming-premise-rot/governance-handoff.json b/readiness/2723-fence-arming-premise-rot/governance-handoff.json new file mode 100644 index 000000000..51f511b58 --- /dev/null +++ b/readiness/2723-fence-arming-premise-rot/governance-handoff.json @@ -0,0 +1,271 @@ +{ + "schemaVersion": 1, + "contractVersion": "2.0.0", + "generatorVersion": "FS.GG.SDD.Artifacts/1.1.0", + "workId": "2723-fence-arming-premise-rot", + "sources": [ + { + "path": "readiness/2723-fence-arming-premise-rot/ship.json", + "digest": "sha256:e9ef9c2f1df122af4f74ba659d4d80bed1db4b0ee24c265a7e42f834be63491c", + "schemaVersion": 1 + }, + { + "path": "readiness/2723-fence-arming-premise-rot/verify.json", + "digest": "sha256:29af17b887f11ab1e5277e1abf171b1704dbf115a8091b8db9f2a043ee02dacc", + "schemaVersion": 1 + }, + { + "path": "readiness/2723-fence-arming-premise-rot/work-model.json", + "digest": "sha256:68391d56619cdd6ba31c7c02269b3593f2b3dd1a78a0e8e027f3b57432c0bfcc", + "schemaVersion": 1 + } + ], + "evidence": { + "nodes": [ + { + "id": "evidence:EV001", + "state": "real", + "rationale": null + }, + { + "id": "evidence:EV002", + "state": "real", + "rationale": null + }, + { + "id": "evidence:EV003", + "state": "real", + "rationale": null + }, + { + "id": "evidence:EV004", + "state": "real", + "rationale": null + }, + { + "id": "evidence:EV005", + "state": "real", + "rationale": null + }, + { + "id": "evidence:EV006", + "state": "real", + "rationale": null + }, + { + "id": "evidence:EV007", + "state": "real", + "rationale": null + }, + { + "id": "evidence:EV008", + "state": "real", + "rationale": null + }, + { + "id": "evidence:EV009", + "state": "real", + "rationale": null + }, + { + "id": "evidence:EV010", + "state": "real", + "rationale": null + }, + { + "id": "task:T001", + "state": "real", + "rationale": null + }, + { + "id": "task:T002", + "state": "real", + "rationale": null + }, + { + "id": "task:T003", + "state": "real", + "rationale": null + }, + { + "id": "task:T004", + "state": "real", + "rationale": null + }, + { + "id": "task:T005", + "state": "real", + "rationale": null + }, + { + "id": "task:T006", + "state": "real", + "rationale": null + }, + { + "id": "task:T007", + "state": "real", + "rationale": null + }, + { + "id": "task:T008", + "state": "real", + "rationale": null + }, + { + "id": "task:T009", + "state": "real", + "rationale": null + }, + { + "id": "task:T010", + "state": "real", + "rationale": null + } + ], + "dependencies": [ + { + "dependent": "evidence:EV001", + "dependency": "task:T001" + }, + { + "dependent": "evidence:EV002", + "dependency": "task:T002" + }, + { + "dependent": "evidence:EV003", + "dependency": "task:T003" + }, + { + "dependent": "evidence:EV004", + "dependency": "task:T004" + }, + { + "dependent": "evidence:EV005", + "dependency": "task:T005" + }, + { + "dependent": "evidence:EV006", + "dependency": "task:T006" + }, + { + "dependent": "evidence:EV007", + "dependency": "task:T007" + }, + { + "dependent": "evidence:EV008", + "dependency": "task:T008" + }, + { + "dependent": "evidence:EV009", + "dependency": "task:T009" + }, + { + "dependent": "evidence:EV010", + "dependency": "task:T010" + }, + { + "dependent": "task:T001", + "dependency": "evidence:EV001" + }, + { + "dependent": "task:T002", + "dependency": "evidence:EV002" + }, + { + "dependent": "task:T003", + "dependency": "evidence:EV003" + }, + { + "dependent": "task:T004", + "dependency": "evidence:EV004" + }, + { + "dependent": "task:T004", + "dependency": "task:T001" + }, + { + "dependent": "task:T005", + "dependency": "evidence:EV005" + }, + { + "dependent": "task:T005", + "dependency": "task:T001" + }, + { + "dependent": "task:T006", + "dependency": "evidence:EV006" + }, + { + "dependent": "task:T006", + "dependency": "task:T001" + }, + { + "dependent": "task:T007", + "dependency": "evidence:EV007" + }, + { + "dependent": "task:T007", + "dependency": "task:T001" + }, + { + "dependent": "task:T008", + "dependency": "evidence:EV008" + }, + { + "dependent": "task:T008", + "dependency": "task:T001" + }, + { + "dependent": "task:T009", + "dependency": "evidence:EV009" + }, + { + "dependent": "task:T009", + "dependency": "task:T001" + }, + { + "dependent": "task:T010", + "dependency": "evidence:EV010" + }, + { + "dependent": "task:T010", + "dependency": "task:T001" + } + ] + }, + "performanceEvidence": [], + "governedReferences": [], + "governanceConfig": { + "policyPresent": false, + "capabilitiesPresent": false, + "toolingPresent": false + }, + "readiness": { + "shipDisposition": "shipReady", + "verificationReadiness": "verificationReady", + "counts": { + "advisory": 0, + "warning": 0, + "blocking": 0, + "classifiedObligationsUnmet": 0, + "journeyObligationsUnmet": 0 + }, + "blockingDiagnosticIds": [], + "perViewState": [ + { + "view": "ship.json", + "state": "current" + }, + { + "view": "verify.json", + "state": "current" + }, + { + "view": "work-model.json", + "state": "current" + } + ] + }, + "diagnostics": [] +} \ No newline at end of file diff --git a/readiness/2723-fence-arming-premise-rot/ship-verdict.json b/readiness/2723-fence-arming-premise-rot/ship-verdict.json new file mode 100644 index 000000000..9903eb130 --- /dev/null +++ b/readiness/2723-fence-arming-premise-rot/ship-verdict.json @@ -0,0 +1,23 @@ +{ + "schemaVersion": 1, + "viewVersion": "1.0", + "workId": "2723-fence-arming-premise-rot", + "stage": "ship", + "status": "shipReady", + "generator": "FS.GG.SDD.Artifacts/1.1.0", + "sourcesDigest": { + "algorithm": "sha256", + "value": "20626ca5b39a9b3f14825eaeadeb9c25e882b96cceafd7ddddb41a6351d67abd" + }, + "verificationReadiness": { + "status": "verificationReady", + "evidenceSupportedCount": 10, + "evidenceSelfAttestedCount": 0, + "evidenceObservedCount": 10 + }, + "disposition": { + "state": "shipReady", + "blockingFindingIds": [] + }, + "readiness": "shipReady" +} \ No newline at end of file diff --git a/readiness/2723-fence-arming-premise-rot/ship.json b/readiness/2723-fence-arming-premise-rot/ship.json new file mode 100644 index 000000000..dc822de02 --- /dev/null +++ b/readiness/2723-fence-arming-premise-rot/ship.json @@ -0,0 +1,322 @@ +{ + "schemaVersion": 1, + "viewVersion": "1.0", + "workId": "2723-fence-arming-premise-rot", + "stage": "ship", + "status": "shipReady", + "generator": "FS.GG.SDD.Artifacts/1.1.0", + "sources": [ + { + "path": ".fsgg/agents.yml", + "kind": "agentsConfig", + "digest": { + "algorithm": "sha256", + "value": "c67035b1cf31b6fa802c10f761eeb1e5bf5d198c38d159b54fac299957b5aac3" + }, + "schemaVersion": 1, + "schemaStatus": "current" + }, + { + "path": ".fsgg/project.yml", + "kind": "projectConfig", + "digest": { + "algorithm": "sha256", + "value": "ef78f002b33ce22f738bac2c0dbf716db729a7d3ae3e4a68a4ce4b93810ced66" + }, + "schemaVersion": 1, + "schemaStatus": "current" + }, + { + "path": ".fsgg/sdd.yml", + "kind": "sddConfig", + "digest": { + "algorithm": "sha256", + "value": "fe5a7c270a975153e80ab0d08a610c9b302585dcb0b5f7c654841ceced9272cb" + }, + "schemaVersion": 1, + "schemaStatus": "current" + }, + { + "path": "readiness/2723-fence-arming-premise-rot/analysis.json", + "kind": "analysis", + "digest": { + "algorithm": "sha256", + "value": "ece93425673043c5c48a2a0b60e9a43de52e917c991da213d1752ca319c46afe" + }, + "schemaVersion": 1, + "schemaStatus": "current" + }, + { + "path": "readiness/2723-fence-arming-premise-rot/verify.json", + "kind": "source", + "digest": { + "algorithm": "sha256", + "value": "29af17b887f11ab1e5277e1abf171b1704dbf115a8091b8db9f2a043ee02dacc" + }, + "schemaVersion": 1, + "schemaStatus": "current" + }, + { + "path": "readiness/2723-fence-arming-premise-rot/work-model.json", + "kind": "workModel", + "digest": { + "algorithm": "sha256", + "value": "68391d56619cdd6ba31c7c02269b3593f2b3dd1a78a0e8e027f3b57432c0bfcc" + }, + "schemaVersion": 1, + "schemaStatus": "current" + }, + { + "path": "work/2723-fence-arming-premise-rot/checklist.md", + "kind": "checklist", + "digest": { + "algorithm": "sha256", + "value": "102e2b9535d2ab976eb0229a4f2c72ef9e85c5d494233da28306a6d65d801fa9" + }, + "schemaVersion": 1, + "schemaStatus": "current" + }, + { + "path": "work/2723-fence-arming-premise-rot/clarifications.md", + "kind": "clarification", + "digest": { + "algorithm": "sha256", + "value": "d14483cfd6a8cf8e3c82b47a730cbc158c4e5382b7a63802b901062b84caf842" + }, + "schemaVersion": 1, + "schemaStatus": "current" + }, + { + "path": "work/2723-fence-arming-premise-rot/evidence.yml", + "kind": "evidence", + "digest": { + "algorithm": "sha256", + "value": "380b2bbd98c347e7d02491877620297c7b200b13ae4a9e3e2c50ac279b869aba" + }, + "schemaVersion": 1, + "schemaStatus": "current" + }, + { + "path": "work/2723-fence-arming-premise-rot/plan.md", + "kind": "plan", + "digest": { + "algorithm": "sha256", + "value": "0eb6e6700f912065c2986475dde1fa59d2a7eb9ff58dcb660285061018212877" + }, + "schemaVersion": 1, + "schemaStatus": "current" + }, + { + "path": "work/2723-fence-arming-premise-rot/spec.md", + "kind": "specification", + "digest": { + "algorithm": "sha256", + "value": "29f2cb8a7ec153c14b98f7c1bc63db3b2b1b72dfa71d3c98409659fa8473abdf" + }, + "schemaVersion": 1, + "schemaStatus": "current" + }, + { + "path": "work/2723-fence-arming-premise-rot/tasks.yml", + "kind": "tasks", + "digest": { + "algorithm": "sha256", + "value": "476b7455c315389f9701220eeac136770247ed15c187ab2d7191224a7a2991c7" + }, + "schemaVersion": 1, + "schemaStatus": "current" + } + ], + "lifecycleReadiness": { + "status": "shipReady", + "stages": [ + { + "stage": "analyze", + "status": "ready" + }, + { + "stage": "checklist", + "status": "ready" + }, + { + "stage": "clarify", + "status": "ready" + }, + { + "stage": "evidence", + "status": "ready" + }, + { + "stage": "plan", + "status": "ready" + }, + { + "stage": "specify", + "status": "ready" + }, + { + "stage": "tasks", + "status": "ready" + }, + { + "stage": "verify", + "status": "ready" + } + ] + }, + "verificationReadiness": { + "status": "verificationReady", + "blockingFindingIds": [], + "evidenceSupportedCount": 10, + "evidenceSelfAttestedCount": 0, + "evidenceObservedCount": 10, + "evidenceDeferredCount": 0, + "evidenceMissingCount": 0, + "evidenceStaleCount": 0, + "evidenceSyntheticCount": 0, + "evidenceInvalidCount": 0 + }, + "evidenceDispositions": [ + { + "id": "ED-EV001", + "obligationId": "EV001", + "state": "supported", + "observed": true, + "severity": "ready", + "diagnosticIds": [] + }, + { + "id": "ED-EV002", + "obligationId": "EV002", + "state": "supported", + "observed": true, + "severity": "ready", + "diagnosticIds": [] + }, + { + "id": "ED-EV003", + "obligationId": "EV003", + "state": "supported", + "observed": true, + "severity": "ready", + "diagnosticIds": [] + }, + { + "id": "ED-EV004", + "obligationId": "EV004", + "state": "supported", + "observed": true, + "severity": "ready", + "diagnosticIds": [] + }, + { + "id": "ED-EV005", + "obligationId": "EV005", + "state": "supported", + "observed": true, + "severity": "ready", + "diagnosticIds": [] + }, + { + "id": "ED-EV006", + "obligationId": "EV006", + "state": "supported", + "observed": true, + "severity": "ready", + "diagnosticIds": [] + }, + { + "id": "ED-EV007", + "obligationId": "EV007", + "state": "supported", + "observed": true, + "severity": "ready", + "diagnosticIds": [] + }, + { + "id": "ED-EV008", + "obligationId": "EV008", + "state": "supported", + "observed": true, + "severity": "ready", + "diagnosticIds": [] + }, + { + "id": "ED-EV009", + "obligationId": "EV009", + "state": "supported", + "observed": true, + "severity": "ready", + "diagnosticIds": [] + }, + { + "id": "ED-EV010", + "obligationId": "EV010", + "state": "supported", + "observed": true, + "severity": "ready", + "diagnosticIds": [] + } + ], + "generatedViews": [ + { + "path": "readiness/2723-fence-arming-premise-rot/analysis.json", + "kind": "analysis", + "currency": "current", + "diagnosticIds": [] + }, + { + "path": "readiness/2723-fence-arming-premise-rot/verify.json", + "kind": "verification", + "currency": "current", + "diagnosticIds": [] + }, + { + "path": "readiness/2723-fence-arming-premise-rot/work-model.json", + "kind": "workModel", + "currency": "current", + "diagnosticIds": [] + } + ], + "disposition": { + "state": "shipReady", + "blockingFindingIds": [], + "warningFindingIds": [], + "advisoryFindingIds": [], + "contributingStages": [], + "classifiedObligationsUnmetCount": 0, + "journeyObligationsUnmetCount": 0, + "correction": "" + }, + "findings": [], + "governanceCompatibility": [ + { + "path": ".fsgg/policy.yml", + "relationship": "optionalGovernancePolicy", + "requiredBySdd": false, + "state": "notEvaluated", + "diagnosticIds": [] + }, + { + "path": ".fsgg/capabilities.yml", + "relationship": "optionalGovernanceCapabilities", + "requiredBySdd": false, + "state": "notEvaluated", + "diagnosticIds": [] + }, + { + "path": ".fsgg/tooling.yml", + "relationship": "optionalGovernanceTooling", + "requiredBySdd": false, + "state": "notEvaluated", + "diagnosticIds": [] + } + ], + "diagnostics": [], + "readiness": "shipReady", + "nextAction": { + "actionId": "ship.next.protectedBoundary", + "command": null, + "reason": "Ship readiness is current and ready for the protected-boundary handoff." + } +} \ No newline at end of file diff --git a/readiness/2723-fence-arming-premise-rot/summary.md b/readiness/2723-fence-arming-premise-rot/summary.md new file mode 100644 index 000000000..a3790f64c --- /dev/null +++ b/readiness/2723-fence-arming-premise-rot/summary.md @@ -0,0 +1,32 @@ + + +# Readiness Summary — 2723-fence-arming-premise-rot + +**Lifecycle stage**: refresh **Outcome**: succeededWithWarnings **Disposition**: awaiting-lifecycle + +## Generated-view currency +| View | State | +|---|---| +| work-model | current | +| analysis | current | +| verify | missing | +| ship | missing | +| ship-verdict | missing | +| governance-handoff | missing | +| agent-commands | current | +| summary | current | + +## Diagnostics +- refresh.notYetGenerated (info) readiness/2723-fence-arming-premise-rot/ship-verdict.json: Generated view 'readiness/2723-fence-arming-premise-rot/ship-verdict.json' has not been produced at the current lifecycle state. — Run `fsgg-sdd ship` for this work item; refresh reports downstream lifecycle views but does not generate them out of order. +- refresh.notYetGenerated (info) readiness/2723-fence-arming-premise-rot/ship.json: Generated view 'readiness/2723-fence-arming-premise-rot/ship.json' has not been produced at the current lifecycle state. — Run `fsgg-sdd ship` for this work item; refresh reports downstream lifecycle views but does not generate them out of order. +- refresh.notYetGenerated (info) readiness/2723-fence-arming-premise-rot/verify.json: Generated view 'readiness/2723-fence-arming-premise-rot/verify.json' has not been produced at the current lifecycle state. — Run `fsgg-sdd verify` for this work item; refresh reports downstream lifecycle views but does not generate them out of order. + +## Next action +Run the next lifecycle command named by the not-yet-generated view; refresh does not generate lifecycle views out of order. diff --git a/readiness/2723-fence-arming-premise-rot/verify.json b/readiness/2723-fence-arming-premise-rot/verify.json new file mode 100644 index 000000000..9db525e16 --- /dev/null +++ b/readiness/2723-fence-arming-premise-rot/verify.json @@ -0,0 +1,685 @@ +{ + "schemaVersion": 1, + "viewVersion": "1.0", + "workId": "2723-fence-arming-premise-rot", + "stage": "verify", + "status": "verificationReady", + "generator": "FS.GG.SDD.Artifacts/1.1.0", + "sources": [ + { + "path": ".fsgg/agents.yml", + "kind": "agentsConfig", + "digest": { + "algorithm": "sha256", + "value": "c67035b1cf31b6fa802c10f761eeb1e5bf5d198c38d159b54fac299957b5aac3" + }, + "schemaVersion": 1, + "schemaStatus": "current" + }, + { + "path": ".fsgg/project.yml", + "kind": "projectConfig", + "digest": { + "algorithm": "sha256", + "value": "ef78f002b33ce22f738bac2c0dbf716db729a7d3ae3e4a68a4ce4b93810ced66" + }, + "schemaVersion": 1, + "schemaStatus": "current" + }, + { + "path": ".fsgg/sdd.yml", + "kind": "sddConfig", + "digest": { + "algorithm": "sha256", + "value": "fe5a7c270a975153e80ab0d08a610c9b302585dcb0b5f7c654841ceced9272cb" + }, + "schemaVersion": 1, + "schemaStatus": "current" + }, + { + "path": "readiness/2723-fence-arming-premise-rot/analysis.json", + "kind": "analysis", + "digest": { + "algorithm": "sha256", + "value": "ece93425673043c5c48a2a0b60e9a43de52e917c991da213d1752ca319c46afe" + }, + "schemaVersion": 1, + "schemaStatus": "current" + }, + { + "path": "readiness/2723-fence-arming-premise-rot/work-model.json", + "kind": "workModel", + "digest": { + "algorithm": "sha256", + "value": "68391d56619cdd6ba31c7c02269b3593f2b3dd1a78a0e8e027f3b57432c0bfcc" + }, + "schemaVersion": 1, + "schemaStatus": "current" + }, + { + "path": "work/2723-fence-arming-premise-rot/checklist.md", + "kind": "checklist", + "digest": { + "algorithm": "sha256", + "value": "102e2b9535d2ab976eb0229a4f2c72ef9e85c5d494233da28306a6d65d801fa9" + }, + "schemaVersion": 1, + "schemaStatus": "current" + }, + { + "path": "work/2723-fence-arming-premise-rot/clarifications.md", + "kind": "clarification", + "digest": { + "algorithm": "sha256", + "value": "d14483cfd6a8cf8e3c82b47a730cbc158c4e5382b7a63802b901062b84caf842" + }, + "schemaVersion": 1, + "schemaStatus": "current" + }, + { + "path": "work/2723-fence-arming-premise-rot/evidence.yml", + "kind": "evidence", + "digest": { + "algorithm": "sha256", + "value": "380b2bbd98c347e7d02491877620297c7b200b13ae4a9e3e2c50ac279b869aba" + }, + "schemaVersion": 1, + "schemaStatus": "current" + }, + { + "path": "work/2723-fence-arming-premise-rot/plan.md", + "kind": "plan", + "digest": { + "algorithm": "sha256", + "value": "0eb6e6700f912065c2986475dde1fa59d2a7eb9ff58dcb660285061018212877" + }, + "schemaVersion": 1, + "schemaStatus": "current" + }, + { + "path": "work/2723-fence-arming-premise-rot/spec.md", + "kind": "specification", + "digest": { + "algorithm": "sha256", + "value": "29f2cb8a7ec153c14b98f7c1bc63db3b2b1b72dfa71d3c98409659fa8473abdf" + }, + "schemaVersion": 1, + "schemaStatus": "current" + }, + { + "path": "work/2723-fence-arming-premise-rot/tasks.yml", + "kind": "tasks", + "digest": { + "algorithm": "sha256", + "value": "476b7455c315389f9701220eeac136770247ed15c187ab2d7191224a7a2991c7" + }, + "schemaVersion": 1, + "schemaStatus": "current" + } + ], + "lifecycleReadiness": { + "status": "implementationReady", + "stages": [ + { + "stage": "analyze", + "status": "implementationReady" + }, + { + "stage": "checklist", + "status": "current" + }, + { + "stage": "clarify", + "status": "current" + }, + { + "stage": "evidence", + "status": "evidenceReady" + }, + { + "stage": "plan", + "status": "current" + }, + { + "stage": "specify", + "status": "current" + }, + { + "stage": "tasks", + "status": "current" + } + ] + }, + "taskGraph": { + "taskCount": 10, + "dependencyCount": 7, + "dependenciesValid": true, + "statusesValid": true, + "findingIds": [] + }, + "evidenceDispositions": [ + { + "id": "ED-EV001", + "obligationId": "EV001", + "state": "supported", + "observed": true, + "classifiedRequirement": false, + "journeyRequirement": false, + "recordRequirement": false, + "evidenceIds": [ + "EV001" + ], + "affectedTaskIds": [ + "T001" + ], + "affectedSourceIds": [ + "AC-001", + "FR-001", + "PD-001" + ], + "severity": "ready", + "diagnosticIds": [], + "correction": "" + }, + { + "id": "ED-EV002", + "obligationId": "EV002", + "state": "supported", + "observed": true, + "classifiedRequirement": false, + "journeyRequirement": false, + "recordRequirement": false, + "evidenceIds": [ + "EV002" + ], + "affectedTaskIds": [ + "T002" + ], + "affectedSourceIds": [ + "AC-001", + "FR-002", + "PD-002" + ], + "severity": "ready", + "diagnosticIds": [], + "correction": "" + }, + { + "id": "ED-EV003", + "obligationId": "EV003", + "state": "supported", + "observed": true, + "classifiedRequirement": false, + "journeyRequirement": false, + "recordRequirement": false, + "evidenceIds": [ + "EV003" + ], + "affectedTaskIds": [ + "T003" + ], + "affectedSourceIds": [ + "AC-001", + "FR-003", + "PD-003" + ], + "severity": "ready", + "diagnosticIds": [], + "correction": "" + }, + { + "id": "ED-EV004", + "obligationId": "EV004", + "state": "supported", + "observed": true, + "classifiedRequirement": false, + "journeyRequirement": false, + "recordRequirement": false, + "evidenceIds": [ + "EV004" + ], + "affectedTaskIds": [ + "T004" + ], + "affectedSourceIds": [ + "DEC-001" + ], + "severity": "ready", + "diagnosticIds": [], + "correction": "" + }, + { + "id": "ED-EV005", + "obligationId": "EV005", + "state": "supported", + "observed": true, + "classifiedRequirement": false, + "journeyRequirement": false, + "recordRequirement": false, + "evidenceIds": [ + "EV005" + ], + "affectedTaskIds": [ + "T005" + ], + "affectedSourceIds": [ + "DEC-002" + ], + "severity": "ready", + "diagnosticIds": [], + "correction": "" + }, + { + "id": "ED-EV006", + "obligationId": "EV006", + "state": "supported", + "observed": true, + "classifiedRequirement": false, + "journeyRequirement": false, + "recordRequirement": false, + "evidenceIds": [ + "EV006" + ], + "affectedTaskIds": [ + "T006" + ], + "affectedSourceIds": [ + "DEC-003" + ], + "severity": "ready", + "diagnosticIds": [], + "correction": "" + }, + { + "id": "ED-EV007", + "obligationId": "EV007", + "state": "supported", + "observed": true, + "classifiedRequirement": false, + "journeyRequirement": false, + "recordRequirement": false, + "evidenceIds": [ + "EV007" + ], + "affectedTaskIds": [ + "T007" + ], + "affectedSourceIds": [ + "PC-001", + "PD-001" + ], + "severity": "ready", + "diagnosticIds": [], + "correction": "" + }, + { + "id": "ED-EV008", + "obligationId": "EV008", + "state": "supported", + "observed": true, + "classifiedRequirement": false, + "journeyRequirement": false, + "recordRequirement": false, + "evidenceIds": [ + "EV008" + ], + "affectedTaskIds": [ + "T008" + ], + "affectedSourceIds": [ + "PC-001", + "PD-001", + "VO-001" + ], + "severity": "ready", + "diagnosticIds": [], + "correction": "" + }, + { + "id": "ED-EV009", + "obligationId": "EV009", + "state": "supported", + "observed": true, + "classifiedRequirement": false, + "journeyRequirement": false, + "recordRequirement": false, + "evidenceIds": [ + "EV009" + ], + "affectedTaskIds": [ + "T009" + ], + "affectedSourceIds": [ + "PC-001", + "PM-001" + ], + "severity": "ready", + "diagnosticIds": [], + "correction": "" + }, + { + "id": "ED-EV010", + "obligationId": "EV010", + "state": "supported", + "observed": true, + "classifiedRequirement": false, + "journeyRequirement": false, + "recordRequirement": false, + "evidenceIds": [ + "EV010" + ], + "affectedTaskIds": [ + "T010" + ], + "affectedSourceIds": [ + "GV-001", + "PD-001" + ], + "severity": "ready", + "diagnosticIds": [], + "correction": "" + } + ], + "testDispositions": [ + { + "id": "TD-EV001", + "obligationId": "EV001", + "state": "satisfied", + "observed": true, + "recordRequirement": false, + "evidenceIds": [ + "EV001" + ], + "affectedTaskIds": [ + "T001" + ], + "affectedRequirementIds": [ + "FR-001" + ], + "severity": "ready", + "diagnosticIds": [], + "correction": "" + }, + { + "id": "TD-EV002", + "obligationId": "EV002", + "state": "satisfied", + "observed": true, + "recordRequirement": false, + "evidenceIds": [ + "EV002" + ], + "affectedTaskIds": [ + "T002" + ], + "affectedRequirementIds": [ + "FR-002" + ], + "severity": "ready", + "diagnosticIds": [], + "correction": "" + }, + { + "id": "TD-EV003", + "obligationId": "EV003", + "state": "satisfied", + "observed": true, + "recordRequirement": false, + "evidenceIds": [ + "EV003" + ], + "affectedTaskIds": [ + "T003" + ], + "affectedRequirementIds": [ + "FR-003" + ], + "severity": "ready", + "diagnosticIds": [], + "correction": "" + }, + { + "id": "TD-EV004", + "obligationId": "EV004", + "state": "satisfied", + "observed": true, + "recordRequirement": false, + "evidenceIds": [ + "EV004" + ], + "affectedTaskIds": [ + "T004" + ], + "affectedRequirementIds": [], + "severity": "ready", + "diagnosticIds": [], + "correction": "" + }, + { + "id": "TD-EV005", + "obligationId": "EV005", + "state": "satisfied", + "observed": true, + "recordRequirement": false, + "evidenceIds": [ + "EV005" + ], + "affectedTaskIds": [ + "T005" + ], + "affectedRequirementIds": [], + "severity": "ready", + "diagnosticIds": [], + "correction": "" + }, + { + "id": "TD-EV006", + "obligationId": "EV006", + "state": "satisfied", + "observed": true, + "recordRequirement": false, + "evidenceIds": [ + "EV006" + ], + "affectedTaskIds": [ + "T006" + ], + "affectedRequirementIds": [], + "severity": "ready", + "diagnosticIds": [], + "correction": "" + }, + { + "id": "TD-EV007", + "obligationId": "EV007", + "state": "satisfied", + "observed": true, + "recordRequirement": false, + "evidenceIds": [ + "EV007" + ], + "affectedTaskIds": [ + "T007" + ], + "affectedRequirementIds": [], + "severity": "ready", + "diagnosticIds": [], + "correction": "" + }, + { + "id": "TD-EV008", + "obligationId": "EV008", + "state": "satisfied", + "observed": true, + "recordRequirement": false, + "evidenceIds": [ + "EV008" + ], + "affectedTaskIds": [ + "T008" + ], + "affectedRequirementIds": [], + "severity": "ready", + "diagnosticIds": [], + "correction": "" + }, + { + "id": "TD-EV009", + "obligationId": "EV009", + "state": "satisfied", + "observed": true, + "recordRequirement": false, + "evidenceIds": [ + "EV009" + ], + "affectedTaskIds": [ + "T009" + ], + "affectedRequirementIds": [], + "severity": "ready", + "diagnosticIds": [], + "correction": "" + }, + { + "id": "TD-EV010", + "obligationId": "EV010", + "state": "satisfied", + "observed": true, + "recordRequirement": false, + "evidenceIds": [ + "EV010" + ], + "affectedTaskIds": [ + "T010" + ], + "affectedRequirementIds": [], + "severity": "ready", + "diagnosticIds": [], + "correction": "" + } + ], + "skillVisibility": [ + { + "skill": "automated-tests", + "requiringTaskIds": [ + "T008" + ], + "visibility": "visible", + "sourceArtifactPath": "work/2723-fence-arming-premise-rot/tasks.yml", + "severity": "ready", + "diagnosticIds": [], + "correction": "" + }, + { + "skill": "deterministic-json", + "requiringTaskIds": [ + "T010" + ], + "visibility": "visible", + "sourceArtifactPath": "work/2723-fence-arming-premise-rot/tasks.yml", + "severity": "ready", + "diagnosticIds": [], + "correction": "" + }, + { + "skill": "fsharp", + "requiringTaskIds": [ + "T001", + "T002", + "T003", + "T004", + "T005", + "T006", + "T007" + ], + "visibility": "visible", + "sourceArtifactPath": "work/2723-fence-arming-premise-rot/tasks.yml", + "severity": "ready", + "diagnosticIds": [], + "correction": "" + }, + { + "skill": "implementation", + "requiringTaskIds": [ + "T001", + "T002", + "T003", + "T004", + "T005", + "T006" + ], + "visibility": "visible", + "sourceArtifactPath": "work/2723-fence-arming-premise-rot/tasks.yml", + "severity": "ready", + "diagnosticIds": [], + "correction": "" + }, + { + "skill": "readiness-evidence", + "requiringTaskIds": [ + "T008" + ], + "visibility": "visible", + "sourceArtifactPath": "work/2723-fence-arming-premise-rot/tasks.yml", + "severity": "ready", + "diagnosticIds": [], + "correction": "" + }, + { + "skill": "schema-versioning", + "requiringTaskIds": [ + "T009" + ], + "visibility": "visible", + "sourceArtifactPath": "work/2723-fence-arming-premise-rot/tasks.yml", + "severity": "ready", + "diagnosticIds": [], + "correction": "" + } + ], + "generatedViews": [ + { + "path": "readiness/2723-fence-arming-premise-rot/analysis.json", + "kind": "verification", + "currency": "current", + "diagnosticIds": [] + }, + { + "path": "readiness/2723-fence-arming-premise-rot/work-model.json", + "kind": "workModel", + "currency": "current", + "diagnosticIds": [] + } + ], + "findings": [], + "governanceCompatibility": [ + { + "path": ".fsgg/policy.yml", + "relationship": "optionalGovernancePolicy", + "requiredBySdd": false, + "state": "notEvaluated", + "diagnosticIds": [] + }, + { + "path": ".fsgg/capabilities.yml", + "relationship": "optionalGovernanceCapabilities", + "requiredBySdd": false, + "state": "notEvaluated", + "diagnosticIds": [] + }, + { + "path": ".fsgg/tooling.yml", + "relationship": "optionalGovernanceTooling", + "requiredBySdd": false, + "state": "notEvaluated", + "diagnosticIds": [] + } + ], + "diagnostics": [], + "readiness": "verificationReady", + "nextAction": { + "actionId": "verify.next.ship", + "command": null, + "reason": "Verification readiness is current and ready for ship." + } +} \ No newline at end of file diff --git a/readiness/2723-fence-arming-premise-rot/work-model.json b/readiness/2723-fence-arming-premise-rot/work-model.json new file mode 100644 index 000000000..a0e581d33 --- /dev/null +++ b/readiness/2723-fence-arming-premise-rot/work-model.json @@ -0,0 +1,869 @@ +{ + "schemaVersion": 1, + "modelVersion": "1.2.0", + "workId": "2723-fence-arming-premise-rot", + "project": { + "id": ".github-2127", + "defaultWorkRoot": "work", + "profile": null + }, + "sources": [ + { + "path": ".fsgg/agents.yml", + "kind": "agentsConfig", + "owner": "sdd", + "schemaVersion": 1, + "rawSchemaVersion": "1", + "schemaStatus": "current", + "sourceDigest": { + "algorithm": "sha256", + "value": "c67035b1cf31b6fa802c10f761eeb1e5bf5d198c38d159b54fac299957b5aac3" + } + }, + { + "path": ".fsgg/project.yml", + "kind": "projectConfig", + "owner": "sdd", + "schemaVersion": 1, + "rawSchemaVersion": "1", + "schemaStatus": "current", + "sourceDigest": { + "algorithm": "sha256", + "value": "ef78f002b33ce22f738bac2c0dbf716db729a7d3ae3e4a68a4ce4b93810ced66" + } + }, + { + "path": ".fsgg/sdd.yml", + "kind": "sddConfig", + "owner": "sdd", + "schemaVersion": 1, + "rawSchemaVersion": "1", + "schemaStatus": "current", + "sourceDigest": { + "algorithm": "sha256", + "value": "fe5a7c270a975153e80ab0d08a610c9b302585dcb0b5f7c654841ceced9272cb" + } + }, + { + "path": "work/2723-fence-arming-premise-rot/checklist.md", + "kind": "checklist", + "owner": "sdd", + "schemaVersion": 1, + "rawSchemaVersion": "1", + "schemaStatus": "current", + "sourceDigest": { + "algorithm": "sha256", + "value": "102e2b9535d2ab976eb0229a4f2c72ef9e85c5d494233da28306a6d65d801fa9" + } + }, + { + "path": "work/2723-fence-arming-premise-rot/clarifications.md", + "kind": "clarifications", + "owner": "sdd", + "schemaVersion": 1, + "rawSchemaVersion": "1", + "schemaStatus": "current", + "sourceDigest": { + "algorithm": "sha256", + "value": "d14483cfd6a8cf8e3c82b47a730cbc158c4e5382b7a63802b901062b84caf842" + } + }, + { + "path": "work/2723-fence-arming-premise-rot/evidence.yml", + "kind": "evidence", + "owner": "sdd", + "schemaVersion": 1, + "rawSchemaVersion": "1", + "schemaStatus": "current", + "sourceDigest": { + "algorithm": "sha256", + "value": "81a7e3c234baafcb8eb48924bf99162c189899e38de510569419587c16f70da7" + } + }, + { + "path": "work/2723-fence-arming-premise-rot/plan.md", + "kind": "plan", + "owner": "sdd", + "schemaVersion": 1, + "rawSchemaVersion": "1", + "schemaStatus": "current", + "sourceDigest": { + "algorithm": "sha256", + "value": "0eb6e6700f912065c2986475dde1fa59d2a7eb9ff58dcb660285061018212877" + } + }, + { + "path": "work/2723-fence-arming-premise-rot/spec.md", + "kind": "spec", + "owner": "sdd", + "schemaVersion": 1, + "rawSchemaVersion": "1", + "schemaStatus": "current", + "sourceDigest": { + "algorithm": "sha256", + "value": "29f2cb8a7ec153c14b98f7c1bc63db3b2b1b72dfa71d3c98409659fa8473abdf" + } + }, + { + "path": "work/2723-fence-arming-premise-rot/tasks.yml", + "kind": "tasks", + "owner": "sdd", + "schemaVersion": 1, + "rawSchemaVersion": "1", + "schemaStatus": "current", + "sourceDigest": { + "algorithm": "sha256", + "value": "476b7455c315389f9701220eeac136770247ed15c187ab2d7191224a7a2991c7" + } + } + ], + "workItem": { + "id": "2723-fence-arming-premise-rot", + "title": "Arm merge fence and repair repos.sh premise drift", + "stage": "specify", + "changeTier": "tier1", + "status": "specified" + }, + "performanceIntent": null, + "requirements": [ + { + "id": "FR-001", + "title": "Before any apply, observe the exact claim-fence context on a real pull request, prove it statically producible, confirm a full 120-minute observe-only window, census every open item pull request for a current authorization marker, record the merge-queue decision, dry-run each target, then apply hub-first and per receiver with read-back. (Stories: US-001; Acceptance: AC-001)", + "text": "Before any apply, observe the exact claim-fence context on a real pull request, prove it statically producible, confirm a full 120-minute observe-only window, census every open item pull request for a current authorization marker, record the merge-queue decision, dry-run each target, then apply hub-first and per receiver with read-back. (Stories: US-001; Acceptance: AC-001)", + "acceptanceCriteria": [ + "AC-001" + ], + "priority": null, + "classification": [], + "source": "work/2723-fence-arming-premise-rot/spec.md", + "sourceLocation": { + "line": 31, + "column": 1 + }, + "linkedTaskIds": [ + "T001" + ], + "linkedEvidenceIds": [ + "EV001" + ] + }, + { + "id": "FR-002", + "title": "The documentation must name exact immutable evidence for each arming precondition, per-repository result, accepted residual, and rollback sequence. (Stories: US-001; Acceptance: AC-001)", + "text": "The documentation must name exact immutable evidence for each arming precondition, per-repository result, accepted residual, and rollback sequence. (Stories: US-001; Acceptance: AC-001)", + "acceptanceCriteria": [ + "AC-001" + ], + "priority": null, + "classification": [], + "source": "work/2723-fence-arming-premise-rot/spec.md", + "sourceLocation": { + "line": 32, + "column": 1 + }, + "linkedTaskIds": [ + "T002" + ], + "linkedEvidenceIds": [ + "EV002" + ] + }, + { + "id": "FR-003", + "title": "The scripts/repos.sh credential guidance must state the current App administration:write capability without implying that a workflow GITHUB_TOKEN can hold it. (Stories: US-001; Acceptance: AC-001)", + "text": "The scripts/repos.sh credential guidance must state the current App administration:write capability without implying that a workflow GITHUB_TOKEN can hold it. (Stories: US-001; Acceptance: AC-001)", + "acceptanceCriteria": [ + "AC-001" + ], + "priority": null, + "classification": [], + "source": "work/2723-fence-arming-premise-rot/spec.md", + "sourceLocation": { + "line": 33, + "column": 1 + }, + "linkedTaskIds": [ + "T003" + ], + "linkedEvidenceIds": [ + "EV003" + ] + } + ], + "decisions": [ + { + "id": "DEC-001", + "title": "Arm only repositories for which the exact context is both observed on a real pull request", + "decision": "Arm only repositories for which the exact context is both observed on a real pull request", + "requirementRefs": [], + "storyRefs": [], + "acceptanceRefs": [], + "source": "work/2723-fence-arming-premise-rot/clarifications.md", + "sourceLocation": { + "line": 31, + "column": 1 + }, + "linkedTaskIds": [ + "T004" + ] + }, + { + "id": "DEC-002", + "title": "Record \u0060merge queue disabled; accepted stale-green residual\u0060 for \u0060.github\u0060 rather than", + "decision": "Record \u0060merge queue disabled; accepted stale-green residual\u0060 for \u0060.github\u0060 rather than", + "requirementRefs": [], + "storyRefs": [], + "acceptanceRefs": [], + "source": "work/2723-fence-arming-premise-rot/clarifications.md", + "sourceLocation": { + "line": 33, + "column": 1 + }, + "linkedTaskIds": [ + "T005" + ] + }, + { + "id": "DEC-003", + "title": "Declare the administrative arming write as a post-merge obligation and verify the exact", + "decision": "Declare the administrative arming write as a post-merge obligation and verify the exact", + "requirementRefs": [], + "storyRefs": [], + "acceptanceRefs": [], + "source": "work/2723-fence-arming-premise-rot/clarifications.md", + "sourceLocation": { + "line": 35, + "column": 1 + }, + "linkedTaskIds": [ + "T006" + ] + } + ], + "tasks": [ + { + "id": "T001", + "title": "Implement requirement FR-001", + "status": "done", + "owner": "sdd", + "dependencies": [], + "requirements": [ + "FR-001" + ], + "decisions": [], + "sourceIds": [ + "AC-001", + "FR-001", + "PD-001" + ], + "requiredSkills": [ + "fsharp", + "implementation" + ], + "requiredEvidence": [ + "EV001" + ], + "source": "work/2723-fence-arming-premise-rot/tasks.yml", + "sourceLocation": { + "line": 1, + "column": 1 + } + }, + { + "id": "T002", + "title": "Implement requirement FR-002", + "status": "done", + "owner": "sdd", + "dependencies": [], + "requirements": [ + "FR-002" + ], + "decisions": [], + "sourceIds": [ + "AC-001", + "FR-002", + "PD-002" + ], + "requiredSkills": [ + "fsharp", + "implementation" + ], + "requiredEvidence": [ + "EV002" + ], + "source": "work/2723-fence-arming-premise-rot/tasks.yml", + "sourceLocation": { + "line": 2, + "column": 1 + } + }, + { + "id": "T003", + "title": "Implement requirement FR-003", + "status": "done", + "owner": "sdd", + "dependencies": [], + "requirements": [ + "FR-003" + ], + "decisions": [], + "sourceIds": [ + "AC-001", + "FR-003", + "PD-003" + ], + "requiredSkills": [ + "fsharp", + "implementation" + ], + "requiredEvidence": [ + "EV003" + ], + "source": "work/2723-fence-arming-premise-rot/tasks.yml", + "sourceLocation": { + "line": 3, + "column": 1 + } + }, + { + "id": "T004", + "title": "Implement clarification decision DEC-001", + "status": "done", + "owner": "sdd", + "dependencies": [ + "T001" + ], + "requirements": [], + "decisions": [ + "DEC-001" + ], + "sourceIds": [ + "DEC-001" + ], + "requiredSkills": [ + "fsharp", + "implementation" + ], + "requiredEvidence": [ + "EV004" + ], + "source": "work/2723-fence-arming-premise-rot/tasks.yml", + "sourceLocation": { + "line": 4, + "column": 1 + } + }, + { + "id": "T005", + "title": "Implement clarification decision DEC-002", + "status": "done", + "owner": "sdd", + "dependencies": [ + "T001" + ], + "requirements": [], + "decisions": [ + "DEC-002" + ], + "sourceIds": [ + "DEC-002" + ], + "requiredSkills": [ + "fsharp", + "implementation" + ], + "requiredEvidence": [ + "EV005" + ], + "source": "work/2723-fence-arming-premise-rot/tasks.yml", + "sourceLocation": { + "line": 5, + "column": 1 + } + }, + { + "id": "T006", + "title": "Implement clarification decision DEC-003", + "status": "done", + "owner": "sdd", + "dependencies": [ + "T001" + ], + "requirements": [], + "decisions": [ + "DEC-003" + ], + "sourceIds": [ + "DEC-003" + ], + "requiredSkills": [ + "fsharp", + "implementation" + ], + "requiredEvidence": [ + "EV006" + ], + "source": "work/2723-fence-arming-premise-rot/tasks.yml", + "sourceLocation": { + "line": 6, + "column": 1 + } + }, + { + "id": "T007", + "title": "Update contract surface PC-001", + "status": "done", + "owner": "sdd", + "dependencies": [ + "T001" + ], + "requirements": [], + "decisions": [], + "sourceIds": [ + "PC-001", + "PD-001" + ], + "requiredSkills": [ + "fsharp" + ], + "requiredEvidence": [ + "EV007" + ], + "source": "work/2723-fence-arming-premise-rot/tasks.yml", + "sourceLocation": { + "line": 7, + "column": 1 + } + }, + { + "id": "T008", + "title": "Record verification evidence VO-001", + "status": "done", + "owner": "sdd", + "dependencies": [ + "T001" + ], + "requirements": [], + "decisions": [], + "sourceIds": [ + "PC-001", + "PD-001", + "VO-001" + ], + "requiredSkills": [ + "automated-tests", + "readiness-evidence" + ], + "requiredEvidence": [ + "EV008" + ], + "source": "work/2723-fence-arming-premise-rot/tasks.yml", + "sourceLocation": { + "line": 8, + "column": 1 + } + }, + { + "id": "T009", + "title": "Handle migration posture PM-001", + "status": "done", + "owner": "sdd", + "dependencies": [ + "T001" + ], + "requirements": [], + "decisions": [], + "sourceIds": [ + "PC-001", + "PM-001" + ], + "requiredSkills": [ + "schema-versioning" + ], + "requiredEvidence": [ + "EV009" + ], + "source": "work/2723-fence-arming-premise-rot/tasks.yml", + "sourceLocation": { + "line": 9, + "column": 1 + } + }, + { + "id": "T010", + "title": "Refresh generated view impact GV-001", + "status": "done", + "owner": "sdd", + "dependencies": [ + "T001" + ], + "requirements": [], + "decisions": [], + "sourceIds": [ + "GV-001", + "PD-001" + ], + "requiredSkills": [ + "deterministic-json" + ], + "requiredEvidence": [ + "EV010" + ], + "source": "work/2723-fence-arming-premise-rot/tasks.yml", + "sourceLocation": { + "line": 10, + "column": 1 + } + } + ], + "evidence": [ + { + "id": "EV001", + "kind": "verification", + "subjectType": "task", + "subjectId": "T001", + "taskRefs": [ + "T001" + ], + "requirementRefs": [ + "FR-001" + ], + "artifactRefs": [ + "docs/coordination/reusable-workflow-contract.md", + "scripts/repos.sh" + ], + "result": "pass", + "synthetic": false, + "performanceBudget": null, + "performanceEvidenceArtifact": null, + "performanceMeasurements": [], + "rationale": null, + "source": "work/2723-fence-arming-premise-rot/evidence.yml", + "sourceLocation": { + "line": 1, + "column": 1 + } + }, + { + "id": "EV002", + "kind": "verification", + "subjectType": "task", + "subjectId": "T002", + "taskRefs": [ + "T002" + ], + "requirementRefs": [ + "FR-002" + ], + "artifactRefs": [ + "docs/coordination/reusable-workflow-contract.md", + "scripts/repos.sh" + ], + "result": "pass", + "synthetic": false, + "performanceBudget": null, + "performanceEvidenceArtifact": null, + "performanceMeasurements": [], + "rationale": null, + "source": "work/2723-fence-arming-premise-rot/evidence.yml", + "sourceLocation": { + "line": 2, + "column": 1 + } + }, + { + "id": "EV003", + "kind": "verification", + "subjectType": "task", + "subjectId": "T003", + "taskRefs": [ + "T003" + ], + "requirementRefs": [ + "FR-003" + ], + "artifactRefs": [ + "docs/coordination/reusable-workflow-contract.md", + "scripts/repos.sh" + ], + "result": "pass", + "synthetic": false, + "performanceBudget": null, + "performanceEvidenceArtifact": null, + "performanceMeasurements": [], + "rationale": null, + "source": "work/2723-fence-arming-premise-rot/evidence.yml", + "sourceLocation": { + "line": 3, + "column": 1 + } + }, + { + "id": "EV004", + "kind": "verification", + "subjectType": "task", + "subjectId": "T004", + "taskRefs": [ + "T004" + ], + "requirementRefs": [], + "artifactRefs": [ + "docs/coordination/reusable-workflow-contract.md", + "scripts/repos.sh" + ], + "result": "pass", + "synthetic": false, + "performanceBudget": null, + "performanceEvidenceArtifact": null, + "performanceMeasurements": [], + "rationale": null, + "source": "work/2723-fence-arming-premise-rot/evidence.yml", + "sourceLocation": { + "line": 4, + "column": 1 + } + }, + { + "id": "EV005", + "kind": "verification", + "subjectType": "task", + "subjectId": "T005", + "taskRefs": [ + "T005" + ], + "requirementRefs": [], + "artifactRefs": [ + "docs/coordination/reusable-workflow-contract.md", + "scripts/repos.sh" + ], + "result": "pass", + "synthetic": false, + "performanceBudget": null, + "performanceEvidenceArtifact": null, + "performanceMeasurements": [], + "rationale": null, + "source": "work/2723-fence-arming-premise-rot/evidence.yml", + "sourceLocation": { + "line": 5, + "column": 1 + } + }, + { + "id": "EV006", + "kind": "verification", + "subjectType": "task", + "subjectId": "T006", + "taskRefs": [ + "T006" + ], + "requirementRefs": [], + "artifactRefs": [ + "docs/coordination/reusable-workflow-contract.md", + "scripts/repos.sh" + ], + "result": "pass", + "synthetic": false, + "performanceBudget": null, + "performanceEvidenceArtifact": null, + "performanceMeasurements": [], + "rationale": null, + "source": "work/2723-fence-arming-premise-rot/evidence.yml", + "sourceLocation": { + "line": 6, + "column": 1 + } + }, + { + "id": "EV007", + "kind": "verification", + "subjectType": "task", + "subjectId": "T007", + "taskRefs": [ + "T007" + ], + "requirementRefs": [], + "artifactRefs": [ + "docs/coordination/reusable-workflow-contract.md", + "scripts/repos.sh" + ], + "result": "pass", + "synthetic": false, + "performanceBudget": null, + "performanceEvidenceArtifact": null, + "performanceMeasurements": [], + "rationale": null, + "source": "work/2723-fence-arming-premise-rot/evidence.yml", + "sourceLocation": { + "line": 7, + "column": 1 + } + }, + { + "id": "EV008", + "kind": "verification", + "subjectType": "task", + "subjectId": "T008", + "taskRefs": [ + "T008" + ], + "requirementRefs": [], + "artifactRefs": [ + "docs/coordination/reusable-workflow-contract.md", + "scripts/repos.sh" + ], + "result": "pass", + "synthetic": false, + "performanceBudget": null, + "performanceEvidenceArtifact": null, + "performanceMeasurements": [], + "rationale": null, + "source": "work/2723-fence-arming-premise-rot/evidence.yml", + "sourceLocation": { + "line": 8, + "column": 1 + } + }, + { + "id": "EV009", + "kind": "verification", + "subjectType": "task", + "subjectId": "T009", + "taskRefs": [ + "T009" + ], + "requirementRefs": [], + "artifactRefs": [ + "docs/coordination/reusable-workflow-contract.md", + "scripts/repos.sh" + ], + "result": "pass", + "synthetic": false, + "performanceBudget": null, + "performanceEvidenceArtifact": null, + "performanceMeasurements": [], + "rationale": null, + "source": "work/2723-fence-arming-premise-rot/evidence.yml", + "sourceLocation": { + "line": 9, + "column": 1 + } + }, + { + "id": "EV010", + "kind": "verification", + "subjectType": "task", + "subjectId": "T010", + "taskRefs": [ + "T010" + ], + "requirementRefs": [], + "artifactRefs": [ + "docs/coordination/reusable-workflow-contract.md", + "scripts/repos.sh" + ], + "result": "pass", + "synthetic": false, + "performanceBudget": null, + "performanceEvidenceArtifact": null, + "performanceMeasurements": [], + "rationale": null, + "source": "work/2723-fence-arming-premise-rot/evidence.yml", + "sourceLocation": { + "line": 10, + "column": 1 + } + } + ], + "generatedViews": [ + { + "path": "readiness/2723-fence-arming-premise-rot/work-model.json", + "kind": "workModel", + "schemaVersion": 1, + "generator": { + "id": "FS.GG.SDD.Artifacts", + "version": "1.1.0" + }, + "sources": [ + { + "path": ".fsgg/agents.yml", + "digest": { + "algorithm": "sha256", + "value": "c67035b1cf31b6fa802c10f761eeb1e5bf5d198c38d159b54fac299957b5aac3" + }, + "schemaVersion": 1 + }, + { + "path": ".fsgg/project.yml", + "digest": { + "algorithm": "sha256", + "value": "ef78f002b33ce22f738bac2c0dbf716db729a7d3ae3e4a68a4ce4b93810ced66" + }, + "schemaVersion": 1 + }, + { + "path": ".fsgg/sdd.yml", + "digest": { + "algorithm": "sha256", + "value": "fe5a7c270a975153e80ab0d08a610c9b302585dcb0b5f7c654841ceced9272cb" + }, + "schemaVersion": 1 + }, + { + "path": "work/2723-fence-arming-premise-rot/checklist.md", + "digest": { + "algorithm": "sha256", + "value": "102e2b9535d2ab976eb0229a4f2c72ef9e85c5d494233da28306a6d65d801fa9" + }, + "schemaVersion": 1 + }, + { + "path": "work/2723-fence-arming-premise-rot/clarifications.md", + "digest": { + "algorithm": "sha256", + "value": "d14483cfd6a8cf8e3c82b47a730cbc158c4e5382b7a63802b901062b84caf842" + }, + "schemaVersion": 1 + }, + { + "path": "work/2723-fence-arming-premise-rot/evidence.yml", + "digest": { + "algorithm": "sha256", + "value": "81a7e3c234baafcb8eb48924bf99162c189899e38de510569419587c16f70da7" + }, + "schemaVersion": 1 + }, + { + "path": "work/2723-fence-arming-premise-rot/plan.md", + "digest": { + "algorithm": "sha256", + "value": "0eb6e6700f912065c2986475dde1fa59d2a7eb9ff58dcb660285061018212877" + }, + "schemaVersion": 1 + }, + { + "path": "work/2723-fence-arming-premise-rot/spec.md", + "digest": { + "algorithm": "sha256", + "value": "29f2cb8a7ec153c14b98f7c1bc63db3b2b1b72dfa71d3c98409659fa8473abdf" + }, + "schemaVersion": 1 + }, + { + "path": "work/2723-fence-arming-premise-rot/tasks.yml", + "digest": { + "algorithm": "sha256", + "value": "476b7455c315389f9701220eeac136770247ed15c187ab2d7191224a7a2991c7" + }, + "schemaVersion": 1 + } + ], + "outputDigest": { + "algorithm": "sha256", + "value": "a56478f5a6654ae8858c3d9c0065874b7b8756d851ad88767795abe0ff501859" + }, + "currency": "current" + } + ], + "diagnostics": [], + "governanceBoundaries": [] +} \ No newline at end of file diff --git a/scripts/repos.sh b/scripts/repos.sh index fa392d3dc..75de5bbce 100755 --- a/scripts/repos.sh +++ b/scripts/repos.sh @@ -482,18 +482,17 @@ cmd_kit() { # removes from the classic store, and a ruleset may still require the context afterwards. Under- # promising is the safe direction for a removal. # -# CREDENTIAL, MEASURED 2026-07-28, AND THIS IS NOT AUTOMATION YET. Reading protection needs +# CREDENTIAL, RE-MEASURED 2026-08-22, AND THIS IS NOT A WORKFLOW TOKEN. Reading protection needs # `administration: read`; writing needs `administration: write`. NEITHER is a valid `permissions:` # scope for a workflow's GITHUB_TOKEN — declaring one is a startup validation error that produces no -# check run at all (#478's blind spot, hit for real by #1575). The org dispatch App holds -# `administration: READ` (the #574 org grant, 2026-07-17) and that is what -# required-context-coherence.yml mints. **No credential in this org can run the APPLY path today**: -# raising the App's grant to `administration: write` is an org-owner action, not a change in this -# repo. So this ships as an OPERATOR tool driven by a `GH_TOKEN` that carries the scope (an App token -# minted from a raised grant, or a human PAT with admin on the target repos), and it says so when the -# token cannot: a 403 on the write is reported as "this token lacks administration: write on ", -# never as a generic outage. The DRY RUN needs only `administration: read`, so it is runnable from the -# existing App grant today and is the half that can be automated now. +# check run at all (#478's blind spot, hit for real by #1575). The org dispatch App installation now +# holds `administration: write` (the #1712 grant), so a repository-scoped installation token minted +# from that App CAN run the apply path; required-context-coherence.yml keeps minting only the narrower +# `administration: read` token its audit needs. This remains an OPERATOR tool driven by a `GH_TOKEN` +# that carries the scope (that installation token, or a human PAT with admin on the target repos), and +# it says so when the token cannot: a 403 on the write is reported as "this token lacks +# administration: write on ", never as a generic outage. The DRY RUN needs only +# `administration: read`, so it remains available to the narrower audit credential. # # DRY RUN BY DEFAULT, READ BACK ALWAYS, FAIL CLOSED ON PARTIAL APPLICATION. Nothing is written without # `--apply`. After every write the contexts are RE-READ and compared against the exact expected set — diff --git a/work/2723-fence-arming-premise-rot/charter.md b/work/2723-fence-arming-premise-rot/charter.md new file mode 100644 index 000000000..3d59086c2 --- /dev/null +++ b/work/2723-fence-arming-premise-rot/charter.md @@ -0,0 +1,44 @@ +--- +schemaVersion: 1 +workId: 2723-fence-arming-premise-rot +title: Arm merge fence and repair repos.sh premise drift +stage: charter +changeTier: tier1 +status: chartered +policyPointers: + - .fsgg/sdd.yml + - .fsgg/agents.yml + - .fsgg/policy.yml + - .fsgg/capabilities.yml + - .fsgg/tooling.yml +--- + +# Arm merge fence and repair repos.sh premise drift Charter + +## Identity +- Work id: `2723-fence-arming-premise-rot` +- Lifecycle stage: charter +- Status: chartered + +## Principles +- Arm no required context until its producer has reported on a real pull request and static + producibility has been demonstrated for the exact context. +- Preserve a fail-closed merge fence: authorization failures and unreadable live state block once + armed; unrelated pull requests receive a real passing check rather than a missing context. +- Treat branch-protection changes as per-repository, read-back-verified operations with an explicit + rollback order. + +## Scope Boundaries +- Repair the stale credential premise in `scripts/repos.sh`. +- Record the arming evidence, receiver decisions, residuals, and rollback contract in + `docs/coordination/reusable-workflow-contract.md`. +- Apply the required-context transition only after all five design steps are evidenced; do not enable + merge queues implicitly and do not alter the fence producer in this slice. +- Keep SDD lifecycle ownership separate from optional Governance enforcement. + +## Policy Pointers +- SDD policy comes from `.fsgg/sdd.yml` and `.fsgg/agents.yml`. +- Governance files are optional compatibility pointers and are not evaluated by this command. + +## Lifecycle Notes +- Next lifecycle action: `fsgg-sdd specify --work 2723-fence-arming-premise-rot`. diff --git a/work/2723-fence-arming-premise-rot/checklist.md b/work/2723-fence-arming-premise-rot/checklist.md new file mode 100644 index 000000000..d419d6fa5 --- /dev/null +++ b/work/2723-fence-arming-premise-rot/checklist.md @@ -0,0 +1,49 @@ +--- +schemaVersion: 1 +workId: 2723-fence-arming-premise-rot +title: Fence Arming Premise Rot +stage: checklist +changeTier: tier1 +status: checklistReady +sourceSpec: work/2723-fence-arming-premise-rot/spec.md +sourceClarifications: work/2723-fence-arming-premise-rot/clarifications.md +publicOrToolFacingImpact: true +--- + +# Fence Arming Premise Rot Checklist + +Prose status: checklistReady + +## Source Specification +- work/2723-fence-arming-premise-rot/spec.md + +## Source Clarifications +- work/2723-fence-arming-premise-rot/clarifications.md + +## Source Snapshot +- spec: work/2723-fence-arming-premise-rot/spec.md sha256:29f2cb8a7ec153c14b98f7c1bc63db3b2b1b72dfa71d3c98409659fa8473abdf schemaVersion:1 +- clarifications: work/2723-fence-arming-premise-rot/clarifications.md sha256:d14483cfd6a8cf8e3c82b47a730cbc158c4e5382b7a63802b901062b84caf842 schemaVersion:1 + +## Checklist Items +- CHK-001 [FR-001] [AC-001] blocking: Requirement FR-001 is testable and linked to acceptance coverage. +- CHK-002 [FR-002] [AC-001] blocking: Requirement FR-002 is testable and linked to acceptance coverage. +- CHK-003 [FR-003] [AC-001] blocking: Requirement FR-003 is testable and linked to acceptance coverage. + +## Review Results +- CR-001 [CHK:CHK-001] [FR-001] [AC-001] pass: Requirement FR-001 is testable and linked to acceptance coverage. +- CR-002 [CHK:CHK-002] [FR-002] [AC-001] pass: Requirement FR-002 is testable and linked to acceptance coverage. +- CR-003 [CHK:CHK-003] [FR-003] [AC-001] pass: Requirement FR-003 is testable and linked to acceptance coverage. + +## Accepted Deferrals +No accepted checklist deferrals recorded. + +## Blocking Findings +No blocking findings recorded. + +## Advisory Notes +No advisory notes recorded. + +## Lifecycle Notes +- Specification requirements reviewed: 3. +- Clarification decisions reviewed: 3. +- Next lifecycle action: `fsgg-sdd plan --work 2723-fence-arming-premise-rot`. diff --git a/work/2723-fence-arming-premise-rot/clarifications.md b/work/2723-fence-arming-premise-rot/clarifications.md new file mode 100644 index 000000000..2d4fc1544 --- /dev/null +++ b/work/2723-fence-arming-premise-rot/clarifications.md @@ -0,0 +1,45 @@ +--- +schemaVersion: 1 +workId: 2723-fence-arming-premise-rot +title: Arm merge fence and repair repos.sh premise drift +stage: clarify +changeTier: tier1 +status: clarified +sourceSpec: work/2723-fence-arming-premise-rot/spec.md +publicOrToolFacingImpact: true +--- + +# Arm merge fence and repair repos.sh premise drift Clarifications + +## Source Specification +- work/2723-fence-arming-premise-rot/spec.md + +## Clarification Questions +- Q-001: Which repositories receive this fence, and is merge-queue enablement part of arming? +- Q-002: May the administrative branch-protection write occur before the implementation PR is + independently reviewed and merged? + +## Answers +- A-001: The producer exists only in `FS-GG/.github`, where the exact context is `claim-fence`. + Receiver repositories are not targets unless they independently contain and report that producer. + Merge-queue enablement remains a separate per-repository decision and is not performed here. +- A-002: No. The repository change first lands its reviewed procedure and evidence. The + branch-protection apply is a declared post-merge obligation, keeping the fence observe-only + throughout implementation review. + +## Decisions +- DEC-001: Arm only repositories for which the exact context is both observed on a real pull request + and statically producible; do not derive a fleet target from the coordination-kit receiver roster. +- DEC-002: Record `merge queue disabled; accepted stale-green residual` for `.github` rather than + silently enabling a queue that changes how every pull request merges. +- DEC-003: Declare the administrative arming write as a post-merge obligation and verify the exact + required-context set by read-back after applying it. + +## Accepted Deferrals +No accepted deferrals recorded. + +## Remaining Ambiguity +No blocking ambiguity remains. + +## Lifecycle Notes +- Next lifecycle action: `fsgg-sdd checklist --work 2723-fence-arming-premise-rot`. diff --git a/work/2723-fence-arming-premise-rot/evidence.yml b/work/2723-fence-arming-premise-rot/evidence.yml new file mode 100644 index 000000000..e7f51d7df --- /dev/null +++ b/work/2723-fence-arming-premise-rot/evidence.yml @@ -0,0 +1,308 @@ +schemaVersion: 1 +workId: 2723-fence-arming-premise-rot +stage: evidence +status: evidenceReady +sourceSpec: work/2723-fence-arming-premise-rot/spec.md +sourceClarifications: work/2723-fence-arming-premise-rot/clarifications.md +sourceChecklist: work/2723-fence-arming-premise-rot/checklist.md +sourcePlan: work/2723-fence-arming-premise-rot/plan.md +sourceTasks: work/2723-fence-arming-premise-rot/tasks.yml +sourceAnalysis: readiness/2723-fence-arming-premise-rot/analysis.json +sourceSnapshots: + - label: analysis + path: readiness/2723-fence-arming-premise-rot/analysis.json + digest: ece93425673043c5c48a2a0b60e9a43de52e917c991da213d1752ca319c46afe + schemaVersion: 1 + - label: checklist + path: work/2723-fence-arming-premise-rot/checklist.md + digest: 102e2b9535d2ab976eb0229a4f2c72ef9e85c5d494233da28306a6d65d801fa9 + schemaVersion: 1 + - label: clarifications + path: work/2723-fence-arming-premise-rot/clarifications.md + digest: d14483cfd6a8cf8e3c82b47a730cbc158c4e5382b7a63802b901062b84caf842 + schemaVersion: 1 + - label: plan + path: work/2723-fence-arming-premise-rot/plan.md + digest: 0eb6e6700f912065c2986475dde1fa59d2a7eb9ff58dcb660285061018212877 + schemaVersion: 1 + - label: spec + path: work/2723-fence-arming-premise-rot/spec.md + digest: 29f2cb8a7ec153c14b98f7c1bc63db3b2b1b72dfa71d3c98409659fa8473abdf + schemaVersion: 1 + - label: tasks + path: work/2723-fence-arming-premise-rot/tasks.yml + digest: 476b7455c315389f9701220eeac136770247ed15c187ab2d7191224a7a2991c7 + schemaVersion: 1 +evidence: + - id: EV001 + kind: verification + subject: + type: task + id: T001 + taskRefs: [T001] + requirementRefs: [FR-001] + acceptanceScenarioRefs: [] + clarificationDecisionRefs: [] + checklistResultRefs: [] + planDecisionRefs: [PD-001] + obligationRefs: [EV001] + artifacts: [docs/coordination/reusable-workflow-contract.md, scripts/repos.sh] + sourceRefs: + - kind: verification + path: tests/repos-registry/run.sh + result: pass + synthetic: false + observedRun: + source: work/2723-fence-arming-premise-rot/test-results/focused.xml + digest: "sha256:06a977740605f2e60f8dbd9c95452d0e30f070cc44d132084396fe5cc70f7090" + digestContract: exact-bytes-v1 + outcome: passed + passed: 2 + failed: 0 + skipped: 0 + notes: ["Focused shell fixtures and live arming measurements passed; administrative apply remains a declared post-merge obligation until the in-flight marker census clears."] + - id: EV002 + kind: verification + subject: + type: task + id: T002 + taskRefs: [T002] + requirementRefs: [FR-002] + acceptanceScenarioRefs: [] + clarificationDecisionRefs: [] + checklistResultRefs: [] + planDecisionRefs: [PD-002] + obligationRefs: [EV002] + artifacts: [docs/coordination/reusable-workflow-contract.md, scripts/repos.sh] + sourceRefs: + - kind: verification + path: tests/repos-registry/run.sh + result: pass + synthetic: false + observedRun: + source: work/2723-fence-arming-premise-rot/test-results/focused.xml + digest: "sha256:06a977740605f2e60f8dbd9c95452d0e30f070cc44d132084396fe5cc70f7090" + digestContract: exact-bytes-v1 + outcome: passed + passed: 2 + failed: 0 + skipped: 0 + notes: ["Focused shell fixtures and live arming measurements passed; administrative apply remains a declared post-merge obligation until the in-flight marker census clears."] + - id: EV003 + kind: verification + subject: + type: task + id: T003 + taskRefs: [T003] + requirementRefs: [FR-003] + acceptanceScenarioRefs: [] + clarificationDecisionRefs: [] + checklistResultRefs: [] + planDecisionRefs: [PD-003] + obligationRefs: [EV003] + artifacts: [docs/coordination/reusable-workflow-contract.md, scripts/repos.sh] + sourceRefs: + - kind: verification + path: tests/repos-registry/run.sh + result: pass + synthetic: false + observedRun: + source: work/2723-fence-arming-premise-rot/test-results/focused.xml + digest: "sha256:06a977740605f2e60f8dbd9c95452d0e30f070cc44d132084396fe5cc70f7090" + digestContract: exact-bytes-v1 + outcome: passed + passed: 2 + failed: 0 + skipped: 0 + notes: ["Focused shell fixtures and live arming measurements passed; administrative apply remains a declared post-merge obligation until the in-flight marker census clears."] + - id: EV004 + kind: verification + subject: + type: task + id: T004 + taskRefs: [T004] + requirementRefs: [] + acceptanceScenarioRefs: [] + clarificationDecisionRefs: [] + checklistResultRefs: [] + planDecisionRefs: [] + obligationRefs: [EV004] + artifacts: [docs/coordination/reusable-workflow-contract.md, scripts/repos.sh] + sourceRefs: + - kind: verification + path: tests/repos-registry/run.sh + result: pass + synthetic: false + observedRun: + source: work/2723-fence-arming-premise-rot/test-results/focused.xml + digest: "sha256:06a977740605f2e60f8dbd9c95452d0e30f070cc44d132084396fe5cc70f7090" + digestContract: exact-bytes-v1 + outcome: passed + passed: 2 + failed: 0 + skipped: 0 + notes: ["Focused shell fixtures and live arming measurements passed; administrative apply remains a declared post-merge obligation until the in-flight marker census clears."] + - id: EV005 + kind: verification + subject: + type: task + id: T005 + taskRefs: [T005] + requirementRefs: [] + acceptanceScenarioRefs: [] + clarificationDecisionRefs: [] + checklistResultRefs: [] + planDecisionRefs: [] + obligationRefs: [EV005] + artifacts: [docs/coordination/reusable-workflow-contract.md, scripts/repos.sh] + sourceRefs: + - kind: verification + path: tests/repos-registry/run.sh + result: pass + synthetic: false + observedRun: + source: work/2723-fence-arming-premise-rot/test-results/focused.xml + digest: "sha256:06a977740605f2e60f8dbd9c95452d0e30f070cc44d132084396fe5cc70f7090" + digestContract: exact-bytes-v1 + outcome: passed + passed: 2 + failed: 0 + skipped: 0 + notes: ["Focused shell fixtures and live arming measurements passed; administrative apply remains a declared post-merge obligation until the in-flight marker census clears."] + - id: EV006 + kind: verification + subject: + type: task + id: T006 + taskRefs: [T006] + requirementRefs: [] + acceptanceScenarioRefs: [] + clarificationDecisionRefs: [] + checklistResultRefs: [] + planDecisionRefs: [] + obligationRefs: [EV006] + artifacts: [docs/coordination/reusable-workflow-contract.md, scripts/repos.sh] + sourceRefs: + - kind: verification + path: tests/repos-registry/run.sh + result: pass + synthetic: false + observedRun: + source: work/2723-fence-arming-premise-rot/test-results/focused.xml + digest: "sha256:06a977740605f2e60f8dbd9c95452d0e30f070cc44d132084396fe5cc70f7090" + digestContract: exact-bytes-v1 + outcome: passed + passed: 2 + failed: 0 + skipped: 0 + notes: ["Focused shell fixtures and live arming measurements passed; administrative apply remains a declared post-merge obligation until the in-flight marker census clears."] + - id: EV007 + kind: verification + subject: + type: task + id: T007 + taskRefs: [T007] + requirementRefs: [] + acceptanceScenarioRefs: [] + clarificationDecisionRefs: [] + checklistResultRefs: [] + planDecisionRefs: [PD-001] + obligationRefs: [EV007] + artifacts: [docs/coordination/reusable-workflow-contract.md, scripts/repos.sh] + sourceRefs: + - kind: verification + path: tests/repos-registry/run.sh + result: pass + synthetic: false + observedRun: + source: work/2723-fence-arming-premise-rot/test-results/focused.xml + digest: "sha256:06a977740605f2e60f8dbd9c95452d0e30f070cc44d132084396fe5cc70f7090" + digestContract: exact-bytes-v1 + outcome: passed + passed: 2 + failed: 0 + skipped: 0 + notes: ["Focused shell fixtures and live arming measurements passed; administrative apply remains a declared post-merge obligation until the in-flight marker census clears."] + - id: EV008 + kind: verification + subject: + type: task + id: T008 + taskRefs: [T008] + requirementRefs: [] + acceptanceScenarioRefs: [] + clarificationDecisionRefs: [] + checklistResultRefs: [] + planDecisionRefs: [PD-001] + obligationRefs: [EV008] + artifacts: [docs/coordination/reusable-workflow-contract.md, scripts/repos.sh] + sourceRefs: + - kind: verification + path: tests/repos-registry/run.sh + result: pass + synthetic: false + observedRun: + source: work/2723-fence-arming-premise-rot/test-results/focused.xml + digest: "sha256:06a977740605f2e60f8dbd9c95452d0e30f070cc44d132084396fe5cc70f7090" + digestContract: exact-bytes-v1 + outcome: passed + passed: 2 + failed: 0 + skipped: 0 + notes: ["Focused shell fixtures and live arming measurements passed; administrative apply remains a declared post-merge obligation until the in-flight marker census clears."] + - id: EV009 + kind: verification + subject: + type: task + id: T009 + taskRefs: [T009] + requirementRefs: [] + acceptanceScenarioRefs: [] + clarificationDecisionRefs: [] + checklistResultRefs: [] + planDecisionRefs: [] + obligationRefs: [EV009] + artifacts: [docs/coordination/reusable-workflow-contract.md, scripts/repos.sh] + sourceRefs: + - kind: verification + path: tests/repos-registry/run.sh + result: pass + synthetic: false + observedRun: + source: work/2723-fence-arming-premise-rot/test-results/focused.xml + digest: "sha256:06a977740605f2e60f8dbd9c95452d0e30f070cc44d132084396fe5cc70f7090" + digestContract: exact-bytes-v1 + outcome: passed + passed: 2 + failed: 0 + skipped: 0 + notes: ["Focused shell fixtures and live arming measurements passed; administrative apply remains a declared post-merge obligation until the in-flight marker census clears."] + - id: EV010 + kind: verification + subject: + type: task + id: T010 + taskRefs: [T010] + requirementRefs: [] + acceptanceScenarioRefs: [] + clarificationDecisionRefs: [] + checklistResultRefs: [] + planDecisionRefs: [PD-001] + obligationRefs: [EV010] + artifacts: [docs/coordination/reusable-workflow-contract.md, scripts/repos.sh] + sourceRefs: + - kind: verification + path: tests/repos-registry/run.sh + result: pass + synthetic: false + observedRun: + source: work/2723-fence-arming-premise-rot/test-results/focused.xml + digest: "sha256:06a977740605f2e60f8dbd9c95452d0e30f070cc44d132084396fe5cc70f7090" + digestContract: exact-bytes-v1 + outcome: passed + passed: 2 + failed: 0 + skipped: 0 + notes: ["Focused shell fixtures and live arming measurements passed; administrative apply remains a declared post-merge obligation until the in-flight marker census clears."] +lifecycleNotes: + - "Next lifecycle action: verify." diff --git a/work/2723-fence-arming-premise-rot/plan.md b/work/2723-fence-arming-premise-rot/plan.md new file mode 100644 index 000000000..b939bd786 --- /dev/null +++ b/work/2723-fence-arming-premise-rot/plan.md @@ -0,0 +1,79 @@ +--- +schemaVersion: 1 +workId: 2723-fence-arming-premise-rot +title: Fence Arming Premise Rot +stage: plan +changeTier: tier1 +status: planned +sourceSpec: work/2723-fence-arming-premise-rot/spec.md +sourceClarifications: work/2723-fence-arming-premise-rot/clarifications.md +sourceChecklist: work/2723-fence-arming-premise-rot/checklist.md +publicOrToolFacingImpact: true +--- + +# Fence Arming Premise Rot Plan + +Prose status: planned + +## Source Snapshot +- spec: work/2723-fence-arming-premise-rot/spec.md sha256:29f2cb8a7ec153c14b98f7c1bc63db3b2b1b72dfa71d3c98409659fa8473abdf schemaVersion:1 +- clarifications: work/2723-fence-arming-premise-rot/clarifications.md sha256:d14483cfd6a8cf8e3c82b47a730cbc158c4e5382b7a63802b901062b84caf842 schemaVersion:1 +- checklist: work/2723-fence-arming-premise-rot/checklist.md sha256:102e2b9535d2ab976eb0229a4f2c72ef9e85c5d494233da28306a6d65d801fa9 schemaVersion:1 + +## Plan Scope +- Work item 2723-fence-arming-premise-rot is planned from the current specification, clarification, and checklist facts. +- Requirement count: 3. +- Clarification decision count: 3. +- Checklist result count: 3. + +## Plan Decisions +- PD-001 [AC-001] [FR-001] complete: Establish a measurement packet for `.github/main`: identify + the exact `claim-fence` check run on an immutable pull-request head, run the static producer + verifier against that checkout, prove the observe-only interval exceeds 120 minutes, enumerate all + open `item/-*` pull requests and validate their authorization markers, and record the explicit + no-merge-queue decision. Keep every API census paginated and bind its result to immutable SHAs. +- PD-002 [AC-001] [FR-002] complete: Add an arming section to + `docs/coordination/reusable-workflow-contract.md` that records each precondition, the hub-first dry + run, the post-merge apply obligation, the accepted stale-green residual, and the neuter-then-disarm + rollback order. The administrative write remains outside the implementation PR and occurs only from + the landed procedure. +- PD-003 [AC-001] [FR-003] complete: Replace the obsolete `scripts/repos.sh` claim that no org + credential can apply with the measured current boundary: the dispatch App installation can mint an + `administration:write` token, while an Actions `GITHUB_TOKEN` still cannot request that permission. + +## Contract Impact +- PC-001 [PD-001] operator contract: `scripts/repos.sh require-context` keeps its command syntax and + add-only/read-back behavior; only its credential guidance changes. The reusable-workflow contract + gains the durable operating record for arming `claim-fence` on `.github/main`. + +## Verification Obligations +- VO-001 [PD-001] [PC-001] semanticTest: Run `bash tests/repos-registry/run.sh`, invert the edited + credential premise so the focused assertion reds, and re-run after restoring it. Validate every + live precondition with paginated GitHub API reads, a static `check-required-contexts.py` invocation, + and exact required-context read-back in dry-run mode. The post-merge obligation repeats dry-run, + applies only to `.github`, and verifies the exact after-set. + +## Performance Intent +No performance intent is declared for this work item. + +## Migration Posture +- PM-001 [PC-001] additiveExternalState: The reviewed PR changes no branch protection. After merge, + the live claim holder executes the documented add-only apply for `.github/main`; rollback first + neuters the producer, then removes the classic context with explicit confirmation and checks both + classic protection and rulesets. + +## Generated View Impact +- GV-001 [PD-001] workModel: `readiness/2723-fence-arming-premise-rot/work-model.json` and + `analysis.json` are regenerated from the final lifecycle sources and committed with this item. + +## Accepted Deferrals +No accepted plan deferrals recorded. + +## Planning Findings +No blocking planning findings recorded. + +## Advisory Notes +- Optional Governance pointers remain compatibility facts only. + +## Lifecycle Notes +- Next lifecycle action: `fsgg-sdd tasks --work 2723-fence-arming-premise-rot`. diff --git a/work/2723-fence-arming-premise-rot/spec.md b/work/2723-fence-arming-premise-rot/spec.md new file mode 100644 index 000000000..28b8a5299 --- /dev/null +++ b/work/2723-fence-arming-premise-rot/spec.md @@ -0,0 +1,42 @@ +--- +schemaVersion: 1 +workId: 2723-fence-arming-premise-rot +title: Arm merge fence and repair repos.sh premise drift +stage: specify +changeTier: tier1 +status: specified +publicOrToolFacingImpact: true +--- + +# Arm merge fence and repair repos.sh premise drift Specification + +Prose status: specified + +## User Value +Make the landed GitHub-native merge fence binding only after each receiver has demonstrated a real, producible check and an explicit merge-queue decision. + +## Scope +- SB-001: Repair the stale administration-write credential guidance in scripts/repos.sh, document and execute the five-step per-repository arming sequence, evidence the residuals and rollback order, and leave the producer workflow unchanged. + +## Non-Goals +- SB-002: Do not implement later lifecycle commands or Governance enforcement in this specification. + +## User Stories +- US-001 (P1): As a user, I can make the landed GitHub-native merge fence binding only after each receiver has demonstrated a real, producible check and an explicit merge-queue decision. + +## Acceptance Scenarios +- AC-001 [US-001] [FR-001]: Given Arm merge fence and repair repos.sh premise drift is available, when the user exercises it, then they can make the landed GitHub-native merge fence binding only after each receiver has demonstrated a real, producible check and an explicit merge-queue decision. + +## Functional Requirements +- FR-001: Before any apply, observe the exact claim-fence context on a real pull request, prove it statically producible, confirm a full 120-minute observe-only window, census every open item pull request for a current authorization marker, record the merge-queue decision, dry-run each target, then apply hub-first and per receiver with read-back. (Stories: US-001; Acceptance: AC-001) +- FR-002: The documentation must name exact immutable evidence for each arming precondition, per-repository result, accepted residual, and rollback sequence. (Stories: US-001; Acceptance: AC-001) +- FR-003: The scripts/repos.sh credential guidance must state the current App administration:write capability without implying that a workflow GITHUB_TOKEN can hold it. (Stories: US-001; Acceptance: AC-001) + +## Ambiguities +No material ambiguities recorded. + +## Public Or Tool-Facing Impact +- This specification is an SDD lifecycle artifact and command-report contract input. + +## Lifecycle Notes +- Next lifecycle action: `fsgg-sdd clarify --work 2723-fence-arming-premise-rot`. diff --git a/work/2723-fence-arming-premise-rot/tasks.yml b/work/2723-fence-arming-premise-rot/tasks.yml new file mode 100644 index 000000000..8d8a13fef --- /dev/null +++ b/work/2723-fence-arming-premise-rot/tasks.yml @@ -0,0 +1,136 @@ +schemaVersion: 1 +work: + id: 2723-fence-arming-premise-rot + title: "Fence Arming Premise Rot" + stage: tasks + status: tasksReady + sourceSpec: work/2723-fence-arming-premise-rot/spec.md + sourceClarifications: work/2723-fence-arming-premise-rot/clarifications.md + sourceChecklist: work/2723-fence-arming-premise-rot/checklist.md + sourcePlan: work/2723-fence-arming-premise-rot/plan.md + publicOrToolFacingImpact: true + +sources: + - label: spec + path: work/2723-fence-arming-premise-rot/spec.md + digest: 29f2cb8a7ec153c14b98f7c1bc63db3b2b1b72dfa71d3c98409659fa8473abdf + schemaVersion: 1 + - label: clarifications + path: work/2723-fence-arming-premise-rot/clarifications.md + digest: d14483cfd6a8cf8e3c82b47a730cbc158c4e5382b7a63802b901062b84caf842 + schemaVersion: 1 + - label: checklist + path: work/2723-fence-arming-premise-rot/checklist.md + digest: 102e2b9535d2ab976eb0229a4f2c72ef9e85c5d494233da28306a6d65d801fa9 + schemaVersion: 1 + - label: plan + path: work/2723-fence-arming-premise-rot/plan.md + digest: 0eb6e6700f912065c2986475dde1fa59d2a7eb9ff58dcb660285061018212877 + schemaVersion: 1 +tasks: + - id: T001 + title: Implement requirement FR-001 + status: done + owner: sdd + dependencies: [] + requirements: [FR-001] + decisions: [] + sourceIds: [AC-001, FR-001, PD-001] + requiredSkills: [fsharp, implementation] + requiredEvidence: [EV001] + - id: T002 + title: Implement requirement FR-002 + status: done + owner: sdd + dependencies: [] + requirements: [FR-002] + decisions: [] + sourceIds: [AC-001, FR-002, PD-002] + requiredSkills: [fsharp, implementation] + requiredEvidence: [EV002] + - id: T003 + title: Implement requirement FR-003 + status: done + owner: sdd + dependencies: [] + requirements: [FR-003] + decisions: [] + sourceIds: [AC-001, FR-003, PD-003] + requiredSkills: [fsharp, implementation] + requiredEvidence: [EV003] + - id: T004 + title: Implement clarification decision DEC-001 + status: done + owner: sdd + dependencies: [T001] + requirements: [] + decisions: [DEC-001] + sourceIds: [DEC-001] + requiredSkills: [fsharp, implementation] + requiredEvidence: [EV004] + - id: T005 + title: Implement clarification decision DEC-002 + status: done + owner: sdd + dependencies: [T001] + requirements: [] + decisions: [DEC-002] + sourceIds: [DEC-002] + requiredSkills: [fsharp, implementation] + requiredEvidence: [EV005] + - id: T006 + title: Implement clarification decision DEC-003 + status: done + owner: sdd + dependencies: [T001] + requirements: [] + decisions: [DEC-003] + sourceIds: [DEC-003] + requiredSkills: [fsharp, implementation] + requiredEvidence: [EV006] + - id: T007 + title: Update contract surface PC-001 + status: done + owner: sdd + dependencies: [T001] + requirements: [] + decisions: [] + sourceIds: [PC-001, PD-001] + requiredSkills: [fsharp] + requiredEvidence: [EV007] + - id: T008 + title: Record verification evidence VO-001 + status: done + owner: sdd + dependencies: [T001] + requirements: [] + decisions: [] + sourceIds: [PC-001, PD-001, VO-001] + requiredSkills: [automated-tests, readiness-evidence] + requiredEvidence: [EV008] + - id: T009 + title: Handle migration posture PM-001 + status: done + owner: sdd + dependencies: [T001] + requirements: [] + decisions: [] + sourceIds: [PC-001, PM-001] + requiredSkills: [schema-versioning] + requiredEvidence: [EV009] + - id: T010 + title: Refresh generated view impact GV-001 + status: done + owner: sdd + dependencies: [T001] + requirements: [] + decisions: [] + sourceIds: [GV-001, PD-001] + requiredSkills: [deterministic-json] + requiredEvidence: [EV010] +acceptedDeferrals: [] +findings: [] +advisoryNotes: + - "Optional Governance pointers remain compatibility facts only." +lifecycleNotes: + - "Next lifecycle action: fsgg-sdd analyze --work 2723-fence-arming-premise-rot." From 81baec150032d2e62c4f6fb38f3f9a4057378086 Mon Sep 17 00:00:00 2001 From: crake-b242 Date: Sat, 22 Aug 2026 11:38:03 +0200 Subject: [PATCH 2/3] fix: strip unverifiable ship verdict digest --- readiness/2723-fence-arming-premise-rot/ship-verdict.json | 4 ---- 1 file changed, 4 deletions(-) diff --git a/readiness/2723-fence-arming-premise-rot/ship-verdict.json b/readiness/2723-fence-arming-premise-rot/ship-verdict.json index 9903eb130..48a7fade8 100644 --- a/readiness/2723-fence-arming-premise-rot/ship-verdict.json +++ b/readiness/2723-fence-arming-premise-rot/ship-verdict.json @@ -5,10 +5,6 @@ "stage": "ship", "status": "shipReady", "generator": "FS.GG.SDD.Artifacts/1.1.0", - "sourcesDigest": { - "algorithm": "sha256", - "value": "20626ca5b39a9b3f14825eaeadeb9c25e882b96cceafd7ddddb41a6351d67abd" - }, "verificationReadiness": { "status": "verificationReady", "evidenceSupportedCount": 10, From 9b84fe51dc32d23569a856a3e683afbcbf1d2f75 Mon Sep 17 00:00:00 2001 From: crake-b242 Date: Sat, 22 Aug 2026 12:19:04 +0200 Subject: [PATCH 3/3] fix: make claim fences fail closed --- .github/workflows/fsgg-claim-fence.yml | 80 +++---- .github/workflows/kit-materialize.yml | 43 ++-- .../reusable-workflow-contract.md | 43 ++-- .../agent-commands/claude/commands.md | 14 +- .../agent-commands/claude/guidance.json | 52 ++++- .../agent-commands/claude/skills.md | 8 +- .../agent-commands/codex/commands.md | 14 +- .../agent-commands/codex/guidance.json | 52 ++++- .../agent-commands/codex/skills.md | 8 +- .../analysis.json | 102 ++++++--- .../governance-handoff.json | 46 ++++- .../ship-verdict.json | 4 +- .../2723-fence-arming-premise-rot/ship.json | 38 +++- .../2723-fence-arming-premise-rot/summary.md | 28 +-- .../2723-fence-arming-premise-rot/verify.json | 109 ++++++++-- .../work-model.json | 195 +++++++++++++++--- tests/claim-fence/run.sh | 71 ++++--- tests/receiver-validate/run.sh | 71 +++---- .../checklist.md | 6 +- .../clarifications.md | 13 +- .../evidence.yml | 110 +++++++--- work/2723-fence-arming-premise-rot/plan.md | 56 ++--- work/2723-fence-arming-premise-rot/spec.md | 8 +- work/2723-fence-arming-premise-rot/tasks.yml | 30 ++- 24 files changed, 874 insertions(+), 327 deletions(-) diff --git a/.github/workflows/fsgg-claim-fence.yml b/.github/workflows/fsgg-claim-fence.yml index 3a9e56511..0f0f6a55d 100644 --- a/.github/workflows/fsgg-claim-fence.yml +++ b/.github/workflows/fsgg-claim-fence.yml @@ -1,4 +1,4 @@ -# The merge fence producer, OBSERVE-ONLY — slice 4 of the GitHub-native executor fencing design +# The merge fence producer, fail-closed — slice 8 of the GitHub-native executor fencing design # (.github#2719, under .github#1858; docs/reports/2026-08-04-github-native-executor-fencing-design.md # §6.2 for this file's shape, §6.3 for the six checks, §9.1 for why it lands unarmed). # @@ -7,32 +7,28 @@ # single coordination verb — MERGED pull requests in six repositories. Every guard inside `fsgg-coord` # is unreachable for an executor that never runs it, so the fence has to live where the EFFECT lands. # This is that fence. `scripts/check-claim-fence.py` carries the six checks and the reasoning; this -# file carries only the triggers, the permissions, and the deliberate refusal to enforce. +# file carries the triggers, permissions, reporting, and fail-closed enforcement. # # ============================================================================================ -# OBSERVE-ONLY IS A HARD BOUNDARY, NOT A SOFT START +# THE PRODUCER NOW FAILS CLOSED; BRANCH-PROTECTION ACTIVATION REMAINS SEPARATE # ============================================================================================ # -# Design doc §9.1 step 1: "Land the producer in observe-only. The fence workflow reports `success` -# unconditionally and writes its real verdict to the job summary. Required in ZERO repositories." -# ARMING IT IS SLICE 8's JOB (.github#2723, §9.1 steps 2-5), and the design separates the two so that -# a half-built gate can never block a merge. Concretely, and checkably: +# Design doc §9.1 separates producer enforcement from branch-protection activation so a half-built +# gate can never block a merge. Slice 8 (.github#2723) has reached the former boundary: this workflow +# now consumes the gate verdict and fails closed. Activation remains an administrative change after +# the authorization census is clean. Concretely, and checkably: # -# * No verdict step in this file exits non-zero. A FINDING and both NO-VERDICT codes are reported -# as `::warning::` and written to the job summary. `tests/claim-fence/run.sh` asserts this -# structurally over this very file, in both directions — a mutated copy that DOES exit on a -# finding must be caught — so the boundary is a test rather than a promise. +# * A final, named enforcement step exits zero only for verdict 0. FINDING, both NO-VERDICT codes, +# and every unclassified code exit non-zero after their diagnostic summary is rendered. +# `tests/claim-fence/run.sh` executes and inverts that property over this file. # * Nothing here adds a required status context to any repository. Arming is an administrative # branch-protection edit made outside a merge; a workflow file cannot perform it and this one does # not try. -# * The fixture step below IS allowed to fail the job, and that is not a hole in the above: it -# reds when THIS GATE is broken, never when a pull request's authorization is. A gate whose own -# breakage is unobservable would be #266's shape, and an observe-only verdict path is exactly the -# place that could hide it. +# * The fixture step below also fails the job when THIS GATE is broken. A gate whose own breakage +# is unobservable would be #266's shape. # -# §9.1 also fixes what must be true before slice 8 arms anything, and neither condition is met yet: -# the observe-only phase must run at least one full claim-lease window, and arming must confirm zero -# open `item/-*` pull requests lacking the marker. +# §9.1 also fixes what must be true before slice 8 changes branch protection. The current live census +# is not clean, so this change deliberately does not require the context in any repository yet. # # ============================================================================================ # THE SUMMARY DERIVES THE FAILING CHECK. IT USED TO PREDICT ONE, AND THE PREDICTION WAS UNFALSIFIABLE @@ -144,9 +140,7 @@ jobs: - uses: actions/checkout@v7 - uses: ./.github/actions/setup-policy-python - # The gate on the gate. This step MAY fail the job — see the header's observe-only note for why - # that is not a hole in the boundary: it reds when this gate is broken, never when a pull - # request's authorization is. + # The gate on the gate. This step fails when this gate is broken. - name: Run the claim-fence fixture (no network) run: bash tests/claim-fence/run.sh @@ -187,16 +181,15 @@ jobs: } >> "$GITHUB_OUTPUT" # ------------------------------------------------------------------------------------------ - # OBSERVE-ONLY REPORTING. One named step per exit code, because "I could not check" must never +# VERDICT REPORTING. One named step per exit code, because "I could not check" must never # be mistaken for "I checked, and it's fine" (#266) — the distinction is preserved in the - # SUMMARY even though none of these steps enforces it. NOT ONE OF THEM EXITS NON-ZERO, and - # `tests/claim-fence/run.sh` asserts that structurally over this file. + # summary. The final named step consumes the captured code and enforces it after reporting. # ------------------------------------------------------------------------------------------ - name: 'OK: the authorization is grounded, or this PR does not deliver a board item' if: ${{ !cancelled() && steps.fence.outputs.rc == '0' }} run: | { - echo "### fsgg-claim-fence: OK (observe-only)" + echo "### fsgg-claim-fence: OK" echo echo '```' printf '%s\n' "$VERDICT" @@ -210,7 +203,7 @@ jobs: # is how `tests/claim-fence/run.sh` section L selects this step: BY ID, never by position or by # name, because an assertion that quietly starts grading a different step is the same defect # class this file exists to close. - - name: 'FINDING (observed, NOT enforced): the authorization is not grounded' + - name: 'FINDING: the authorization is not grounded' id: finding if: ${{ !cancelled() && steps.fence.outputs.rc == '1' }} run: | @@ -223,7 +216,7 @@ jobs: fired="${BASH_REMATCH[1]}" fi { - echo "### fsgg-claim-fence: FINDING — observed, NOT enforced — $fired" + echo "### fsgg-claim-fence: FINDING — $fired" echo if [ "$fired" = unnamed ]; then echo 'The gate reported a finding but its verdict names no check in `[checkN]` form.' @@ -236,15 +229,14 @@ jobs: echo 'survived being false in two directions at once.' fi echo - echo 'This job is deliberately OBSERVE-ONLY (design 9.1 step 1): it reports `success`' - echo 'regardless, and arming this context is slice 8 (.github#2723), not this one. So this' - echo 'finding does NOT block the merge, and it is not meant to yet.' + echo 'This finding is fail-closed: the enforcement step below consumes the captured code.' + echo 'Branch protection is still unchanged until slice 8 authorization preconditions pass.' echo echo '```' printf '%s\n' "$VERDICT" echo '```' } >> "$GITHUB_STEP_SUMMARY" - echo "::warning title=fsgg-claim-fence: finding (observe-only)::The merge fence would refuse this head. See the job summary for which of design §6.3's checks failed. Nothing is blocked: this context is not armed." + echo "::error title=fsgg-claim-fence: finding::The merge fence refuses this head. See the job summary for which of design §6.3's checks failed." env: VERDICT: ${{ steps.fence.outputs.verdict }} @@ -252,7 +244,7 @@ jobs: if: ${{ !cancelled() && steps.fence.outputs.rc == '2' }} run: | { - echo "### fsgg-claim-fence: NO VERDICT (retryable) — observed, NOT enforced" + echo "### fsgg-claim-fence: NO VERDICT (retryable) — fail closed" echo echo 'A rate limit, an outage, or a timeout kept this job from reading the item, so it does' echo 'NOT know whether the authorization is grounded. Once this context is armed (slice 8),' @@ -264,7 +256,7 @@ jobs: printf '%s\n' "$VERDICT" echo '```' } >> "$GITHUB_STEP_SUMMARY" - echo "::warning title=fsgg-claim-fence: no verdict, retryable (observe-only)::The live item state could not be read. Nothing is blocked: this context is not armed." + echo "::error title=fsgg-claim-fence: no verdict, retryable::The live item state could not be read; the fence fails closed." env: VERDICT: ${{ steps.fence.outputs.verdict }} @@ -272,7 +264,7 @@ jobs: if: ${{ !cancelled() && steps.fence.outputs.rc == '3' }} run: | { - echo "### fsgg-claim-fence: NO VERDICT (permanent) — observed, NOT enforced" + echo "### fsgg-claim-fence: NO VERDICT (permanent) — fail closed" echo echo 'A credential problem, an unusable input, or a bug in the gate kept this job from' echo 'establishing a verdict. Retrying will not help. Once armed this is RED, for the same' @@ -282,7 +274,7 @@ jobs: printf '%s\n' "$VERDICT" echo '```' } >> "$GITHUB_STEP_SUMMARY" - echo "::warning title=fsgg-claim-fence: no verdict, permanent (observe-only)::See the job summary. Nothing is blocked: this context is not armed." + echo "::error title=fsgg-claim-fence: no verdict, permanent::See the job summary; the fence fails closed." env: VERDICT: ${{ steps.fence.outputs.verdict }} @@ -290,12 +282,26 @@ jobs: if: ${{ !cancelled() && !contains(fromJSON('["0","1","2","3"]'), steps.fence.outputs.rc) }} run: | { - echo "### fsgg-claim-fence: INCONCLUSIVE — observed, NOT enforced" + echo "### fsgg-claim-fence: INCONCLUSIVE — fail closed" echo echo "\`scripts/check-claim-fence.py\` exited \`$RC\`, which this workflow does not classify." echo 'That is a bug in one of the two, not a fact about this pull request. Once armed, this' echo 'state is RED — an unclassifiable exit code is not a pass.' } >> "$GITHUB_STEP_SUMMARY" - echo "::warning title=fsgg-claim-fence: inconclusive (observe-only)::The gate exited with a code this workflow does not classify. Nothing is blocked: this context is not armed." + echo "::error title=fsgg-claim-fence: inconclusive::The gate exited with an unclassified code; the fence fails closed." env: RC: ${{ steps.fence.outputs.rc }} + + # Reporting comes first so every refusal remains diagnosable. Only verdict 0 is authorized; + # missing, stale, unreadable, malformed, and unclassified states all fail closed. + - name: Enforce the merge-fence verdict + id: enforce + if: ${{ !cancelled() }} + env: + RC: ${{ steps.fence.outputs.rc }} + run: | + case "$RC" in + 0) exit 0 ;; + 1|2|3) exit "$RC" ;; + *) exit 1 ;; + esac diff --git a/.github/workflows/kit-materialize.yml b/.github/workflows/kit-materialize.yml index 75aee7210..7a40c1b02 100644 --- a/.github/workflows/kit-materialize.yml +++ b/.github/workflows/kit-materialize.yml @@ -730,10 +730,11 @@ jobs: # subject `item/-*` branches carrying NO marker at all — `.github#1858`'s own shape, # live, in the very repository the incident reached. # - # THE FOUR-FIELD FORM IS DELIBERATE AND IS NOT A NARROWING. `scripts/check-claim-fence.py` requires - # SIX (`v item gen opkey grant head`) because §6.3 checks 4 and 5 need the election; nothing writes - # those two fields today, which is why that gate is observe-only and says so. This job grades the - # form the production path actually emits — checks 1, 2, 3 and 6 of §6.3, the same slice + # THE FOUR-FIELD REQUIRED SUBSET IS DELIBERATE AND IS NOT A NARROWING OF THE PRODUCER. + # `scripts/check-claim-fence.py` requires SIX (`v item gen opkey grant head`) because §6.3 checks 4 + # and 5 need the election, and the current producer writes all six. This receiver job grades the + # four fields it can verify after the short-lived grant is released — checks 1, 2, 3 and 6 of §6.3, + # the same slice # `coherence.yml`'s already-armed `claim-generation` grades in the hub — so its findings are about # pull requests rather than about a field nobody writes. It also accepts a marker that carries the # future `opkey=`/`grant=` fields, which is `authorizationMarker`'s own stated forward-compatibility @@ -756,15 +757,14 @@ jobs: # hard constraint above forbids. This boundary is REPORTED, not silently absorbed. # # ============================================================================================ - # OBSERVE-ONLY, AND #1508 + # FAIL-CLOSED PRODUCER, ACTIVATION DEFERRED, AND #1508 # ============================================================================================ # - # §9.1 step 1: "Land the producer in observe-only. The fence workflow reports `success` - # unconditionally and writes its real verdict to the job summary. Required in ZERO repositories." - # That is exactly where `kit-bump-shape` and `kit-bump-mechanical` above already sit, and arming is - # slice 8's job (`.github#2723`), never a workflow file's. Concretely: the verdict step's LAST - # statement is `exit 0`, and the real code is published as its `verdict` output. Arming this before - # a producer has been observed reporting is the measured outage `#1713` was founded on. + # §9.1 separates a fail-closed producer from branch-protection activation. Slice 8 (`.github#2723`) + # now makes this producer consume its real verdict: the verdict step's LAST statement is + # `exit "$rc"`. Requiring `materialize / receiver-validate` in the seven receivers remains a + # later administrative operation after the hub is activated and the authorization census is clean. + # This ordering preserves the measured lesson behind #1713 without leaving the producer toothless. # # `if: github.event_name == 'pull_request'` IS A TAUTOLOGY OVER THE EVENT THIS JOB REPORTS ABOUT, # carried for the same reason and with the same property as `bump-shape` and `bump-mechanical` @@ -793,7 +793,7 @@ jobs: # That is what makes the credential argument safe to hold rather than something to be right about: # a repository turned private, a rate limit, or an outage produces code 2/3 with the reason named, # not a green. §9.1 step 2 — "observe it REPORT on a real pull request" — is the step that measures - # this in production, and observe-only is what makes that measurement free. + # this in production before branch protection consumes the context. # # THE VERDICT CONTRACT IS THE ORG'S SHARED ONE, `scripts/lib/gate.py`'s `ExitCode`: 0 OK — the ONLY # green code — 1 FINDING, 2 NO-VERDICT (retryable), 3 NO-VERDICT (permanent). It is restated inline @@ -1277,8 +1277,8 @@ jobs: lines.append(extra) lines.append("") lines.append( - "This context is OBSERVE-ONLY (design §9.1 step 1) and is required in no repository, so " - "this verdict blocks no merge. It reports; it gates nothing." + "This producer fails closed (design §9.1): only verdict 0 exits successfully. Branch " + "protection activation remains a separate, authorization-gated operation." ) # THE ANNOTATION IS EMITTED BEFORE THE SUMMARY IS WRITTEN, and the order is deliberate. The # annotation is the one place the reason ALWAYS reaches a reader; the summary write touches @@ -1311,18 +1311,15 @@ jobs: sys.exit(code) PY # THE REAL VERDICT, PUBLISHED. `$rc` is the script's own exit status, captured above and - # written here before the observe-only `exit 0` below neutralises it — so the code a reader + # written here before the fail-closed exit below consumes it — so the code a reader # (and `tests/receiver-validate/run.sh`) sees is the one the rule actually reached, not a # rendering of it. printf 'verdict=%s\n' "$rc" >> "$GITHUB_OUTPUT" - # OBSERVE-ONLY IS A HARD BOUNDARY, NOT A SOFT START (design §9.1 step 1, and slice 4's - # `fsgg-claim-fence.yml` header). ARMING IS SLICE 8's JOB (`.github#2723`). This job runs in - # SEVEN repositories it does not own, so a verdict that failed here would red pull requests - # across the fleet on the first push — before anyone has watched the context report once, - # which is precisely what §9.1 step 2 exists to do first. `tests/receiver-validate/run.sh` - # asserts this line structurally AND by execution, in both directions: a mutated copy that - # propagates the finding must be CAUGHT, or the boundary is a promise rather than a test. - exit 0 + # FAIL CLOSED IN THE PRODUCER; ACTIVATE SEPARATELY. The seven receiver repositories do not + # require this context until slice 8's hub-first authorization preconditions pass, but once + # activated a missing, stale, unreadable, malformed, or unclassified authorization must be + # red. `tests/receiver-validate/run.sh` asserts and inverts this exact consumed exit status. + exit "$rc" materialize: name: Materialize the kit from its pin diff --git a/docs/coordination/reusable-workflow-contract.md b/docs/coordination/reusable-workflow-contract.md index 3db97a0cc..3daa8edd1 100644 --- a/docs/coordination/reusable-workflow-contract.md +++ b/docs/coordination/reusable-workflow-contract.md @@ -406,17 +406,22 @@ FS.GG.Net's real caller and **this repository's own** `kit-materialize.yml`, and either job is caught by name. That is stronger than a dry run — it needs no credential, and it fails on the pull request that would break it rather than on the nightly sweep afterwards. -### Arming record: `claim-fence` on `.github/main` +### Arming record: hub `claim-fence`, then seven receiver validation contexts This is the durable slice-8 packet for the GitHub-native executor fence ([#2723](https://github.com/FS-GG/.github/issues/2723)). It records the decision and the evidence; it does not pretend a blocked administrative write happened. -1. **Producer landed and observed for more than one claim-lease window.** The exact context is +1. **Both producers are fail-closed before branch protection consumes them.** The hub context is `claim-fence`, produced directly by `.github/workflows/fsgg-claim-fence.yml` on this repository (it - is not a nested reusable-workflow context). The earliest complete workflow census entry is run + is not a nested reusable-workflow context). Its final `id: enforce` step exits zero only for gate + verdict 0; findings, retryable/permanent no-verdicts, and unclassified exits are red. Each + `receives: coordination-kit` caller also reports `materialize / receiver-validate`; the shared + callee now exits its captured verdict instead of publishing a refusal and returning success. + `tests/claim-fence/run.sh` and `tests/receiver-validate/run.sh` execute and invert those consumers. + Historical observation evidence remains useful: the earliest complete hub census entry is run [31969788185](https://github.com/FS-GG/.github/actions/runs/31969788185), which reported a successful `claim-fence` check on immutable head `0a0d6b052490b26fc6cbab8cf2619bfaae9ab809` at - `2026-08-16T20:11:03Z`. A six-page, 597-run census at `2026-08-22T09:18:30Z` put the observe-only + `2026-08-16T20:11:03Z`; a six-page, 597-run census at `2026-08-22T09:18:30Z` put the reporting interval beyond five days, comfortably above the 120-minute default lease. 2. **Static producibility passes.** Against this checkout and an offline classic-protection payload requiring only `claim-fence`, `scripts/check-required-contexts.py` reported `ok claim-fence` and @@ -430,30 +435,36 @@ It records the decision and the evidence; it does not pretend a blocked administ was `[]` on 2026-08-22. Enabling a queue changes how every pull request merges and remains a separate repository decision. Arming without it still refuses ungrounded executors, while accepting the stale-green residual above; this is deliberate, not an assertion that AC1's strongest form is met. -5. **Apply is a post-merge obligation and is presently blocked.** A complete open-pull-request census - on 2026-08-22 found three `item/-*` pull requests: [#2821](https://github.com/FS-GG/.github/pull/2821) - and [#2818](https://github.com/FS-GG/.github/pull/2818) had no authorization marker, while +5. **Apply is a post-merge obligation and is presently blocked.** The repair-round census on + 2026-08-22 found open `item/-*` pull requests including [#2824](https://github.com/FS-GG/.github/pull/2824), + [#2825](https://github.com/FS-GG/.github/pull/2825), and [#2818](https://github.com/FS-GG/.github/pull/2818) + without a current authorization marker, while [#2809](https://github.com/FS-GG/.github/pull/2809)'s marker named head `2fb051d9…` rather than its current `ff04546b…`. Therefore the zero-unmarked-in-flight precondition is false and **nothing is armed by this change**. After this document lands, the claim holder must repeat the complete census; - only when it is empty (or every item PR carries a current marker) may it run the hub-only dry run and - apply: + only when it is empty (or every item PR carries a current marker) may it run the hub dry run/apply, + verify that exact after-set, and then repeat the receiver dry run/apply one repository at a time: ```sh scripts/repos.sh require-context --context claim-fence --receives labels --only FS-GG/.github scripts/repos.sh require-context --context claim-fence --receives labels --only FS-GG/.github --apply + scripts/repos.sh require-context --context 'materialize / receiver-validate' --receives coordination-kit + scripts/repos.sh require-context --context 'materialize / receiver-validate' --receives coordination-kit --apply ``` - The recorded dry run on 2026-08-22 selected exactly `FS-GG/.github`, read the seven-context before - set, and reported `1 would-add, 0 unchanged, 0 failed`. The apply is complete only when its built-in - read-back reports `claim-fence` in the exact after-set. The separately measured dispatch App + The receiver command selects exactly `FS.GG.SDD`, `FS.GG.Rendering`, `FS.GG.Governance`, + `FS.GG.Templates`, `FS.GG.Game`, `FS.GG.Audio`, and `FS.GG.Net` from the registry. Automation must + stop on the first failed dry run or read-back; it must not treat a partial fan-out as completion. + The apply is complete only when built-in read-back reports the hub context first and the receiver + context in every exact receiver after-set. The separately measured dispatch App installation grant includes `administration: write`; a workflow `GITHUB_TOKEN` still cannot hold that permission. -Rollback preserves a reporting context before it weakens protection: first set the producer back to -observe-only/non-binding behavior, then run `unrequire-context` with the exact confirmation, and finally -read both classic protection and rulesets. Never delete or silence the producer before removing a -required context: a missing required check is a permanent wait, not a red verdict. +Rollback reverses the activation order: remove the receiver requirements one at a time with exact +confirmation/read-back, remove the hub requirement, and only then change or remove either producer. +Read both classic protection and rulesets after every operation. Never delete, silence, or make a +producer pass-open while its context is required: a missing context is a permanent wait and a false +green is an authorization bypass. ## The on-demand materialize, and why one still never writes `main` diff --git a/readiness/2723-fence-arming-premise-rot/agent-commands/claude/commands.md b/readiness/2723-fence-arming-premise-rot/agent-commands/claude/commands.md index a31ed1e8d..1795e8056 100644 --- a/readiness/2723-fence-arming-premise-rot/agent-commands/claude/commands.md +++ b/readiness/2723-fence-arming-premise-rot/agent-commands/claude/commands.md @@ -40,8 +40,8 @@ normalized work model, not an authored source of truth. See `guidance.json`. ## T008 — Record verification evidence VO-001 - Stage: specify -- Purpose: Carry out lifecycle task T008 (done) covering PC-001, PD-001, VO-001. -- Related: PC-001, PD-001, VO-001 +- Purpose: Carry out lifecycle task T008 (done) covering PC-001, PD-001, PD-004, VO-001. +- Related: PC-001, PD-001, PD-004, VO-001 ## T009 — Handle migration posture PM-001 - Stage: specify @@ -52,3 +52,13 @@ normalized work model, not an authored source of truth. See `guidance.json`. - Stage: specify - Purpose: Carry out lifecycle task T010 (done) covering GV-001, PD-001. - Related: GV-001, PD-001 + +## T011 — Implement requirement FR-004 +- Stage: specify +- Purpose: Carry out lifecycle task T011 (done) covering AC-001, FR-004, PD-004. +- Related: AC-001, FR-004, PD-004 + +## T012 — Implement clarification decision DEC-004 +- Stage: specify +- Purpose: Carry out lifecycle task T012 (done) covering DEC-004. +- Related: DEC-004 diff --git a/readiness/2723-fence-arming-premise-rot/agent-commands/claude/guidance.json b/readiness/2723-fence-arming-premise-rot/agent-commands/claude/guidance.json index 59660d65f..a1d125d9b 100644 --- a/readiness/2723-fence-arming-premise-rot/agent-commands/claude/guidance.json +++ b/readiness/2723-fence-arming-premise-rot/agent-commands/claude/guidance.json @@ -11,7 +11,7 @@ "kind": "workModel", "digest": { "algorithm": "sha256", - "value": "69e1a04e67bc3339aebff00a2f992126379cecc39af6f5c51193856247c2ca0b" + "value": "44969cfd8153e5b96bd7e7b858fecb741b9c7be81392a3fa182a3021c442ad12" }, "schemaVersion": 1, "schemaStatus": "current" @@ -19,7 +19,7 @@ ], "behaviorModelDigest": { "algorithm": "sha256", - "value": "527a14bcd46ffa462c47bd7c51b466c3f4842b4492e2ba6a49374a06a06ad6b6" + "value": "fb0a84fbca8c9c7050e75fb3e851bd709cd1c4bcfc8a1d309d5a95ad1a38c8c8" }, "commands": [ { @@ -96,10 +96,11 @@ "id": "T008", "title": "Record verification evidence VO-001", "stage": "specify", - "purpose": "Carry out lifecycle task T008 (done) covering PC-001, PD-001, VO-001.", + "purpose": "Carry out lifecycle task T008 (done) covering PC-001, PD-001, PD-004, VO-001.", "relatedIds": [ "PC-001", "PD-001", + "PD-004", "VO-001" ] }, @@ -122,6 +123,26 @@ "GV-001", "PD-001" ] + }, + { + "id": "T011", + "title": "Implement requirement FR-004", + "stage": "specify", + "purpose": "Carry out lifecycle task T011 (done) covering AC-001, FR-004, PD-004.", + "relatedIds": [ + "AC-001", + "FR-004", + "PD-004" + ] + }, + { + "id": "T012", + "title": "Implement clarification decision DEC-004", + "stage": "specify", + "purpose": "Carry out lifecycle task T012 (done) covering DEC-004.", + "relatedIds": [ + "DEC-004" + ] } ], "skills": [ @@ -144,7 +165,7 @@ { "id": "fsharp", "title": "fsharp", - "capability": "Required by tasks: T001, T002, T003, T004, T005, T006, T007.", + "capability": "Required by tasks: T001, T002, T003, T004, T005, T006, T007, T011, T012.", "relatedIds": [ "T001", "T002", @@ -152,20 +173,24 @@ "T004", "T005", "T006", - "T007" + "T007", + "T011", + "T012" ] }, { "id": "implementation", "title": "implementation", - "capability": "Required by tasks: T001, T002, T003, T004, T005, T006.", + "capability": "Required by tasks: T001, T002, T003, T004, T005, T006, T011, T012.", "relatedIds": [ "T001", "T002", "T003", "T004", "T005", - "T006" + "T006", + "T011", + "T012" ] }, { @@ -195,5 +220,16 @@ "kind": "skills" } ], - "diagnostics": [] + "diagnostics": [ + { + "id": "agents.staleGeneratedGuidance", + "severity": "warning", + "artifact": "readiness/2723-fence-arming-premise-rot/agent-commands/claude/guidance.json", + "message": "Generated agent guidance for target \u0027claude\u0027 no longer matches the current normalized work model.", + "correction": "Regenerate agent guidance so the generated view matches the current work model.", + "relatedIds": [ + "claude" + ] + } + ] } \ No newline at end of file diff --git a/readiness/2723-fence-arming-premise-rot/agent-commands/claude/skills.md b/readiness/2723-fence-arming-premise-rot/agent-commands/claude/skills.md index 499013b4a..5c7e7bb12 100644 --- a/readiness/2723-fence-arming-premise-rot/agent-commands/claude/skills.md +++ b/readiness/2723-fence-arming-premise-rot/agent-commands/claude/skills.md @@ -14,12 +14,12 @@ For public-impact F# work, author or update the compiled `.fsi` signature before - Related: T010 ## fsharp — fsharp -- Capability: Required by tasks: T001, T002, T003, T004, T005, T006, T007. -- Related: T001, T002, T003, T004, T005, T006, T007 +- Capability: Required by tasks: T001, T002, T003, T004, T005, T006, T007, T011, T012. +- Related: T001, T002, T003, T004, T005, T006, T007, T011, T012 ## implementation — implementation -- Capability: Required by tasks: T001, T002, T003, T004, T005, T006. -- Related: T001, T002, T003, T004, T005, T006 +- Capability: Required by tasks: T001, T002, T003, T004, T005, T006, T011, T012. +- Related: T001, T002, T003, T004, T005, T006, T011, T012 ## readiness-evidence — readiness-evidence - Capability: Required by tasks: T008. diff --git a/readiness/2723-fence-arming-premise-rot/agent-commands/codex/commands.md b/readiness/2723-fence-arming-premise-rot/agent-commands/codex/commands.md index f577ce69f..752940d6a 100644 --- a/readiness/2723-fence-arming-premise-rot/agent-commands/codex/commands.md +++ b/readiness/2723-fence-arming-premise-rot/agent-commands/codex/commands.md @@ -40,8 +40,8 @@ normalized work model, not an authored source of truth. See `guidance.json`. ## T008 — Record verification evidence VO-001 - Stage: specify -- Purpose: Carry out lifecycle task T008 (done) covering PC-001, PD-001, VO-001. -- Related: PC-001, PD-001, VO-001 +- Purpose: Carry out lifecycle task T008 (done) covering PC-001, PD-001, PD-004, VO-001. +- Related: PC-001, PD-001, PD-004, VO-001 ## T009 — Handle migration posture PM-001 - Stage: specify @@ -52,3 +52,13 @@ normalized work model, not an authored source of truth. See `guidance.json`. - Stage: specify - Purpose: Carry out lifecycle task T010 (done) covering GV-001, PD-001. - Related: GV-001, PD-001 + +## T011 — Implement requirement FR-004 +- Stage: specify +- Purpose: Carry out lifecycle task T011 (done) covering AC-001, FR-004, PD-004. +- Related: AC-001, FR-004, PD-004 + +## T012 — Implement clarification decision DEC-004 +- Stage: specify +- Purpose: Carry out lifecycle task T012 (done) covering DEC-004. +- Related: DEC-004 diff --git a/readiness/2723-fence-arming-premise-rot/agent-commands/codex/guidance.json b/readiness/2723-fence-arming-premise-rot/agent-commands/codex/guidance.json index a3641a5fa..a2f5c88f5 100644 --- a/readiness/2723-fence-arming-premise-rot/agent-commands/codex/guidance.json +++ b/readiness/2723-fence-arming-premise-rot/agent-commands/codex/guidance.json @@ -11,7 +11,7 @@ "kind": "workModel", "digest": { "algorithm": "sha256", - "value": "69e1a04e67bc3339aebff00a2f992126379cecc39af6f5c51193856247c2ca0b" + "value": "44969cfd8153e5b96bd7e7b858fecb741b9c7be81392a3fa182a3021c442ad12" }, "schemaVersion": 1, "schemaStatus": "current" @@ -19,7 +19,7 @@ ], "behaviorModelDigest": { "algorithm": "sha256", - "value": "527a14bcd46ffa462c47bd7c51b466c3f4842b4492e2ba6a49374a06a06ad6b6" + "value": "fb0a84fbca8c9c7050e75fb3e851bd709cd1c4bcfc8a1d309d5a95ad1a38c8c8" }, "commands": [ { @@ -96,10 +96,11 @@ "id": "T008", "title": "Record verification evidence VO-001", "stage": "specify", - "purpose": "Carry out lifecycle task T008 (done) covering PC-001, PD-001, VO-001.", + "purpose": "Carry out lifecycle task T008 (done) covering PC-001, PD-001, PD-004, VO-001.", "relatedIds": [ "PC-001", "PD-001", + "PD-004", "VO-001" ] }, @@ -122,6 +123,26 @@ "GV-001", "PD-001" ] + }, + { + "id": "T011", + "title": "Implement requirement FR-004", + "stage": "specify", + "purpose": "Carry out lifecycle task T011 (done) covering AC-001, FR-004, PD-004.", + "relatedIds": [ + "AC-001", + "FR-004", + "PD-004" + ] + }, + { + "id": "T012", + "title": "Implement clarification decision DEC-004", + "stage": "specify", + "purpose": "Carry out lifecycle task T012 (done) covering DEC-004.", + "relatedIds": [ + "DEC-004" + ] } ], "skills": [ @@ -144,7 +165,7 @@ { "id": "fsharp", "title": "fsharp", - "capability": "Required by tasks: T001, T002, T003, T004, T005, T006, T007.", + "capability": "Required by tasks: T001, T002, T003, T004, T005, T006, T007, T011, T012.", "relatedIds": [ "T001", "T002", @@ -152,20 +173,24 @@ "T004", "T005", "T006", - "T007" + "T007", + "T011", + "T012" ] }, { "id": "implementation", "title": "implementation", - "capability": "Required by tasks: T001, T002, T003, T004, T005, T006.", + "capability": "Required by tasks: T001, T002, T003, T004, T005, T006, T011, T012.", "relatedIds": [ "T001", "T002", "T003", "T004", "T005", - "T006" + "T006", + "T011", + "T012" ] }, { @@ -195,5 +220,16 @@ "kind": "skills" } ], - "diagnostics": [] + "diagnostics": [ + { + "id": "agents.staleGeneratedGuidance", + "severity": "warning", + "artifact": "readiness/2723-fence-arming-premise-rot/agent-commands/codex/guidance.json", + "message": "Generated agent guidance for target \u0027codex\u0027 no longer matches the current normalized work model.", + "correction": "Regenerate agent guidance so the generated view matches the current work model.", + "relatedIds": [ + "codex" + ] + } + ] } \ No newline at end of file diff --git a/readiness/2723-fence-arming-premise-rot/agent-commands/codex/skills.md b/readiness/2723-fence-arming-premise-rot/agent-commands/codex/skills.md index 68df5bdc6..083ad5edc 100644 --- a/readiness/2723-fence-arming-premise-rot/agent-commands/codex/skills.md +++ b/readiness/2723-fence-arming-premise-rot/agent-commands/codex/skills.md @@ -14,12 +14,12 @@ For public-impact F# work, author or update the compiled `.fsi` signature before - Related: T010 ## fsharp — fsharp -- Capability: Required by tasks: T001, T002, T003, T004, T005, T006, T007. -- Related: T001, T002, T003, T004, T005, T006, T007 +- Capability: Required by tasks: T001, T002, T003, T004, T005, T006, T007, T011, T012. +- Related: T001, T002, T003, T004, T005, T006, T007, T011, T012 ## implementation — implementation -- Capability: Required by tasks: T001, T002, T003, T004, T005, T006. -- Related: T001, T002, T003, T004, T005, T006 +- Capability: Required by tasks: T001, T002, T003, T004, T005, T006, T011, T012. +- Related: T001, T002, T003, T004, T005, T006, T011, T012 ## readiness-evidence — readiness-evidence - Capability: Required by tasks: T008. diff --git a/readiness/2723-fence-arming-premise-rot/analysis.json b/readiness/2723-fence-arming-premise-rot/analysis.json index d7dc7e988..bd0674232 100644 --- a/readiness/2723-fence-arming-premise-rot/analysis.json +++ b/readiness/2723-fence-arming-premise-rot/analysis.json @@ -41,7 +41,7 @@ "kind": "workModel", "digest": { "algorithm": "sha256", - "value": "69e1a04e67bc3339aebff00a2f992126379cecc39af6f5c51193856247c2ca0b" + "value": "44969cfd8153e5b96bd7e7b858fecb741b9c7be81392a3fa182a3021c442ad12" }, "schemaVersion": 1, "schemaStatus": "current" @@ -51,7 +51,7 @@ "kind": "checklist", "digest": { "algorithm": "sha256", - "value": "102e2b9535d2ab976eb0229a4f2c72ef9e85c5d494233da28306a6d65d801fa9" + "value": "ac8a50ff51a092f043c4722238acf1bd5784daa38eab80535100df7e5a286a62" }, "schemaVersion": 1, "schemaStatus": "current" @@ -61,7 +61,7 @@ "kind": "clarification", "digest": { "algorithm": "sha256", - "value": "d14483cfd6a8cf8e3c82b47a730cbc158c4e5382b7a63802b901062b84caf842" + "value": "c86f6e45846039d4590b652082a793649e1bff93f24e7f5f7ce61ebec93c121c" }, "schemaVersion": 1, "schemaStatus": "current" @@ -71,7 +71,7 @@ "kind": "plan", "digest": { "algorithm": "sha256", - "value": "0eb6e6700f912065c2986475dde1fa59d2a7eb9ff58dcb660285061018212877" + "value": "1fa66fc0a40b98af4e98ad299e4d2091ac1c2c63a772d3aaa28db9999c9c0b8e" }, "schemaVersion": 1, "schemaStatus": "current" @@ -81,7 +81,7 @@ "kind": "specification", "digest": { "algorithm": "sha256", - "value": "29f2cb8a7ec153c14b98f7c1bc63db3b2b1b72dfa71d3c98409659fa8473abdf" + "value": "76b2fa86eb896809b8b8f0108ee9c93efa2974df176d1df5b01f5551b143bdd4" }, "schemaVersion": 1, "schemaStatus": "current" @@ -91,7 +91,7 @@ "kind": "tasks", "digest": { "algorithm": "sha256", - "value": "476b7455c315389f9701220eeac136770247ed15c187ab2d7191224a7a2991c7" + "value": "85df72be9578a96e18ecbb2278175b2552dd0f7998905a0f6063740fb06f47cb" }, "schemaVersion": 1, "schemaStatus": "current" @@ -161,6 +161,16 @@ { "id": "AR007", "sourcePath": "work/2723-fence-arming-premise-rot/clarifications.md", + "targetPath": "work/2723-fence-arming-premise-rot/tasks.yml", + "sourceId": "DEC-004", + "targetId": null, + "relationship": "clarificationDisposition", + "state": "current", + "diagnosticIds": [] + }, + { + "id": "AR008", + "sourcePath": "work/2723-fence-arming-premise-rot/clarifications.md", "targetPath": "work/2723-fence-arming-premise-rot/plan.md", "sourceId": null, "targetId": null, @@ -169,7 +179,7 @@ "diagnosticIds": [] }, { - "id": "AR008", + "id": "AR009", "sourcePath": "work/2723-fence-arming-premise-rot/clarifications.md", "targetPath": "work/2723-fence-arming-premise-rot/tasks.yml", "sourceId": null, @@ -179,7 +189,7 @@ "diagnosticIds": [] }, { - "id": "AR009", + "id": "AR010", "sourcePath": "work/2723-fence-arming-premise-rot/plan.md", "targetPath": "work/2723-fence-arming-premise-rot/tasks.yml", "sourceId": "PC-001", @@ -189,7 +199,7 @@ "diagnosticIds": [] }, { - "id": "AR010", + "id": "AR011", "sourcePath": "work/2723-fence-arming-premise-rot/plan.md", "targetPath": "work/2723-fence-arming-premise-rot/tasks.yml", "sourceId": "GV-001", @@ -199,7 +209,7 @@ "diagnosticIds": [] }, { - "id": "AR011", + "id": "AR012", "sourcePath": "work/2723-fence-arming-premise-rot/plan.md", "targetPath": "work/2723-fence-arming-premise-rot/tasks.yml", "sourceId": "PM-001", @@ -209,7 +219,7 @@ "diagnosticIds": [] }, { - "id": "AR012", + "id": "AR013", "sourcePath": "work/2723-fence-arming-premise-rot/plan.md", "targetPath": "work/2723-fence-arming-premise-rot/tasks.yml", "sourceId": "PD-001", @@ -219,7 +229,7 @@ "diagnosticIds": [] }, { - "id": "AR013", + "id": "AR014", "sourcePath": "work/2723-fence-arming-premise-rot/plan.md", "targetPath": "work/2723-fence-arming-premise-rot/tasks.yml", "sourceId": "PD-002", @@ -229,7 +239,7 @@ "diagnosticIds": [] }, { - "id": "AR014", + "id": "AR015", "sourcePath": "work/2723-fence-arming-premise-rot/plan.md", "targetPath": "work/2723-fence-arming-premise-rot/tasks.yml", "sourceId": "PD-003", @@ -239,7 +249,17 @@ "diagnosticIds": [] }, { - "id": "AR015", + "id": "AR016", + "sourcePath": "work/2723-fence-arming-premise-rot/plan.md", + "targetPath": "work/2723-fence-arming-premise-rot/tasks.yml", + "sourceId": "PD-004", + "targetId": null, + "relationship": "planDecisionDisposition", + "state": "current", + "diagnosticIds": [] + }, + { + "id": "AR017", "sourcePath": "work/2723-fence-arming-premise-rot/plan.md", "targetPath": "work/2723-fence-arming-premise-rot/tasks.yml", "sourceId": null, @@ -249,7 +269,7 @@ "diagnosticIds": [] }, { - "id": "AR016", + "id": "AR018", "sourcePath": "work/2723-fence-arming-premise-rot/plan.md", "targetPath": "work/2723-fence-arming-premise-rot/tasks.yml", "sourceId": "VO-001", @@ -259,7 +279,7 @@ "diagnosticIds": [] }, { - "id": "AR017", + "id": "AR019", "sourcePath": "work/2723-fence-arming-premise-rot/spec.md", "targetPath": "work/2723-fence-arming-premise-rot/tasks.yml", "sourceId": "AC-001", @@ -269,7 +289,7 @@ "diagnosticIds": [] }, { - "id": "AR018", + "id": "AR020", "sourcePath": "work/2723-fence-arming-premise-rot/spec.md", "targetPath": "work/2723-fence-arming-premise-rot/checklist.md", "sourceId": null, @@ -279,7 +299,7 @@ "diagnosticIds": [] }, { - "id": "AR019", + "id": "AR021", "sourcePath": "work/2723-fence-arming-premise-rot/spec.md", "targetPath": "work/2723-fence-arming-premise-rot/plan.md", "sourceId": null, @@ -289,7 +309,7 @@ "diagnosticIds": [] }, { - "id": "AR020", + "id": "AR022", "sourcePath": "work/2723-fence-arming-premise-rot/spec.md", "targetPath": "work/2723-fence-arming-premise-rot/tasks.yml", "sourceId": "FR-001", @@ -299,7 +319,7 @@ "diagnosticIds": [] }, { - "id": "AR021", + "id": "AR023", "sourcePath": "work/2723-fence-arming-premise-rot/spec.md", "targetPath": "work/2723-fence-arming-premise-rot/tasks.yml", "sourceId": "FR-002", @@ -309,7 +329,7 @@ "diagnosticIds": [] }, { - "id": "AR022", + "id": "AR024", "sourcePath": "work/2723-fence-arming-premise-rot/spec.md", "targetPath": "work/2723-fence-arming-premise-rot/tasks.yml", "sourceId": "FR-003", @@ -319,7 +339,17 @@ "diagnosticIds": [] }, { - "id": "AR023", + "id": "AR025", + "sourcePath": "work/2723-fence-arming-premise-rot/spec.md", + "targetPath": "work/2723-fence-arming-premise-rot/tasks.yml", + "sourceId": "FR-004", + "targetId": null, + "relationship": "requirementDisposition", + "state": "current", + "diagnosticIds": [] + }, + { + "id": "AR026", "sourcePath": "work/2723-fence-arming-premise-rot/spec.md", "targetPath": "work/2723-fence-arming-premise-rot/clarifications.md", "sourceId": null, @@ -329,7 +359,7 @@ "diagnosticIds": [] }, { - "id": "AR024", + "id": "AR027", "sourcePath": "work/2723-fence-arming-premise-rot/spec.md", "targetPath": "work/2723-fence-arming-premise-rot/tasks.yml", "sourceId": null, @@ -339,7 +369,7 @@ "diagnosticIds": [] }, { - "id": "AR025", + "id": "AR028", "sourcePath": "work/2723-fence-arming-premise-rot/tasks.yml", "targetPath": "work/2723-fence-arming-premise-rot/tasks.yml", "sourceId": "T004", @@ -349,7 +379,7 @@ "diagnosticIds": [] }, { - "id": "AR026", + "id": "AR029", "sourcePath": "work/2723-fence-arming-premise-rot/tasks.yml", "targetPath": "work/2723-fence-arming-premise-rot/tasks.yml", "sourceId": "T005", @@ -359,7 +389,7 @@ "diagnosticIds": [] }, { - "id": "AR027", + "id": "AR030", "sourcePath": "work/2723-fence-arming-premise-rot/tasks.yml", "targetPath": "work/2723-fence-arming-premise-rot/tasks.yml", "sourceId": "T006", @@ -369,7 +399,7 @@ "diagnosticIds": [] }, { - "id": "AR028", + "id": "AR031", "sourcePath": "work/2723-fence-arming-premise-rot/tasks.yml", "targetPath": "work/2723-fence-arming-premise-rot/tasks.yml", "sourceId": "T007", @@ -379,7 +409,7 @@ "diagnosticIds": [] }, { - "id": "AR029", + "id": "AR032", "sourcePath": "work/2723-fence-arming-premise-rot/tasks.yml", "targetPath": "work/2723-fence-arming-premise-rot/tasks.yml", "sourceId": "T008", @@ -389,7 +419,7 @@ "diagnosticIds": [] }, { - "id": "AR030", + "id": "AR033", "sourcePath": "work/2723-fence-arming-premise-rot/tasks.yml", "targetPath": "work/2723-fence-arming-premise-rot/tasks.yml", "sourceId": "T009", @@ -399,7 +429,7 @@ "diagnosticIds": [] }, { - "id": "AR031", + "id": "AR034", "sourcePath": "work/2723-fence-arming-premise-rot/tasks.yml", "targetPath": "work/2723-fence-arming-premise-rot/tasks.yml", "sourceId": "T010", @@ -407,11 +437,21 @@ "relationship": "taskDependency", "state": "current", "diagnosticIds": [] + }, + { + "id": "AR035", + "sourcePath": "work/2723-fence-arming-premise-rot/tasks.yml", + "targetPath": "work/2723-fence-arming-premise-rot/tasks.yml", + "sourceId": "T012", + "targetId": "T001", + "relationship": "taskDependency", + "state": "current", + "diagnosticIds": [] } ], "readiness": { "status": "implementationReady", - "readyCount": 31, + "readyCount": 35, "advisoryCount": 0, "warningCount": 0, "blockingCount": 0, diff --git a/readiness/2723-fence-arming-premise-rot/governance-handoff.json b/readiness/2723-fence-arming-premise-rot/governance-handoff.json index 51f511b58..696272444 100644 --- a/readiness/2723-fence-arming-premise-rot/governance-handoff.json +++ b/readiness/2723-fence-arming-premise-rot/governance-handoff.json @@ -6,17 +6,17 @@ "sources": [ { "path": "readiness/2723-fence-arming-premise-rot/ship.json", - "digest": "sha256:e9ef9c2f1df122af4f74ba659d4d80bed1db4b0ee24c265a7e42f834be63491c", + "digest": "sha256:ba34bf7bbe151ed1ff10ce0b7da7fa4413f9fdb455676d262fbe748fa4fa9db4", "schemaVersion": 1 }, { "path": "readiness/2723-fence-arming-premise-rot/verify.json", - "digest": "sha256:29af17b887f11ab1e5277e1abf171b1704dbf115a8091b8db9f2a043ee02dacc", + "digest": "sha256:217ef3b674e410efcc32d5ead646169d800781a316342d4c7a2cf5e3517ef829", "schemaVersion": 1 }, { "path": "readiness/2723-fence-arming-premise-rot/work-model.json", - "digest": "sha256:68391d56619cdd6ba31c7c02269b3593f2b3dd1a78a0e8e027f3b57432c0bfcc", + "digest": "sha256:4a8811be4effb653f2a661cce9b4857735e1ae6d414e772a97c7ddc3dfa15d78", "schemaVersion": 1 } ], @@ -72,6 +72,16 @@ "state": "real", "rationale": null }, + { + "id": "evidence:EV011", + "state": "real", + "rationale": null + }, + { + "id": "evidence:EV012", + "state": "real", + "rationale": null + }, { "id": "task:T001", "state": "real", @@ -121,6 +131,16 @@ "id": "task:T010", "state": "real", "rationale": null + }, + { + "id": "task:T011", + "state": "real", + "rationale": null + }, + { + "id": "task:T012", + "state": "real", + "rationale": null } ], "dependencies": [ @@ -164,6 +184,14 @@ "dependent": "evidence:EV010", "dependency": "task:T010" }, + { + "dependent": "evidence:EV011", + "dependency": "task:T011" + }, + { + "dependent": "evidence:EV012", + "dependency": "task:T012" + }, { "dependent": "task:T001", "dependency": "evidence:EV001" @@ -231,6 +259,18 @@ { "dependent": "task:T010", "dependency": "task:T001" + }, + { + "dependent": "task:T011", + "dependency": "evidence:EV011" + }, + { + "dependent": "task:T012", + "dependency": "evidence:EV012" + }, + { + "dependent": "task:T012", + "dependency": "task:T001" } ] }, diff --git a/readiness/2723-fence-arming-premise-rot/ship-verdict.json b/readiness/2723-fence-arming-premise-rot/ship-verdict.json index 48a7fade8..40c665657 100644 --- a/readiness/2723-fence-arming-premise-rot/ship-verdict.json +++ b/readiness/2723-fence-arming-premise-rot/ship-verdict.json @@ -7,9 +7,9 @@ "generator": "FS.GG.SDD.Artifacts/1.1.0", "verificationReadiness": { "status": "verificationReady", - "evidenceSupportedCount": 10, + "evidenceSupportedCount": 12, "evidenceSelfAttestedCount": 0, - "evidenceObservedCount": 10 + "evidenceObservedCount": 12 }, "disposition": { "state": "shipReady", diff --git a/readiness/2723-fence-arming-premise-rot/ship.json b/readiness/2723-fence-arming-premise-rot/ship.json index dc822de02..c82c2d3bc 100644 --- a/readiness/2723-fence-arming-premise-rot/ship.json +++ b/readiness/2723-fence-arming-premise-rot/ship.json @@ -41,7 +41,7 @@ "kind": "analysis", "digest": { "algorithm": "sha256", - "value": "ece93425673043c5c48a2a0b60e9a43de52e917c991da213d1752ca319c46afe" + "value": "bd4ebbc0283788b039271ca9d9a78d747e58780981f443404d99d7ba9f81c650" }, "schemaVersion": 1, "schemaStatus": "current" @@ -51,7 +51,7 @@ "kind": "source", "digest": { "algorithm": "sha256", - "value": "29af17b887f11ab1e5277e1abf171b1704dbf115a8091b8db9f2a043ee02dacc" + "value": "217ef3b674e410efcc32d5ead646169d800781a316342d4c7a2cf5e3517ef829" }, "schemaVersion": 1, "schemaStatus": "current" @@ -61,7 +61,7 @@ "kind": "workModel", "digest": { "algorithm": "sha256", - "value": "68391d56619cdd6ba31c7c02269b3593f2b3dd1a78a0e8e027f3b57432c0bfcc" + "value": "4a8811be4effb653f2a661cce9b4857735e1ae6d414e772a97c7ddc3dfa15d78" }, "schemaVersion": 1, "schemaStatus": "current" @@ -71,7 +71,7 @@ "kind": "checklist", "digest": { "algorithm": "sha256", - "value": "102e2b9535d2ab976eb0229a4f2c72ef9e85c5d494233da28306a6d65d801fa9" + "value": "ac8a50ff51a092f043c4722238acf1bd5784daa38eab80535100df7e5a286a62" }, "schemaVersion": 1, "schemaStatus": "current" @@ -81,7 +81,7 @@ "kind": "clarification", "digest": { "algorithm": "sha256", - "value": "d14483cfd6a8cf8e3c82b47a730cbc158c4e5382b7a63802b901062b84caf842" + "value": "c86f6e45846039d4590b652082a793649e1bff93f24e7f5f7ce61ebec93c121c" }, "schemaVersion": 1, "schemaStatus": "current" @@ -91,7 +91,7 @@ "kind": "evidence", "digest": { "algorithm": "sha256", - "value": "380b2bbd98c347e7d02491877620297c7b200b13ae4a9e3e2c50ac279b869aba" + "value": "e175a8642afa29dd1d438045b4a310e9593f05e24f42f51db7e1d2cc0169fa47" }, "schemaVersion": 1, "schemaStatus": "current" @@ -101,7 +101,7 @@ "kind": "plan", "digest": { "algorithm": "sha256", - "value": "0eb6e6700f912065c2986475dde1fa59d2a7eb9ff58dcb660285061018212877" + "value": "1fa66fc0a40b98af4e98ad299e4d2091ac1c2c63a772d3aaa28db9999c9c0b8e" }, "schemaVersion": 1, "schemaStatus": "current" @@ -111,7 +111,7 @@ "kind": "specification", "digest": { "algorithm": "sha256", - "value": "29f2cb8a7ec153c14b98f7c1bc63db3b2b1b72dfa71d3c98409659fa8473abdf" + "value": "76b2fa86eb896809b8b8f0108ee9c93efa2974df176d1df5b01f5551b143bdd4" }, "schemaVersion": 1, "schemaStatus": "current" @@ -121,7 +121,7 @@ "kind": "tasks", "digest": { "algorithm": "sha256", - "value": "476b7455c315389f9701220eeac136770247ed15c187ab2d7191224a7a2991c7" + "value": "85df72be9578a96e18ecbb2278175b2552dd0f7998905a0f6063740fb06f47cb" }, "schemaVersion": 1, "schemaStatus": "current" @@ -167,9 +167,9 @@ "verificationReadiness": { "status": "verificationReady", "blockingFindingIds": [], - "evidenceSupportedCount": 10, + "evidenceSupportedCount": 12, "evidenceSelfAttestedCount": 0, - "evidenceObservedCount": 10, + "evidenceObservedCount": 12, "evidenceDeferredCount": 0, "evidenceMissingCount": 0, "evidenceStaleCount": 0, @@ -256,6 +256,22 @@ "observed": true, "severity": "ready", "diagnosticIds": [] + }, + { + "id": "ED-EV011", + "obligationId": "EV011", + "state": "supported", + "observed": true, + "severity": "ready", + "diagnosticIds": [] + }, + { + "id": "ED-EV012", + "obligationId": "EV012", + "state": "supported", + "observed": true, + "severity": "ready", + "diagnosticIds": [] } ], "generatedViews": [ diff --git a/readiness/2723-fence-arming-premise-rot/summary.md b/readiness/2723-fence-arming-premise-rot/summary.md index a3790f64c..1c3fe955c 100644 --- a/readiness/2723-fence-arming-premise-rot/summary.md +++ b/readiness/2723-fence-arming-premise-rot/summary.md @@ -1,32 +1,32 @@ + - readiness/2723-fence-arming-premise-rot/agent-commands/claude/guidance.json digest:620f531e2673f2ead33c03dadfb46b29539b15983907976b491b0768687fbf38 schema:1(current) + - readiness/2723-fence-arming-premise-rot/agent-commands/codex/guidance.json digest:d46f464190bc3248c0b3b45225a21a5b13796542b4aaf9085e729612bc27e6ef schema:1(current) + - readiness/2723-fence-arming-premise-rot/analysis.json digest:4299d04e60788a91d8146002c69238621ac47132b1f47119e4cc7f50c5cdd835 schema:1(current) + - readiness/2723-fence-arming-premise-rot/ship.json digest:e9ef9c2f1df122af4f74ba659d4d80bed1db4b0ee24c265a7e42f834be63491c schema:1(current) + - readiness/2723-fence-arming-premise-rot/verify.json digest:29af17b887f11ab1e5277e1abf171b1704dbf115a8091b8db9f2a043ee02dacc schema:1(current) + - readiness/2723-fence-arming-premise-rot/work-model.json digest:44969cfd8153e5b96bd7e7b858fecb741b9c7be81392a3fa182a3021c442ad12 schema:1(current) + outputDigest: 6709ba29747fc9809d93dd1272faf3d90c226fba1c2d08fb84f061c7de8a7490 --> # Readiness Summary — 2723-fence-arming-premise-rot -**Lifecycle stage**: refresh **Outcome**: succeededWithWarnings **Disposition**: awaiting-lifecycle +**Lifecycle stage**: refresh **Outcome**: succeeded **Disposition**: refreshed-current ## Generated-view currency | View | State | |---|---| | work-model | current | | analysis | current | -| verify | missing | -| ship | missing | -| ship-verdict | missing | -| governance-handoff | missing | +| verify | current | +| ship | current | +| ship-verdict | current | +| governance-handoff | current | | agent-commands | current | | summary | current | ## Diagnostics -- refresh.notYetGenerated (info) readiness/2723-fence-arming-premise-rot/ship-verdict.json: Generated view 'readiness/2723-fence-arming-premise-rot/ship-verdict.json' has not been produced at the current lifecycle state. — Run `fsgg-sdd ship` for this work item; refresh reports downstream lifecycle views but does not generate them out of order. -- refresh.notYetGenerated (info) readiness/2723-fence-arming-premise-rot/ship.json: Generated view 'readiness/2723-fence-arming-premise-rot/ship.json' has not been produced at the current lifecycle state. — Run `fsgg-sdd ship` for this work item; refresh reports downstream lifecycle views but does not generate them out of order. -- refresh.notYetGenerated (info) readiness/2723-fence-arming-premise-rot/verify.json: Generated view 'readiness/2723-fence-arming-premise-rot/verify.json' has not been produced at the current lifecycle state. — Run `fsgg-sdd verify` for this work item; refresh reports downstream lifecycle views but does not generate them out of order. +None ## Next action -Run the next lifecycle command named by the not-yet-generated view; refresh does not generate lifecycle views out of order. +Generated views are current; rely on the refreshed readiness for the selected work item. diff --git a/readiness/2723-fence-arming-premise-rot/verify.json b/readiness/2723-fence-arming-premise-rot/verify.json index 9db525e16..e32050e88 100644 --- a/readiness/2723-fence-arming-premise-rot/verify.json +++ b/readiness/2723-fence-arming-premise-rot/verify.json @@ -41,7 +41,7 @@ "kind": "analysis", "digest": { "algorithm": "sha256", - "value": "ece93425673043c5c48a2a0b60e9a43de52e917c991da213d1752ca319c46afe" + "value": "bd4ebbc0283788b039271ca9d9a78d747e58780981f443404d99d7ba9f81c650" }, "schemaVersion": 1, "schemaStatus": "current" @@ -51,7 +51,7 @@ "kind": "workModel", "digest": { "algorithm": "sha256", - "value": "68391d56619cdd6ba31c7c02269b3593f2b3dd1a78a0e8e027f3b57432c0bfcc" + "value": "4a8811be4effb653f2a661cce9b4857735e1ae6d414e772a97c7ddc3dfa15d78" }, "schemaVersion": 1, "schemaStatus": "current" @@ -61,7 +61,7 @@ "kind": "checklist", "digest": { "algorithm": "sha256", - "value": "102e2b9535d2ab976eb0229a4f2c72ef9e85c5d494233da28306a6d65d801fa9" + "value": "ac8a50ff51a092f043c4722238acf1bd5784daa38eab80535100df7e5a286a62" }, "schemaVersion": 1, "schemaStatus": "current" @@ -71,7 +71,7 @@ "kind": "clarification", "digest": { "algorithm": "sha256", - "value": "d14483cfd6a8cf8e3c82b47a730cbc158c4e5382b7a63802b901062b84caf842" + "value": "c86f6e45846039d4590b652082a793649e1bff93f24e7f5f7ce61ebec93c121c" }, "schemaVersion": 1, "schemaStatus": "current" @@ -81,7 +81,7 @@ "kind": "evidence", "digest": { "algorithm": "sha256", - "value": "380b2bbd98c347e7d02491877620297c7b200b13ae4a9e3e2c50ac279b869aba" + "value": "e175a8642afa29dd1d438045b4a310e9593f05e24f42f51db7e1d2cc0169fa47" }, "schemaVersion": 1, "schemaStatus": "current" @@ -91,7 +91,7 @@ "kind": "plan", "digest": { "algorithm": "sha256", - "value": "0eb6e6700f912065c2986475dde1fa59d2a7eb9ff58dcb660285061018212877" + "value": "1fa66fc0a40b98af4e98ad299e4d2091ac1c2c63a772d3aaa28db9999c9c0b8e" }, "schemaVersion": 1, "schemaStatus": "current" @@ -101,7 +101,7 @@ "kind": "specification", "digest": { "algorithm": "sha256", - "value": "29f2cb8a7ec153c14b98f7c1bc63db3b2b1b72dfa71d3c98409659fa8473abdf" + "value": "76b2fa86eb896809b8b8f0108ee9c93efa2974df176d1df5b01f5551b143bdd4" }, "schemaVersion": 1, "schemaStatus": "current" @@ -111,7 +111,7 @@ "kind": "tasks", "digest": { "algorithm": "sha256", - "value": "476b7455c315389f9701220eeac136770247ed15c187ab2d7191224a7a2991c7" + "value": "85df72be9578a96e18ecbb2278175b2552dd0f7998905a0f6063740fb06f47cb" }, "schemaVersion": 1, "schemaStatus": "current" @@ -151,8 +151,8 @@ ] }, "taskGraph": { - "taskCount": 10, - "dependencyCount": 7, + "taskCount": 12, + "dependencyCount": 8, "dependenciesValid": true, "statusesValid": true, "findingIds": [] @@ -329,6 +329,7 @@ "affectedSourceIds": [ "PC-001", "PD-001", + "PD-004", "VO-001" ], "severity": "ready", @@ -378,6 +379,50 @@ "severity": "ready", "diagnosticIds": [], "correction": "" + }, + { + "id": "ED-EV011", + "obligationId": "EV011", + "state": "supported", + "observed": true, + "classifiedRequirement": false, + "journeyRequirement": false, + "recordRequirement": false, + "evidenceIds": [ + "EV011" + ], + "affectedTaskIds": [ + "T011" + ], + "affectedSourceIds": [ + "AC-001", + "FR-004", + "PD-004" + ], + "severity": "ready", + "diagnosticIds": [], + "correction": "" + }, + { + "id": "ED-EV012", + "obligationId": "EV012", + "state": "supported", + "observed": true, + "classifiedRequirement": false, + "journeyRequirement": false, + "recordRequirement": false, + "evidenceIds": [ + "EV012" + ], + "affectedTaskIds": [ + "T012" + ], + "affectedSourceIds": [ + "DEC-004" + ], + "severity": "ready", + "diagnosticIds": [], + "correction": "" } ], "testDispositions": [ @@ -556,6 +601,42 @@ "severity": "ready", "diagnosticIds": [], "correction": "" + }, + { + "id": "TD-EV011", + "obligationId": "EV011", + "state": "satisfied", + "observed": true, + "recordRequirement": false, + "evidenceIds": [ + "EV011" + ], + "affectedTaskIds": [ + "T011" + ], + "affectedRequirementIds": [ + "FR-004" + ], + "severity": "ready", + "diagnosticIds": [], + "correction": "" + }, + { + "id": "TD-EV012", + "obligationId": "EV012", + "state": "satisfied", + "observed": true, + "recordRequirement": false, + "evidenceIds": [ + "EV012" + ], + "affectedTaskIds": [ + "T012" + ], + "affectedRequirementIds": [], + "severity": "ready", + "diagnosticIds": [], + "correction": "" } ], "skillVisibility": [ @@ -590,7 +671,9 @@ "T004", "T005", "T006", - "T007" + "T007", + "T011", + "T012" ], "visibility": "visible", "sourceArtifactPath": "work/2723-fence-arming-premise-rot/tasks.yml", @@ -606,7 +689,9 @@ "T003", "T004", "T005", - "T006" + "T006", + "T011", + "T012" ], "visibility": "visible", "sourceArtifactPath": "work/2723-fence-arming-premise-rot/tasks.yml", diff --git a/readiness/2723-fence-arming-premise-rot/work-model.json b/readiness/2723-fence-arming-premise-rot/work-model.json index a0e581d33..0cc564544 100644 --- a/readiness/2723-fence-arming-premise-rot/work-model.json +++ b/readiness/2723-fence-arming-premise-rot/work-model.json @@ -53,7 +53,7 @@ "schemaStatus": "current", "sourceDigest": { "algorithm": "sha256", - "value": "102e2b9535d2ab976eb0229a4f2c72ef9e85c5d494233da28306a6d65d801fa9" + "value": "ac8a50ff51a092f043c4722238acf1bd5784daa38eab80535100df7e5a286a62" } }, { @@ -65,7 +65,7 @@ "schemaStatus": "current", "sourceDigest": { "algorithm": "sha256", - "value": "d14483cfd6a8cf8e3c82b47a730cbc158c4e5382b7a63802b901062b84caf842" + "value": "c86f6e45846039d4590b652082a793649e1bff93f24e7f5f7ce61ebec93c121c" } }, { @@ -77,7 +77,7 @@ "schemaStatus": "current", "sourceDigest": { "algorithm": "sha256", - "value": "81a7e3c234baafcb8eb48924bf99162c189899e38de510569419587c16f70da7" + "value": "64aeeaff4680cefebb297783ce03d58f325370333687feb54cf5d40fb84b9db6" } }, { @@ -89,7 +89,7 @@ "schemaStatus": "current", "sourceDigest": { "algorithm": "sha256", - "value": "0eb6e6700f912065c2986475dde1fa59d2a7eb9ff58dcb660285061018212877" + "value": "1fa66fc0a40b98af4e98ad299e4d2091ac1c2c63a772d3aaa28db9999c9c0b8e" } }, { @@ -101,7 +101,7 @@ "schemaStatus": "current", "sourceDigest": { "algorithm": "sha256", - "value": "29f2cb8a7ec153c14b98f7c1bc63db3b2b1b72dfa71d3c98409659fa8473abdf" + "value": "76b2fa86eb896809b8b8f0108ee9c93efa2974df176d1df5b01f5551b143bdd4" } }, { @@ -113,7 +113,7 @@ "schemaStatus": "current", "sourceDigest": { "algorithm": "sha256", - "value": "476b7455c315389f9701220eeac136770247ed15c187ab2d7191224a7a2991c7" + "value": "85df72be9578a96e18ecbb2278175b2552dd0f7998905a0f6063740fb06f47cb" } } ], @@ -128,8 +128,8 @@ "requirements": [ { "id": "FR-001", - "title": "Before any apply, observe the exact claim-fence context on a real pull request, prove it statically producible, confirm a full 120-minute observe-only window, census every open item pull request for a current authorization marker, record the merge-queue decision, dry-run each target, then apply hub-first and per receiver with read-back. (Stories: US-001; Acceptance: AC-001)", - "text": "Before any apply, observe the exact claim-fence context on a real pull request, prove it statically producible, confirm a full 120-minute observe-only window, census every open item pull request for a current authorization marker, record the merge-queue decision, dry-run each target, then apply hub-first and per receiver with read-back. (Stories: US-001; Acceptance: AC-001)", + "title": "Before any apply, prove the exact \u0060claim-fence\u0060 and \u0060materialize / receiver-validate\u0060 contexts are statically producible and fail closed on findings, unreadable state, malformed state, and unclassified results; census every open item pull request for a current authorization marker; record the merge-queue decision; then, only after the census is clean, dry-run and apply the hub first followed by each of the seven coordination-kit receivers with exact read-back. (covers AC-001)", + "text": "Before any apply, prove the exact \u0060claim-fence\u0060 and \u0060materialize / receiver-validate\u0060 contexts are statically producible and fail closed on findings, unreadable state, malformed state, and unclassified results; census every open item pull request for a current authorization marker; record the merge-queue decision; then, only after the census is clean, dry-run and apply the hub first followed by each of the seven coordination-kit receivers with exact read-back. (covers AC-001)", "acceptanceCriteria": [ "AC-001" ], @@ -137,7 +137,7 @@ "classification": [], "source": "work/2723-fence-arming-premise-rot/spec.md", "sourceLocation": { - "line": 31, + "line": 34, "column": 1 }, "linkedTaskIds": [ @@ -158,7 +158,7 @@ "classification": [], "source": "work/2723-fence-arming-premise-rot/spec.md", "sourceLocation": { - "line": 32, + "line": 35, "column": 1 }, "linkedTaskIds": [ @@ -179,7 +179,7 @@ "classification": [], "source": "work/2723-fence-arming-premise-rot/spec.md", "sourceLocation": { - "line": 33, + "line": 36, "column": 1 }, "linkedTaskIds": [ @@ -188,19 +188,40 @@ "linkedEvidenceIds": [ "EV003" ] + }, + { + "id": "FR-004", + "title": "The hub and receiver focused fixtures must execute the positive path, every negative verdict class, and mutations that neutralize the consumed exit status; a published refusal with a green producer is a test failure. (covers AC-001)", + "text": "The hub and receiver focused fixtures must execute the positive path, every negative verdict class, and mutations that neutralize the consumed exit status; a published refusal with a green producer is a test failure. (covers AC-001)", + "acceptanceCriteria": [ + "AC-001" + ], + "priority": null, + "classification": [], + "source": "work/2723-fence-arming-premise-rot/spec.md", + "sourceLocation": { + "line": 37, + "column": 1 + }, + "linkedTaskIds": [ + "T011" + ], + "linkedEvidenceIds": [ + "EV011" + ] } ], "decisions": [ { "id": "DEC-001", - "title": "Arm only repositories for which the exact context is both observed on a real pull request", - "decision": "Arm only repositories for which the exact context is both observed on a real pull request", + "title": "After both producers fail closed and authorization preconditions pass, activate", + "decision": "After both producers fail closed and authorization preconditions pass, activate", "requirementRefs": [], "storyRefs": [], "acceptanceRefs": [], "source": "work/2723-fence-arming-premise-rot/clarifications.md", "sourceLocation": { - "line": 31, + "line": 33, "column": 1 }, "linkedTaskIds": [ @@ -216,7 +237,7 @@ "acceptanceRefs": [], "source": "work/2723-fence-arming-premise-rot/clarifications.md", "sourceLocation": { - "line": 33, + "line": 36, "column": 1 }, "linkedTaskIds": [ @@ -232,12 +253,28 @@ "acceptanceRefs": [], "source": "work/2723-fence-arming-premise-rot/clarifications.md", "sourceLocation": { - "line": 35, + "line": 38, "column": 1 }, "linkedTaskIds": [ "T006" ] + }, + { + "id": "DEC-004", + "title": "Treat missing, stale, unreadable, malformed, and unclassified authorization as red in the", + "decision": "Treat missing, stale, unreadable, malformed, and unclassified authorization as red in the", + "requirementRefs": [], + "storyRefs": [], + "acceptanceRefs": [], + "source": "work/2723-fence-arming-premise-rot/clarifications.md", + "sourceLocation": { + "line": 40, + "column": 1 + }, + "linkedTaskIds": [ + "T012" + ] } ], "tasks": [ @@ -448,6 +485,7 @@ "sourceIds": [ "PC-001", "PD-001", + "PD-004", "VO-001" ], "requiredSkills": [ @@ -514,6 +552,62 @@ "line": 10, "column": 1 } + }, + { + "id": "T011", + "title": "Implement requirement FR-004", + "status": "done", + "owner": "sdd", + "dependencies": [], + "requirements": [ + "FR-004" + ], + "decisions": [], + "sourceIds": [ + "AC-001", + "FR-004", + "PD-004" + ], + "requiredSkills": [ + "fsharp", + "implementation" + ], + "requiredEvidence": [ + "EV011" + ], + "source": "work/2723-fence-arming-premise-rot/tasks.yml", + "sourceLocation": { + "line": 11, + "column": 1 + } + }, + { + "id": "T012", + "title": "Implement clarification decision DEC-004", + "status": "done", + "owner": "sdd", + "dependencies": [ + "T001" + ], + "requirements": [], + "decisions": [ + "DEC-004" + ], + "sourceIds": [ + "DEC-004" + ], + "requiredSkills": [ + "fsharp", + "implementation" + ], + "requiredEvidence": [ + "EV012" + ], + "source": "work/2723-fence-arming-premise-rot/tasks.yml", + "sourceLocation": { + "line": 12, + "column": 1 + } } ], "evidence": [ @@ -772,6 +866,61 @@ "line": 10, "column": 1 } + }, + { + "id": "EV011", + "kind": "verification", + "subjectType": "task", + "subjectId": "T011", + "taskRefs": [ + "T011" + ], + "requirementRefs": [ + "FR-004" + ], + "artifactRefs": [ + ".github/workflows/fsgg-claim-fence.yml", + ".github/workflows/kit-materialize.yml", + "tests/claim-fence/run.sh", + "tests/receiver-validate/run.sh" + ], + "result": "pass", + "synthetic": false, + "performanceBudget": null, + "performanceEvidenceArtifact": null, + "performanceMeasurements": [], + "rationale": null, + "source": "work/2723-fence-arming-premise-rot/evidence.yml", + "sourceLocation": { + "line": 11, + "column": 1 + } + }, + { + "id": "EV012", + "kind": "verification", + "subjectType": "task", + "subjectId": "T012", + "taskRefs": [ + "T012" + ], + "requirementRefs": [], + "artifactRefs": [ + ".github/workflows/fsgg-claim-fence.yml", + ".github/workflows/kit-materialize.yml", + "docs/coordination/reusable-workflow-contract.md" + ], + "result": "pass", + "synthetic": false, + "performanceBudget": null, + "performanceEvidenceArtifact": null, + "performanceMeasurements": [], + "rationale": null, + "source": "work/2723-fence-arming-premise-rot/evidence.yml", + "sourceLocation": { + "line": 12, + "column": 1 + } } ], "generatedViews": [ @@ -812,7 +961,7 @@ "path": "work/2723-fence-arming-premise-rot/checklist.md", "digest": { "algorithm": "sha256", - "value": "102e2b9535d2ab976eb0229a4f2c72ef9e85c5d494233da28306a6d65d801fa9" + "value": "ac8a50ff51a092f043c4722238acf1bd5784daa38eab80535100df7e5a286a62" }, "schemaVersion": 1 }, @@ -820,7 +969,7 @@ "path": "work/2723-fence-arming-premise-rot/clarifications.md", "digest": { "algorithm": "sha256", - "value": "d14483cfd6a8cf8e3c82b47a730cbc158c4e5382b7a63802b901062b84caf842" + "value": "c86f6e45846039d4590b652082a793649e1bff93f24e7f5f7ce61ebec93c121c" }, "schemaVersion": 1 }, @@ -828,7 +977,7 @@ "path": "work/2723-fence-arming-premise-rot/evidence.yml", "digest": { "algorithm": "sha256", - "value": "81a7e3c234baafcb8eb48924bf99162c189899e38de510569419587c16f70da7" + "value": "64aeeaff4680cefebb297783ce03d58f325370333687feb54cf5d40fb84b9db6" }, "schemaVersion": 1 }, @@ -836,7 +985,7 @@ "path": "work/2723-fence-arming-premise-rot/plan.md", "digest": { "algorithm": "sha256", - "value": "0eb6e6700f912065c2986475dde1fa59d2a7eb9ff58dcb660285061018212877" + "value": "1fa66fc0a40b98af4e98ad299e4d2091ac1c2c63a772d3aaa28db9999c9c0b8e" }, "schemaVersion": 1 }, @@ -844,7 +993,7 @@ "path": "work/2723-fence-arming-premise-rot/spec.md", "digest": { "algorithm": "sha256", - "value": "29f2cb8a7ec153c14b98f7c1bc63db3b2b1b72dfa71d3c98409659fa8473abdf" + "value": "76b2fa86eb896809b8b8f0108ee9c93efa2974df176d1df5b01f5551b143bdd4" }, "schemaVersion": 1 }, @@ -852,14 +1001,14 @@ "path": "work/2723-fence-arming-premise-rot/tasks.yml", "digest": { "algorithm": "sha256", - "value": "476b7455c315389f9701220eeac136770247ed15c187ab2d7191224a7a2991c7" + "value": "85df72be9578a96e18ecbb2278175b2552dd0f7998905a0f6063740fb06f47cb" }, "schemaVersion": 1 } ], "outputDigest": { "algorithm": "sha256", - "value": "a56478f5a6654ae8858c3d9c0065874b7b8756d851ad88767795abe0ff501859" + "value": "39bfa1727475ab622d0430fbe59317f258c2605543c05125fb972945d277f96c" }, "currency": "current" } diff --git a/tests/claim-fence/run.sh b/tests/claim-fence/run.sh index 91cb2bec3..00289607e 100755 --- a/tests/claim-fence/run.sh +++ b/tests/claim-fence/run.sh @@ -34,7 +34,7 @@ # `fsgg:claim` marker), which is the point: those are the confusable strings that actually exist # on real items, not ones invented to be easy to reject. # -# Section K asserts the OBSERVE-ONLY boundary structurally over the workflow file itself, and does it +# Section K asserts the fail-closed boundary structurally over the workflow file itself, and does it # in both directions too: a mutated copy that enforces its verdict must be caught, or the assertion # is another absence that a broken check would satisfy. set -euo pipefail @@ -636,8 +636,8 @@ printf '