docs: close the contract-first checkpoint #118

Merged

clawdie merged 1 commit from docs/retire-contract-first-checkpoint into main 2026-10-06 18:49:31 +02:00

Conversation 1 Commits 1 Files changed 2 +58 -53

clawdie commented 2026-10-06 18:24:38 +02:00

Owner

Copy link

Closes the 29.sep.2026 checkpoint as a record rather than leaving it as "current paused work".

Marked complete

• Housekeeping — remote tips verified; the two documentation branches landed: colibri docs/evidence/agent-policy-evidence-review-2026-09-29/ and bherdr docs/VENDOR-HYGIENE-REVIEW-2026-09-29.md.
• task-* / raw sk- marker — already fixed; internal/agent/evidence_test.go "accepts task ID in run id", go test ./internal/agent/... ok.
• Durable evidence tree — PRs #112, #115, #116, #117 (evidence gate, coverage reporting, evidence-manifest.v2 with required kind, kind-scoped Jev blocks, curated-hash manifests).

Left pending (unchanged, not this change)

• colibri pure evidence assembly (Go domain logic)
• bherdr first contract slice
• FreeBSD lane native validation
• Fira Code fixture provenance

Correction recorded

Live Forgejo heads are only main + docs/okf-freshness-review (the latter kept deliberately when #105 was closed). An earlier claim of eight lingering doc/CI branches came from stale local remote-tracking refs, not the server; those refs are now pruned. docs/README.md no longer presents the checkpoint as current paused work.

Gates

check-format pass · check-dates --strict clean · wiki-lint --strict clean (763/0) · check-okf advisory exit 0 · ci-checks.sh All checks passed.

Not started (blocked on operator)

Credential-lifecycle rollout — needs the three inputs (test principal, target Forgejo host, repository/branch/capability scope) before design begins.

Closes the 29.sep.2026 checkpoint as a record rather than leaving it as "current paused work". ### Marked complete - **Housekeeping** — remote tips verified; the two documentation branches landed: colibri `docs/evidence/agent-policy-evidence-review-2026-09-29/` and bherdr `docs/VENDOR-HYGIENE-REVIEW-2026-09-29.md`. - **`task-*` / raw `sk-` marker** — already fixed; `internal/agent/evidence_test.go` "accepts task ID in run id", `go test ./internal/agent/...` ok. - **Durable evidence tree** — PRs **#112, #115, #116, #117** (evidence gate, coverage reporting, `evidence-manifest.v2` with required `kind`, kind-scoped Jev blocks, curated-hash manifests). ### Left pending (unchanged, not this change) - colibri pure evidence assembly (Go domain logic) - bherdr first contract slice - FreeBSD lane native validation - Fira Code fixture provenance ### Correction recorded Live Forgejo heads are only `main` + `docs/okf-freshness-review` (the latter kept deliberately when #105 was closed). An earlier claim of eight lingering doc/CI branches came from **stale local remote-tracking refs**, not the server; those refs are now pruned. `docs/README.md` no longer presents the checkpoint as current paused work. ### Gates check-format pass · check-dates --strict clean · wiki-lint --strict clean (763/0) · check-okf advisory exit 0 · `ci-checks.sh` All checks passed. ### Not started (blocked on operator) Credential-lifecycle rollout — needs the three inputs (test principal, target Forgejo host, repository/branch/capability scope) before design begins.

clawdie added 1 commit 2026-10-06 18:24:38 +02:00

docs: close the contract-first checkpoint ... fb732ade4a

The 29.sep.2026 checkpoint is no longer current paused work. Retire it as a
closed record and record what has since landed.

Completed:
- housekeeping: remote tips verified; the two documentation branches landed
  (colibri docs/evidence/agent-policy-evidence-review-2026-09-29, bherdr
  docs/VENDOR-HYGIENE-REVIEW-2026-09-29.md).
- evidence validation hardened: ordinary task-* values no longer caught by the
  sk- marker (internal/agent/evidence_test.go).
- durable evidence tree formalized: PRs #112, #115, #116, #117.

Still pending (unchanged, not this change):
- colibri pure evidence assembly; bherdr first contract slice; FreeBSD lane
  native validation; Fira Code fixture provenance.

Also record the live branch state (only main + docs/okf-freshness-review; the
latter kept deliberately when #105 was closed), correcting an earlier stale
remote-tracking claim.

docs/README.md no longer presents the checkpoint as current paused work.

Gates: check-format pass, check-dates --strict clean, wiki-lint --strict clean
(763/0), check-okf advisory exit 0, ci-checks.sh All checks passed.

clawdie force-pushed docs/retire-contract-first-checkpoint from fb732ade4a to eab11c0b93 2026-10-06 18:24:57 +02:00 Compare

clawdie commented 2026-10-06 18:36:17 +02:00

Author

Owner

Copy link

Clarification: "the named credential policy" is two policies, not one

This checkpoint's pending line bundles two different objects. Worth separating before the item is picked up:

• Object 1 — source-class policy (ops). docs/wiki/credentials.md (repo-keys vs host-config, the "production refused from repo-keys" guardrail). It is already written; the only change is status: proposed → accepted, enforced in the resolver. Operator call.
• Object 2 — named credential policy (code). Which env-var names count as credentials. This is the reading the handoff sentence points at: secretMarkers sits in the same evidence-validation bullet.

Verified Object-2 footprint is wider than a three-site duplication:

Site	Set
internal/agent/evidence.go secretMarkers	3 names + gw-live-
internal/agent/policy.go ScrubEnv	3 names
internal/agent/marker_internal_test.go	oracle regex
pkg/gate/redact.go envMarkers	3 names + gw-live- — a deliberate mirror; pkg/gate cannot import internal/agent (Go internal/ visibility) and must stay stdlib-only
scripts/check-evidence.py SECRET_PATTERNS	cross-language: generic *_API_KEY + sk-/bearer/private-key

Consequences:

1. "Single-source it in internal/agent" cannot work — the corpus must move to a public package that internal/agent and pkg/gate both import.
2. No parity test exists today, so the pkg/gate mirror can drift silently.
3. The evidence-gate Python scanner is itself a credential-name consumer, so the evidence-gate thread and Object 2 overlap here (they are not fully independent).

Object 1 (ratify + flip status) and Object 2 (corpus package + parity test + Python migration) stay two separate items. The Object-2 design is drafted separately for review; nothing here is implemented.

### Clarification: "the named credential policy" is two policies, not one This checkpoint's pending line bundles two different objects. Worth separating before the item is picked up: - **Object 1 — source-class policy (ops).** `docs/wiki/credentials.md` (`repo-keys` vs `host-config`, the "production refused from `repo-keys`" guardrail). It is already written; the only change is `status: proposed` → accepted, enforced in the resolver. **Operator call.** - **Object 2 — named credential policy (code).** *Which env-var names count as credentials.* This is the reading the handoff sentence points at: `secretMarkers` sits in the same evidence-validation bullet. Verified Object-2 footprint is **wider than a three-site duplication**: | Site | Set | | --- | --- | | `internal/agent/evidence.go` `secretMarkers` | 3 names + `gw-live-` | | `internal/agent/policy.go` `ScrubEnv` | 3 names | | `internal/agent/marker_internal_test.go` | oracle regex | | **`pkg/gate/redact.go` `envMarkers`** | 3 names + `gw-live-` — a **deliberate mirror**; `pkg/gate` cannot import `internal/agent` (Go `internal/` visibility) and must stay stdlib-only | | **`scripts/check-evidence.py` `SECRET_PATTERNS`** | cross-language: generic `*_API_KEY` + `sk-`/bearer/private-key | Consequences: 1. "Single-source it in `internal/agent`" **cannot work** — the corpus must move to a **public package** that `internal/agent` and `pkg/gate` both import. 2. **No parity test exists** today, so the `pkg/gate` mirror can drift silently. 3. The evidence-gate Python scanner is itself a credential-name consumer, so the evidence-gate thread and Object 2 overlap here (they are not fully independent). Object 1 (ratify + flip status) and Object 2 (corpus package + parity test + Python migration) stay **two separate items**. The Object-2 design is drafted separately for review; nothing here is implemented.

clawdie merged commit ad60706751 into main 2026-10-06 18:49:31 +02:00

clawdie deleted branch docs/retire-contract-first-checkpoint 2026-10-06 18:49:31 +02:00

clawdie referenced this pull request from a commit 2026-10-06 18:49:32 +02:00

Merge pull request 'docs: close the contract-first checkpoint' (#118) from docs/retire-contract-first-checkpoint into main

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels

No items

No labels

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

clawdie/colibri!118

No description provided.