Ting/Jostoph
Watch
2
0
Fork
You've already forked Jostoph
 2
Code Issues 57 Pull requests Projects Releases Packages Wiki Activity Actions

Detect canonical lifecycle drift C01-C08 #105

New issue
Closed
opened 2026-08-29 17:05:57 +00:00 by larandar · 1 comment
larandar commented 2026-08-29 17:05:57 +00:00
Owner
Copy link

Objective

Detect and classify the canonical C01-C08 reconciliation conditions without minting, widening, or independently repairing authority.

Scope

Compare declared principal/grant state with active leases, Vedanta operations, Kanidm token IDs, adapter generations, and Forge events. Emit the exact drift class and affected layer. The lifecycle reconciler may separately request only contract-permitted invalidation.

Acceptance criteria

  • C01-C08 each has a deterministic fixture and stable result code.
  • Token-without-lease, lease-without-token, generation mismatch, stale digest, unknown binding, expired acceptance, revoked use, and suppressed-principal authority are distinguishable.
  • Partial revocation remains revocation_pending with the still-live layer named.
  • Detection never creates a credential, grant, membership, projection, or wider scope.

Spec Delta

This leaf is only drift detection. Named-persona acceptance and old-path exit rendering move to #109.

OpenSpec

OpenSpec 103

## Objective Detect and classify the canonical C01-C08 reconciliation conditions without minting, widening, or independently repairing authority. ## Scope Compare declared principal/grant state with active leases, Vedanta operations, Kanidm token IDs, adapter generations, and Forge events. Emit the exact drift class and affected layer. The lifecycle reconciler may separately request only contract-permitted invalidation. ## Acceptance criteria - [ ] C01-C08 each has a deterministic fixture and stable result code. - [ ] Token-without-lease, lease-without-token, generation mismatch, stale digest, unknown binding, expired acceptance, revoked use, and suppressed-principal authority are distinguishable. - [ ] Partial revocation remains `revocation_pending` with the still-live layer named. - [ ] Detection never creates a credential, grant, membership, projection, or wider scope. ## Spec Delta This leaf is only drift detection. Named-persona acceptance and old-path exit rendering move to #109. ## OpenSpec [OpenSpec 103](https://jo.et0.pw/Ting/Jostoph/wiki/OpenSpec-103-forge-identity-lifecycle-audit)
larandar changed title from Report lifecycle drift and named-persona production acceptance to Detect canonical lifecycle drift C01-C08 2026-08-29 20:06:21 +00:00
larandar commented 2026-09-20 03:47:14 +00:00
Author
Owner
Copy link

Closed under audit 2026-09-19/20, G13. Merged PR#120 delivers deterministic C01-C08 lifecycle drift detection for this record. Residual D3 and the unrun nix flake check are split to successor issue #125 (#125): Residue of Session #103: D3 decision + nix flake check (audit G13).

<!-- larandar:groom:v1 --> Closed under audit 2026-09-19/20, G13. Merged PR#120 delivers deterministic C01-C08 lifecycle drift detection for this record. Residual D3 and the unrun nix flake check are split to successor issue #125 (https://jo.et0.pw/Ting/Jostoph/issues/125): Residue of Session #103: D3 decision + nix flake check (audit G13).
Sign in to join this conversation.
No Branch/Tag specified
Branches Tags
main
fastlane
tango/103-lifecycle-audit
No results found.
Labels
Clear labels
  
Compat/Breaking
Breaking change that won't be backward compatible

  
Kind/Bug
Something is not working

  
Kind/Documentation
Documentation changes

  
Kind/Enhancement
Improve existing functionality

  
Kind/Feature
New functionality

  
Kind/Security
This is security issue

  
Kind/Testing
Issue or pull request related to testing

  
Meta/Campaign
Campaign grouping node; dependencies name its direct Epics

  
Meta/Epic
Epic grouping node; dependencies name its direct Sessions

  
Meta/Session
Session delivery bundle; dependencies name its direct leaf issues

  
Priority/Critical
The priority is critical

  
Priority/High
The priority is high

  
Priority/Low
The priority is low

  
Priority/Medium
The priority is medium

  
Reviewed/Confirmed
Issue has been confirmed

  
Reviewed/Curated
PR LABEL: merge by rebase/ff to preserve the commit line; absence means squash. Set by the AUTHOR. (Curation itself is a duty on every PR — the label only picks the merge style.)

  
Reviewed/Duplicate
This issue or pull request already exists

  
Reviewed/Invalid
Invalid issue

  
Reviewed/Won't Fix
This issue won't be fixed

  
Scope/Campaign
Umbrella issue grouping a coherent multi-issue campaign.

  
Status/Abandoned
Somebody has started to work on this but abandoned work

  
Status/Blocked
Something is blocking this issue or pull request

  
Status/Conflicted
STATE: steward rebase failed; work returned to its agent, with evidence.

  
Status/In Progress
STATE: claimed, workspace active. Exactly one assignee, or none when idle.

  
Status/In Review
STATE: PR open against fastlane. Set by steward (PR webhook).

  
Status/Need Grooming
Issue body and comments do not yet conform to the Deliverable record; grooming required.

  
Status/Need More Info
Feedback is required to reproduce issue or to continue work

  
Status/Ready
Ready for execution; no known blocker prevents useful work from starting.

No labels
Compat/Breaking
Kind/Bug
Kind/Documentation
Kind/Enhancement
Kind/Feature
Kind/Security
Kind/Testing
Meta/Campaign
Meta/Epic
Meta/Session
Priority/Critical
Priority/High
Priority/Low
Priority/Medium
Reviewed/Confirmed
Reviewed/Curated
Reviewed/Duplicate
Reviewed/Invalid
Reviewed/Won't Fix
Scope/Campaign
Status/Abandoned
Status/Blocked
Status/Conflicted
Status/In Progress
Status/In Review
Status/Need Grooming
Status/Need More Info
Status/Ready
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Blocks
#103 Session: Independent Forge identity lifecycle audit and reconciliation
Ting/Jostoph
#109 Render production acceptance and old-path exit readiness
Ting/Jostoph
#116 Epic: Jostoph estate-wide toolchain lock
Ting/Jostoph
Depends on
#107 Materialize the lifecycle correlation view
Ting/Jostoph
Reference
Ting/Jostoph#105
No description provided.