swarmheart/leviathan-write-projection #26

New issue

Closed

opened 2026-05-09 23:27:03 +02:00 by codex · 1 comment

codex commented

2026-05-09 23:27:03 +02:00

Collaborator

Parent: #2
Wave: 5 - Swarmheart / Leviathan
Depends on: #24, #25, #4, #15

Summary

Add controlled Leviathan writes through the Kan-ductor Integration API with audit and drift awareness.

Scope

Apply approved projection changes to Kan-ductor through narrow Integration API tools.
Use machine identity and scoped credential model.
Write audit events for every create/move/comment/projection action.
Respect drift: flag and require decision instead of silently overwriting manual Kan moves.

Non-goals

No bulk mutation without dry-run preview.
No delete/archive by default.
No autonomous correction of Piotr's board.
No making Kan-ductor the Swarmheart source of truth.

Acceptance Criteria

Projection writes are idempotent.
Every mutation returns auditPublicId and links to source projection input.
Drift blocks or flags unsafe writes according to contract.
Rollback path for last projection batch is documented.

Tests / Smoke

E2E projection smoke on non-production board.
Idempotency replay test.
Audit completeness test.
Manual production write smoke only after explicit owner approval.

Rollback

Disable write projection and revert affected projection batch using recorded audit/idempotency data where safe.

Owner Gates

Hard stop before production writes, credential issuance, deploy/restart, or trust-boundary changes.

Parent: #2 Wave: 5 - Swarmheart / Leviathan Depends on: #24, #25, #4, #15 ## Summary Add controlled Leviathan writes through the Kan-ductor Integration API with audit and drift awareness. ## Scope - Apply approved projection changes to Kan-ductor through narrow Integration API tools. - Use machine identity and scoped credential model. - Write audit events for every create/move/comment/projection action. - Respect drift: flag and require decision instead of silently overwriting manual Kan moves. ## Non-goals - No bulk mutation without dry-run preview. - No delete/archive by default. - No autonomous correction of Piotr's board. - No making Kan-ductor the Swarmheart source of truth. ## Acceptance Criteria - Projection writes are idempotent. - Every mutation returns auditPublicId and links to source projection input. - Drift blocks or flags unsafe writes according to contract. - Rollback path for last projection batch is documented. ## Tests / Smoke - E2E projection smoke on non-production board. - Idempotency replay test. - Audit completeness test. - Manual production write smoke only after explicit owner approval. ## Rollback Disable write projection and revert affected projection batch using recorded audit/idempotency data where safe. ## Owner Gates Hard stop before production writes, credential issuance, deploy/restart, or trust-boundary changes.

codex referenced this issue

2026-05-09 23:27:13 +02:00

[meta] Kan-ductor maturity waves #2

pdurlej commented

2026-05-10 14:18:58 +02:00

Owner

Resolved by PR #50 (feat: add controlled leviathan projection apply), landed on main via chain drain PR #52 (2026-05-10).

⚠️ Follow-up p0 (security/scope hard blocker): 3+3 review flagged that real apply reuses generic cards:create/cards:move scopes and lacks dedicated projection write authority/feature gate. Plus: secret/gate warnings do not block writes, weak drift classifier dependency, partial batch failure recovery, maxTasks check happens after preview construction. Tracked separately as p0 follow-up issues.

Closing this acceptance issue. Security hardening tracked elsewhere.

— Prof Opus 🦍🎓 (war-room cleanup)

Resolved by **PR #50** (`feat: add controlled leviathan projection apply`), landed on main via chain drain PR #52 (2026-05-10). ⚠️ **Follow-up p0** (security/scope hard blocker): 3+3 review flagged that real apply reuses generic `cards:create`/`cards:move` scopes and lacks dedicated projection write authority/feature gate. Plus: secret/gate warnings do not block writes, weak drift classifier dependency, partial batch failure recovery, maxTasks check happens after preview construction. Tracked separately as p0 follow-up issues. Closing this acceptance issue. Security hardening tracked elsewhere. — Prof Opus 🦍🎓 (war-room cleanup)

pdurlej closed this issue

2026-05-10 14:18:59 +02:00