coulomb/access-engine
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

FLEX-WP-0024: CCR-2026-0050 Access review, signer public receipt and T07 founder gate
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
Approve CCR-2026-0050 for Access scope (sent to railiance-platform).
Add the exact consumer pin derived at candidate 84c78e0 and an offline
projection from the Platform custody receipt to the secrets-engine
pdp-trust.v1 bytes plus a public receipt. No key, rollout or admission.
T07 waits on founder decision 4fab263d.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 809600@bnt-lap001
Assistant-Session: 40ba228f-c8a0-4ec9-bb29-3129951afdc4
This commit is contained in:
tegwick 2026-10-21 01:22:46 +02:00
parent c130b7d739
commit c1e83c16bf
6 changed files with 236 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

36
workplans/FLEX-WP-0024-decision-envelope-authenticity.md
View file

@ -15,7 +15,7 @@ related_workplans:
- FLEX-WP-0019
- FLEX-WP-0023
created: "2026-09-06"
updated: "2026-10-18"
updated: "2026-10-21"
state_hub_workstream_id: "90577acd-6910-548d-a13e-1dbfdfb8ed27"
---
@ -365,3 +365,37 @@ Existing rollout R2/image84 and their approvals remain frozen; they do not admit
this source or a new image. T06 and all native custody/trust/rollout/recovery gates
remain open. Forgejo's complete resource/operation/inverse and session-revocation
coverage remains NK48-T43 / RAPPS16-T09 work.
2026-10-21 Access owner review of CCR-2026-0050 (railiance-platform fd2f808; CCR
sha256 66b3ea12d3f3bb870fa0aa0e7598e32abdb9bf39efe1adcfac286407abeb98e4, policy
b9f816da…85ef, native plan 22306d50…06e5): **approved for Access scope** and sent to
`railiance-platform` via State Hub. Secret name/key/mount/0440/kid in the CCR
projection match frozen rollout R2 activation values byte for byte; candidate
84c78e0 carries `--envelope-signing-key-file`. Public receipt prepared:
`docs/native-signer-public-pin.json` (pin derived by running `check` at 84c78e0:
`flex-auth/local`, `standalone`, `secrets-engine.catalog-lane.lifecycle`, `v2`,
`sha256:bd11c5fe…b8b4`) and `tools/prepare_signer_public_receipt.py`, which projects
the Platform `signer-cas-receipt.v1` into the exact `secrets-engine.pdp-trust.v1`
bytes plus `access-engine.signer-public-receipt.v1` (kid, public key, pin,
provenance hashes only). Rollout proposal stays R2; no parallel one. **No key exists
yet**; no rollout, trust or admission happened. Founder go is T07.
## 7. Founder go for the attended signer rollout
```task
id: FLEX-WP-0024-T07
status: wait
priority: high
needs_human: true
decision_id: "4fab263d-686b-4a06-9cea-8df619c87c03"
```
Founder go/no-go for one attended window, after Platform custody exists under
CCR-2026-0050 (Platform-owned approval, not this task). Executes frozen R2 exactly:
stop to 0, Platform CAS0 under fence, activation values (image `sha256:09a83b27…`,
kid `flex-auth-lifecycle-20261016-r1`). Rollback to the stopped revision, then the
reviewed unsigned `05a03a87` restore; never re-CAS or restore a seed. Afterwards:
`prepare_signer_public_receipt.py` → commit receipt under `docs/evidence/` → founder
signs `pdp-trust.json` (SECRETS-WP-0014-T04, decision e4eee965) →
`verify_native_signer_receipt.py` on one native allow and deny. Then T06 closes.