tegwick
c1e83c16bf
Approve CCR-2026-0050 for Access scope (sent to railiance-platform).
Add the exact consumer pin derived at candidate 84c78e0 and an offline
projection from the Platform custody receipt to the secrets-engine
pdp-trust.v1 bytes plus a public receipt. No key, rollout or admission.
T07 waits on founder decision 4fab263d.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 809600@bnt-lap001
Assistant-Session: 40ba228f-c8a0-4ec9-bb29-3129951afdc4
24 lines
1.8 KiB
JSON
24 lines
1.8 KiB
JSON
{
|
|
"schema": "access-engine.signer-public-pin.v1",
|
|
"purpose": "Exact issuer/policy pin the retained Secrets lifecycle PDP signs under. Input to tools/prepare_signer_public_receipt.py; never a key and never consumer trust by itself.",
|
|
"expected_kid": "flex-auth-lifecycle-20261016-r1",
|
|
"pin": {
|
|
"evaluator": "flex-auth/local",
|
|
"mode": "standalone",
|
|
"policy_package": "secrets-engine.catalog-lane.lifecycle",
|
|
"policy_version": "v2",
|
|
"policy_package_digest": "sha256:bd11c5fe77ce6439c65fea225ad6b71d2110efc5e7b5bc9b499c59cd0a53b8b4"
|
|
},
|
|
"derivation": {
|
|
"date": "2026-10-21",
|
|
"source_revision": "84c78e072c8f3daf2bc3b90f8efc8fbeb16c3cf0",
|
|
"image": "forgejo.coulomb.social/coulomb/flex-auth@sha256:09a83b273740133518cc7e7915fb211381e06545d347d2dd1974042525ac981f",
|
|
"policy_file": "examples/secrets-engine/policy_package.md",
|
|
"policy_file_sha256": "sha256:657fa9312c9dcabee059ec31c89ee13396fe9aa54d852edc9e6559a74bbc139a",
|
|
"command": "git archive 84c78e0 | tar -x -C <dir>; cd <dir>; go run ./cmd/access-engine check -policy examples/secrets-engine/policy_package.md -registry examples/secrets-engine/registry_snapshot.json -request examples/secrets-engine/check_request_allow_rotate.json",
|
|
"result": "provenance fields above; signature {mode: unsigned} (no key in source)",
|
|
"rollout_manifest": "the-custodian docs/changes/netkingdom-target-2026-10-16/access-native-admission/rollout-r2/manifest.json sha256:5be7a7f438624dcb35b7dbc96e7c9e5a8e2d5d1b1966cb4338aa5aecbe3a8b59",
|
|
"rollout_activation_values_sha256": "sha256:e76a30967add800ed8b588368757e7a5fa0ce4d8305ef658b5a4a08e377eb5b8",
|
|
"confirmation_required": "The first native signed allow/deny must carry these exact provenance values; tools/verify_native_signer_receipt.py refuses otherwise. A changed policy package, image or source is a new pin and a new receipt."
|
|
}
|
|
}
|