Draft unsigned credential and decision sign-off batches.
INFD-WP-0002 T01–T02: eight one-question memos for net-kingdom-admins, batch contract without approve-all, no live bind (T08 still open). Assistant: grok Assistant-Session: 01a09dc1-b21e-77e1-919e-fcad2f82b267
This commit is contained in:
parent
79f081850b
commit
27b8e916cc
24 changed files with 765 additions and 3 deletions
60
docs/batches/2026-09-14/credentials/index.json
Normal file
60
docs/batches/2026-09-14/credentials/index.json
Normal file
|
|
@ -0,0 +1,60 @@
|
|||
{
|
||||
"kind": "informed-decision-batch",
|
||||
"id": "infd-batch-2026-09-14-credentials",
|
||||
"review_group": "net-kingdom-admins",
|
||||
"status": "draft-unsigned",
|
||||
"submitted": false,
|
||||
"one_question_per_memo": true,
|
||||
"approve_all_forbidden": true,
|
||||
"agent_disposition_forbidden": true,
|
||||
"ordinal": [
|
||||
{
|
||||
"n": 1,
|
||||
"memo_id": "infd-20260914-c01",
|
||||
"workplan": "SECRETS-WP-0010",
|
||||
"task": "Admit and verify real native delivery",
|
||||
"hub_task_prefix": "2aa6d2d3",
|
||||
"question": "Admit real native OpenRouter delivery for intelligence-radar on the existing reviewed lane?",
|
||||
"memo": "infd-20260914-c01.memo.json",
|
||||
"packet": "infd-20260914-c01.packet.md",
|
||||
"packet_hash": "sha256:32081b73066a49097e3564eac937cc34bffe72ff2be1b84b05a0999e578bda99",
|
||||
"required_highlight": "infd-20260914-c01-h1"
|
||||
},
|
||||
{
|
||||
"n": 2,
|
||||
"memo_id": "infd-20260914-c02",
|
||||
"workplan": "RPF-WP-0035",
|
||||
"task": "RPF-WP-0035-T02",
|
||||
"hub_task_prefix": "e0c82ea9",
|
||||
"question": "Accept provisioning of the secrets-engine service JWT login on the reviewed credential lane?",
|
||||
"memo": "infd-20260914-c02.memo.json",
|
||||
"packet": "infd-20260914-c02.packet.md",
|
||||
"packet_hash": "sha256:9a3159c1a8d2f1f8782469e2eb9e04e6cdede40b6bb9cdb872ae1f1bf3b73ee5",
|
||||
"required_highlight": "infd-20260914-c02-h1"
|
||||
},
|
||||
{
|
||||
"n": 3,
|
||||
"memo_id": "infd-20260914-c03",
|
||||
"workplan": "NK-WP-0032",
|
||||
"task": "NK-WP-0032-T03",
|
||||
"hub_task_prefix": "73b77110",
|
||||
"question": "Apply the live OpenBao role addition already specified for the operator-tunneled browser callback?",
|
||||
"memo": "infd-20260914-c03.memo.json",
|
||||
"packet": "infd-20260914-c03.packet.md",
|
||||
"packet_hash": "sha256:3e93888104d59854b8c191a98a46b73fed863df1bc76267b3fc24b070c676d3d",
|
||||
"required_highlight": "infd-20260914-c03-h1"
|
||||
},
|
||||
{
|
||||
"n": 4,
|
||||
"memo_id": "infd-20260914-c04",
|
||||
"workplan": "WARDEN-WP-0027",
|
||||
"task": "WARDEN-WP-0027-T02",
|
||||
"hub_task_prefix": "cae498ee",
|
||||
"question": "Attend the graded lockdown / break-glass seal for ops-warden trust-root work?",
|
||||
"memo": "infd-20260914-c04.memo.json",
|
||||
"packet": "infd-20260914-c04.packet.md",
|
||||
"packet_hash": "sha256:bc6edfa538a6c334a916becf51dc485ad43da49cd08411843aaf1ed56bf25e10",
|
||||
"required_highlight": "infd-20260914-c04-h1"
|
||||
}
|
||||
]
|
||||
}
|
||||
|
|
@ -0,0 +1 @@
|
|||
{"approval_binding_digest":null,"approval_id":null,"binding":{"justification":null,"principal":{"display_name":"Named reviewer in net-kingdom-admins","id":"pending-human-session","identifiers":[],"kind":"person","role":"reviewer"},"target":{"environment":"prod","id":"catalog:openrouter-llm-connect","kind":"secret-catalog-lane","label":"Existing llm-connect OpenRouter lane","requires_new_bind":false},"terms":null},"binding_level":"organizational","brief":"SECRETS-WP-0010 native delivery is waiting on a human admit. KeyCape redirects pass. This memo does not display, mint, or rotate a credential. It only asks whether the already-reviewed apply/verify/exec packets may proceed to live native delivery.","highlights":[{"id":"infd-20260914-c01-h1","item_id":"infd-20260914-c01-packet","locator":{"kind":"work_record","task":"Admit and verify real native delivery","workplan":"SECRETS-WP-0010"},"note":"No secret value is in this packet. Admit is not a mint.","required_ack":true,"severity":"critical"}],"id":"infd-20260914-c01","locale":"en","packet":[{"hash":"sha256:32081b73066a49097e3564eac937cc34bffe72ff2be1b84b05a0999e578bda99","item_id":"infd-20260914-c01-packet","label":"infd-20260914-c01-packet"}],"question":"Admit real native OpenRouter delivery for intelligence-radar on the existing reviewed lane?","requested_act":"approve","sealed":false,"step_kind":"approve","ui_release":"informed-decision@0.2.0","version":1}
|
||||
|
|
@ -0,0 +1,16 @@
|
|||
# SECRETS-WP-0010 — admit native delivery
|
||||
|
||||
Blocking workplan: SECRETS-WP-0010
|
||||
Blocking task: Admit and verify real native delivery (hub prefix 2aa6d2d3)
|
||||
|
||||
## Question
|
||||
Admit real native OpenRouter delivery for intelligence-radar on the existing reviewed lane?
|
||||
|
||||
## One act
|
||||
Authorize the operator in `net-kingdom-admins` to complete the already-prepared
|
||||
apply / verify / exec packets. This is not a new OpenBao path and not a key mint.
|
||||
|
||||
## Must not
|
||||
- Paste or display credential material
|
||||
- Call OpenRouter inference
|
||||
- Treat `ops-warden` as a secret vendor
|
||||
|
|
@ -0,0 +1 @@
|
|||
{"approval_binding_digest":null,"approval_id":null,"binding":{"justification":null,"principal":{"display_name":"Named reviewer in net-kingdom-admins","id":"pending-human-session","identifiers":[],"kind":"person","role":"reviewer"},"target":{"environment":"prod","id":"rpf-wp-0035-t02","kind":"credential-lane","label":"secrets-engine service JWT login","requires_new_bind":false},"terms":null},"binding_level":"organizational","brief":"RPF-WP-0035-T02 waits on accepting and provisioning secrets-engine service JWT login. This memo is the accept question only. Provisioning remains the platform owner's act after bind.","highlights":[{"id":"infd-20260914-c02-h1","item_id":"infd-20260914-c02-packet","locator":{"kind":"work_record","task":"RPF-WP-0035-T02","workplan":"RPF-WP-0035"},"note":"Accept is not permission to invent a client_secret in this memo.","required_ack":true,"severity":"critical"}],"id":"infd-20260914-c02","locale":"en","packet":[{"hash":"sha256:9a3159c1a8d2f1f8782469e2eb9e04e6cdede40b6bb9cdb872ae1f1bf3b73ee5","item_id":"infd-20260914-c02-packet","label":"infd-20260914-c02-packet"}],"question":"Accept provisioning of the secrets-engine service JWT login on the reviewed credential lane?","requested_act":"approve","sealed":false,"step_kind":"approve","ui_release":"informed-decision@0.2.0","version":1}
|
||||
|
|
@ -0,0 +1,15 @@
|
|||
# RPF-WP-0035-T02 — accept JWT login lane
|
||||
|
||||
Blocking workplan: RPF-WP-0035
|
||||
Blocking task: RPF-WP-0035-T02 (hub prefix e0c82ea9)
|
||||
|
||||
## Question
|
||||
Accept provisioning of the secrets-engine service JWT login on the reviewed credential lane?
|
||||
|
||||
## One act
|
||||
Organizational accept that this lane may be provisioned by its owner. The memo
|
||||
does not contain a JWT, client secret, or OpenBao policy body.
|
||||
|
||||
## Must not
|
||||
- Embed a token
|
||||
- Collapse T02 with T03 Fluid lane or T06 reader admission
|
||||
|
|
@ -0,0 +1 @@
|
|||
{"approval_binding_digest":null,"approval_id":null,"binding":{"justification":null,"principal":{"display_name":"Named reviewer in net-kingdom-admins","id":"pending-human-session","identifiers":[],"kind":"person","role":"reviewer"},"target":{"environment":"prod","id":"nk-wp-0032-t03","kind":"openbao-role","label":"OpenBao role addition for operator-tunneled callback","requires_new_bind":false},"terms":null},"binding_level":"organizational","brief":"NK-WP-0032-T03 applies a live OpenBao role addition. This memo asks only whether that apply may proceed. The role body stays in the owning repo; it is not copied here.","highlights":[{"id":"infd-20260914-c03-h1","item_id":"infd-20260914-c03-packet","locator":{"kind":"work_record","task":"NK-WP-0032-T03","workplan":"NK-WP-0032"},"note":"Apply is one role addition, not a general OpenBao admin grant.","required_ack":true,"severity":"critical"}],"id":"infd-20260914-c03","locale":"en","packet":[{"hash":"sha256:3e93888104d59854b8c191a98a46b73fed863df1bc76267b3fc24b070c676d3d","item_id":"infd-20260914-c03-packet","label":"infd-20260914-c03-packet"}],"question":"Apply the live OpenBao role addition already specified for the operator-tunneled browser callback?","requested_act":"approve","sealed":false,"step_kind":"approve","ui_release":"informed-decision@0.2.0","version":1}
|
||||
|
|
@ -0,0 +1,15 @@
|
|||
# NK-WP-0032-T03 — apply live OpenBao role
|
||||
|
||||
Blocking workplan: NK-WP-0032
|
||||
Blocking task: NK-WP-0032-T03 (hub prefix 73b77110)
|
||||
|
||||
## Question
|
||||
Apply the live OpenBao role addition already specified for the operator-tunneled browser callback?
|
||||
|
||||
## One act
|
||||
Authorize the NetKingdom owner to apply the already-specified role. This memo
|
||||
does not include the policy HCL or any secret id.
|
||||
|
||||
## Must not
|
||||
- Broaden to unattended public OpenBao UI
|
||||
- Treat this as NK-WP-0032-T04 evidence return
|
||||
|
|
@ -0,0 +1 @@
|
|||
{"approval_binding_digest":null,"approval_id":null,"binding":{"justification":null,"principal":{"display_name":"Named reviewer in net-kingdom-admins","id":"pending-human-session","identifiers":[],"kind":"person","role":"reviewer"},"target":{"environment":"prod","id":"warden-wp-0027-t02","kind":"trust-root","label":"ops-warden graded lockdown / break-glass","requires_new_bind":false},"terms":null},"binding_level":"organizational","brief":"WARDEN-WP-0027-T02 is attended seal work. This memo asks the reviewer to attend that seal sitting. ops-warden still issues SSH certificates only; this is not a request for an API key.","highlights":[{"id":"infd-20260914-c04-h1","item_id":"infd-20260914-c04-packet","locator":{"kind":"work_record","task":"WARDEN-WP-0027-T02","workplan":"WARDEN-WP-0027"},"note":"ops-warden does not vend API keys. This is an attended seal, not a secret paste.","required_ack":true,"severity":"critical"}],"id":"infd-20260914-c04","locale":"en","packet":[{"hash":"sha256:bc6edfa538a6c334a916becf51dc485ad43da49cd08411843aaf1ed56bf25e10","item_id":"infd-20260914-c04-packet","label":"infd-20260914-c04-packet"}],"question":"Attend the graded lockdown / break-glass seal for ops-warden trust-root work?","requested_act":"approve","sealed":false,"step_kind":"approve","ui_release":"informed-decision@0.2.0","version":1}
|
||||
|
|
@ -0,0 +1,15 @@
|
|||
# WARDEN-WP-0027-T02 — attend graded lockdown seal
|
||||
|
||||
Blocking workplan: WARDEN-WP-0027
|
||||
Blocking task: WARDEN-WP-0027-T02 (hub prefix cae498ee)
|
||||
|
||||
## Question
|
||||
Attend the graded lockdown / break-glass seal for ops-warden trust-root work?
|
||||
|
||||
## One act
|
||||
Schedule/complete the attended seal. Credential routing remains: SSH certs from
|
||||
ops-warden; other secrets from OpenBao via `warden route` pointers.
|
||||
|
||||
## Must not
|
||||
- Ask ops-warden for ISSUE_CORE_API_KEY or similar
|
||||
- Record seal material in this packet
|
||||
Loading…
Add table
Add a link
Reference in a new issue