From 3e9ca473dd0b00c1b0bfea64b8e809d1d720a5b1 Mon Sep 17 00:00:00 2001 From: tegwick Date: Sun, 4 Oct 2026 23:03:26 +0200 Subject: [PATCH] Record requester delivery approval and attended execution dependency Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a10780-6d41-7952-9718-dfbc1f41236f --- docs/requester-workload-owner-review.md | 16 ++++++++++++++++ .../INFD-WP-0007-decision-lifecycle-service.md | 8 ++++++++ 2 files changed, 24 insertions(+) diff --git a/docs/requester-workload-owner-review.md b/docs/requester-workload-owner-review.md index 385d275..89cd419 100644 --- a/docs/requester-workload-owner-review.md +++ b/docs/requester-workload-owner-review.md @@ -98,3 +98,19 @@ composition gap only. The live CCR remains proposed; its current SHA256 is ab4cd7c15192ebe98e17b0c40a188ae67616c63cc796d9b807adba7c39f2edb3. No new design decision is requested. Exact live delivery approval, attended OpenBao login, native custody/rotation proof and cutover acceptance remain. + +## Exact delivery approval recorded — 2026-10-04 + +Founder answered "I approve" to the final requester delivery packet. Platform +commit a7bc33b records approved CCR-2026-0032 and the reviewed intended binding; +approved CCR SHA256 is +c54dd86fd1bd754e64b135f02cac8d9a8f4db314cb3ca44c9645565aa816eee7. +A fresh explicit SubjectAccessReview confirms the current external-secrets +controller can create tokens for informed-decision/informed-decision-eso. No +token was minted. Native account auth and delivery remain to be proven. + +The owner metadata child accepts the approved source and exact digest offline. +The founder must run Platform's updated attended checklist in their terminal. +No repeated requester-delivery approval is needed. Native metadata application, +ESO delivery, negative checks and cleanup receipts are pending; the broader +lifecycle cutover and issuer rotation still require their separate reviewed scope. diff --git a/workplans/INFD-WP-0007-decision-lifecycle-service.md b/workplans/INFD-WP-0007-decision-lifecycle-service.md index 2443b36..17cff4c 100644 --- a/workplans/INFD-WP-0007-decision-lifecycle-service.md +++ b/workplans/INFD-WP-0007-decision-lifecycle-service.md @@ -286,3 +286,11 @@ lost-reply/restart recovery without duplicate native approval, followed by human review and independent audit. Validation: 663 passed, 1 skipped; 28 Hub tests. The exact three worker objects are added to deploy/lifecycle. Native credentials, rollout approval and human acceptance remain the next gates; no live mutation. + +## Requester delivery approval — 2026-10-04 + +Founder approved the concrete CCR-2026-0032 requester delivery. Platform a7bc33b +records the approved exact packet and contained metadata command. Owner source +readiness is accepted under RPF-WP-0051-T02; T03 awaits the founder terminal +OIDC/MFA and native delivery evidence. No live credentials were read or changed +by this session. INFD-WP-0007-T07 still owns separate service cutover acceptance.