Request sitting-requester OpenBao custody without allocating a CCR.

Verifier + attended reader on a new informed-decision KV path, not a
widening of CCR-2026-0024/0025. Intents still match approval-engine
canonical binding. No secret, no apply, no bind.

Assistant: grok
Assistant-Session: 01a09dc1-b21e-77e1-919e-fcad2f82b267
This commit is contained in:
tegwick 2026-09-15 01:04:10 +02:00
parent c333063185
commit 8c03eb85c0
6 changed files with 123 additions and 3 deletions

View file

@ -63,6 +63,7 @@ Open in this order. One question each. No approve-all.
`live_accept` must stay `open`.
2. Owning requester creates eight `human_control=true` objects, required_count 1,
no entries. Carry the native id and `binding.digest`; do not invent a digest.
Platform custody (unallocated CCR): `docs/sitting-requester-custody-request.md`.
3. `uv run python tools/attach_compact_bindings.py --principal <exact-keycape-sub> --receipt <created.json>`
writes `bound/` copies. Unsigned drafts stay unsigned.
4. Flex Auth admits a **new** package pinning those eight `memo:` ids to the