Request sitting-requester OpenBao custody without allocating a CCR.
Verifier + attended reader on a new informed-decision KV path, not a widening of CCR-2026-0024/0025. Intents still match approval-engine canonical binding. No secret, no apply, no bind. Assistant: grok Assistant-Session: 01a09dc1-b21e-77e1-919e-fcad2f82b267
This commit is contained in:
parent
c333063185
commit
8c03eb85c0
6 changed files with 123 additions and 3 deletions
|
|
@ -63,6 +63,7 @@ Open in this order. One question each. No approve-all.
|
|||
— `live_accept` must stay `open`.
|
||||
2. Owning requester creates eight `human_control=true` objects, required_count 1,
|
||||
no entries. Carry the native id and `binding.digest`; do not invent a digest.
|
||||
Platform custody (unallocated CCR): `docs/sitting-requester-custody-request.md`.
|
||||
3. `uv run python tools/attach_compact_bindings.py --principal <exact-keycape-sub> --receipt <created.json>`
|
||||
writes `bound/` copies. Unsigned drafts stay unsigned.
|
||||
4. Flex Auth admits a **new** package pinning those eight `memo:` ids to the
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue