tegwick
c333063185
Names informed-decision-sitting-requester (approval:create only, no approve/consume, no redirect). Eight binding intents are drafted and not posted; c01 stays undecided vs secrets-engine-requester. No secret, no live registration, no bind. Assistant: grok Assistant-Session: 01a09dc1-b21e-77e1-919e-fcad2f82b267
79 lines
3.3 KiB
Markdown
79 lines
3.3 KiB
Markdown
# Sitting requester — create-only client (requested, not applied)
|
|
|
|
**Workplan task:** `INFD-WP-0002-T03`
|
|
**For:** `key-cape` (same registration shape as `secrets-engine-requester`)
|
|
**Copied to:** `approval-engine` (`docs/keycape-service-registrations.md` —
|
|
“no requester identity has been settled for `approval:create`”)
|
|
**Status:** requested 2026-09-14. **Not registered. Not in OpenBao. No secret
|
|
is in this repository.**
|
|
|
|
This is the missing presenter for compact Decision Memo sittings whose
|
|
protected side effect is a **work-record update** (`INFD-WP-0002-T04`), not a
|
|
PEP consume.
|
|
|
|
## Why a second client
|
|
|
|
`informed-decision-approver` is the **human** browser client
|
|
(`approval:read` + `approval:approve`). Humans cannot `POST /v1/approvals`.
|
|
`secrets-engine-requester` is create-only with `sub=secrets-engine` and must
|
|
not draft WSL2 retirement, clock ownership, or mason plan accepts —
|
|
`binding.actor` has to match the authenticated subject.
|
|
|
|
This client names the presenter for *this* sitting.
|
|
|
|
## The strings
|
|
|
|
| Field | Value |
|
|
| --- | --- |
|
|
| `client_id` | `informed-decision-sitting-requester` |
|
|
| Grant | `client_credentials` |
|
|
| Client type | confidential |
|
|
| Audience | `approval-engine` (resource server, never the OAuth client id) |
|
|
| Scopes | `approval:create` **only** |
|
|
| `serviceSubject` / token `sub` | `informed-decision` |
|
|
| `tenant` | `tenant:platform` (exact) |
|
|
| `principal_type` | `service` |
|
|
| Role | `informed-decision-sitting-requester` |
|
|
| Token lifetime | 15m |
|
|
| Redirect URI | **none** — this is not a browser client |
|
|
|
|
Machine-readable copy: `keycape-sitting-requester-registration.json`.
|
|
`secretRef` is a custody *name*. It is not a credential.
|
|
|
|
## Anti-requirements
|
|
|
|
- **No** `approval:approve`. That stays on the human PKCE client.
|
|
- **No** `approval:consume`. Consumption belongs to a PEP. This sitting's
|
|
T04 path is repo files + `fix-consistency`.
|
|
- **No** `approval:read` on this client. The human already has read.
|
|
- Do **not** reuse `approval-engine-operator` (cancelled bundle, too wide).
|
|
- Do **not** reuse `secrets-engine-requester` for unrelated acts.
|
|
- Do **not** register this client until `key-cape` owns the row and
|
|
`railiance-platform` owns attended secret custody. This document is not
|
|
admission.
|
|
|
|
## Binding rules at create time
|
|
|
|
`POST /v1/approvals` requires `binding.actor ==` the token `sub`, so actor is
|
|
always `informed-decision`.
|
|
|
|
| Binding field | Value for this sitting |
|
|
| --- | --- |
|
|
| `actor` | `informed-decision` |
|
|
| `principal` | owning system of the work record (not the human, not this client by default) |
|
|
| `action` / `purpose` / `target` | one memo, one act — see `docs/batches/2026-09-14/approval-create-intents.json` |
|
|
| `human_control` | `true` |
|
|
| `pdp_path` | `false` — no consume PEP on T04 |
|
|
| `required_count` | 1 |
|
|
|
|
`infd-20260914-c01` (SECRETS-WP-0010 native delivery) may belong on
|
|
`secrets-engine-requester` instead if a later consume is in-scope. It is
|
|
marked undecided in the intents file. Do not POST it on this client until
|
|
that is stated.
|
|
|
|
## What this does not do
|
|
|
|
It does not bind. It does not admit Flex Auth. It does not load the review
|
|
store. After KeyCape registers the row and platform materializes custody,
|
|
an attended create can mint the eight (or seven) objects; then
|
|
`tools/attach_compact_bindings.py` with the operator's live KeyCape `sub`.
|