coulomb/key-cape
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

docs(oidc): pin tested issuer probe and bounded owner execution packet

Browse source 
Assistant: codex
Assistant-Model: gpt-5.6-luna
Assistant-Session: 01a07ff8-19d0-7820-b4d0-1353833cb7fc
This commit is contained in:
tegwick 2026-09-08 23:18:11 +02:00
parent 6f33abddcf
commit 1b9793ffed
3 changed files with 186 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

11
workplans/KEY-WP-0013-approval-engine-resource-audience.md
View file

@ -219,7 +219,7 @@ T06 completion: full Go suite and vet passed; published code `dcebd46` and pulle
```task
id: KEY-WP-0013-T07
status: progress
status: done
priority: high
assignee: the-custodian
```
@ -243,3 +243,12 @@ Source tests, image and deployment packet close this preparation task. The
attended live receipt and issuer pin remain in T02, alongside the named CCR
reviews and custody/rollout acceptance. Preparing the diagnostic does not
approve CCR-2026-0017/0018 or close any live factory gate.
T07 preparation complete: source `6f33abd`, immutable image
`sha256:0c85ed377cae7ae6ca5b5c56b1a52930e706b3cb78009747e42f551e869a22e4`.
Complete Go race suite and vet passed; five renderer/collector checks, seven
real Traefik 3.6.7 route cases and Railiance server dry-run passed. The packaged
command ran as UID 65534 with no network and a read-only filesystem and produced
the expected bounded idle-timeout receipt. See `docs/upstream-issuer-proof.md`
and `docs/evidence/upstream-issuer-probe.json`. T02 retains the live proof and
configuration-owner admission; no production resource or custody value changed.