From 26ec9bb9b195ad377448570d6b161fd682311a0b Mon Sep 17 00:00:00 2001 From: tegwick Date: Sat, 17 Oct 2026 13:36:07 +0200 Subject: [PATCH] docs(key39): clarify original client approval scope Assistant: codex Assistant-Model: gpt-6.1-sol Assistant-Session: 01a1468b-63fa-7710-85dc-8f2e16b3ebfa --- workplans/KEY-WP-0039-openbao-negative-probe-tokens.md | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/workplans/KEY-WP-0039-openbao-negative-probe-tokens.md b/workplans/KEY-WP-0039-openbao-negative-probe-tokens.md index fd0fc46..b22aa6a 100644 --- a/workplans/KEY-WP-0039-openbao-negative-probe-tokens.md +++ b/workplans/KEY-WP-0039-openbao-negative-probe-tokens.md @@ -143,8 +143,12 @@ operator/ESO capability and nonmember checks remain independent acceptance. acknowledgment): the [infrastructure assessment](../../the-custodian/docs/changes/netkingdom-target-2026-10-17/key39-infra-finalization-r1/ASSESSMENT.md) confirms all 14 executable/test/producer-decision pins and three Platform source pins still match. Source reviews remain complete: T01/T03 done, T02 wait. Existing -source acceptance, resolved registration go caafe4be and the standing attended -rule remain valid; no new protocol or blanket approval request is needed. The +source acceptance remains valid. Resolved registration go caafe4be covers only +the original secrets-engine-openbao client (KEY-WP-0037-T03, deployed 6f79a2af, +NK-WP-0046 exact-match helper); it does not authorize new probe clients or +coding-client custody, and no renewed original-client approval is requested. +The standing attended rule remains separate, for reviewed commands within +existing scope; no new protocol or blanket approval request is introduced. The remaining sequence is KEY-WP-0038-T02/T03 first-case registration/claims proof, admission of the existing coding-client proposal with sanitized owner readiness returns, then one attended negative/revoke/cleanup receipt committed with probe