coulomb/key-cape
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

docs: close live approval service registration gate

Browse source 
Assistant: codex
Assistant-Model: gpt-5.6-luna
Assistant-Session: 01a07ff8-19d0-7820-b4d0-1353833cb7fc
This commit is contained in:
tegwick 2026-09-09 02:18:12 +02:00
parent cf23469ead
commit 3a4fd38c00
3 changed files with 275 additions and 83 deletions
Download patch file Download diff file Expand all files Collapse all files

21
workplans/KEY-WP-0013-approval-engine-resource-audience.md
View file

@ -36,7 +36,7 @@ including grants removed after authorization.
```task
id: KEY-WP-0013-T02
status: wait
status: done
priority: high
state_hub_task_id: "607897c5-bad9-55e5-86df-7802f592d6e8"
```
@ -148,6 +148,25 @@ image rollout, custody activation or downstream login proof occurred. T02 stays
wait for the named CCR reviews, attended custody and compatible rollout. The
single-instance replacement and existing-human-login checks remain mandatory.
2026-09-09 completion: both named CCR reviews are recorded. Verifier-side custody,
ESO delivery and the compatible pinned image/config are now live. Both service
clients passed the pinned verifier plus independent live signature and exact
claim/lifetime checks; wrong-secret and excess-scope requests were rejected.
The existing OpenBao human login passed before and after replacement; each
attended session self-revoked. Receipt: `docs/evidence/2026-09-09-keycape-verifier-admission.json`.
The deployment owner exercised compatible rollback and version-preserving resume.
The final helper checks containerd imageID against the pinned manifest and uses
the existing 30-second future-iat bound without extending token expiry. The
pinned native verifier runs in the contained owner process because workload
network policy excludes public issuer HTTPS. No network grant was broadened.
Live residual ownership remains KEY-WP-0013-T05 for the approval UI callback/MFA;
RPF-WP-0035-T05 for separate client-side delivery; AUDIT-WP-0009-T09 for audit
custody; APPROVAL-WP-0002 and SECRETS-WP-0009-T03 for end-to-end claim/consume,
expiry/revocation and native delivery. Natural JWT expiry and real predecessor
rotation were not exercised by initial provisioning.
## Reconcile tenant vocabularies across approval layers
```task