coulomb/key-cape
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Name the third state SCOPE had no vocabulary for

Browse source 
Folds in two points from the custody owner and a peer session that arrived after
the reassessment landed.

Implemented and unproven is a distinct state from both missing and done, and
SCOPE had no words for it. verify-client's predecessor rejection is written and
unit-tested and has never run against a genuinely distinct predecessor, so this
repository holds a receipt that reads like rotation evidence and is not. Both
owners state that limit independently, which is why it belongs in SCOPE rather
than only in a workplan. "There is a test" and "it has been exercised against the
real thing" now read as separate claims wherever SCOPE makes one.

Also records that the two approval clients' live verification was independently
confirmed by the custody owner, and corrects a conflation this repository made:
client-side retrieval of those secrets is unadmitted and stays so, but the
attended operator path is not a client-side read and never required one. That
conflation is what left T02 recorded as waiting on a run that had already
happened.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01NV9oijZukGyGbRQGGKnK4P

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 713576@bnt-lap001
Assistant-Session: 384c511d-9bce-4cb8-a676-2aef6c0c8df6
This commit is contained in:
tegwick 2026-09-09 20:09:01 +02:00
parent 06f39906e9
commit 66ca76cb9c
2 changed files with 27 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

13
history/2026-09-09-scope-reassessment.md
View file

@ -72,7 +72,18 @@ stating exactly:
900s lifetime, no credential values emitted.
Those receipts also decline what they did not test — no real predecessor rotation,
no observed wall-clock expiry — and this document declines it with them.
no observed wall-clock expiry — and this document declines it with them. They also
force a distinction SCOPE had no vocabulary for: *implemented and unproven*, a
third state between missing and done. `verify-client`'s predecessor rejection is
written and unit-tested and has never run against a genuinely distinct
predecessor, so the repository holds a receipt that reads like rotation evidence
and is not. Both owners state that limit independently, which is why it belongs
in SCOPE rather than only in a workplan.
One framing correction worth propagating, from the custody owner: client-side
retrieval of those secrets is unadmitted and remains so, but the attended
operator path is not a client-side read and never required one. Conflating the
two is what left T02 recorded here as waiting on a run that had already happened.
The deployed image predates this revision, so the authorization-code bindings,
upstream verification, readiness, graceful shutdown and both tenant-related