From e5839885995f25426523e4c319d0d912214dc62d Mon Sep 17 00:00:00 2001 From: tegwick Date: Tue, 6 Oct 2026 14:29:54 +0200 Subject: [PATCH] Link KEY-WP-0037-T03 to the in-bao custody design and approval decision Co-Authored-By: Claude Opus 5.5 Assistant: claude-code Assistant-Model: opus Assistant-Process: 132360@bnt-lap001 Assistant-Session: 769b1afd-4330-4c86-96b2-e510e26db42b --- ...EY-WP-0037-secrets-engine-openbao-registration-custody.md | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/workplans/KEY-WP-0037-secrets-engine-openbao-registration-custody.md b/workplans/KEY-WP-0037-secrets-engine-openbao-registration-custody.md index d4f6da2..c378120 100644 --- a/workplans/KEY-WP-0037-secrets-engine-openbao-registration-custody.md +++ b/workplans/KEY-WP-0037-secrets-engine-openbao-registration-custody.md @@ -90,7 +90,10 @@ Platform CCR-2026-0033 (`df24a77`, still proposed) holds the KV path `platform/workloads/keycape/secrets-engine-openbao`, the sso-only ESO and the attended custody script; its approval is RPF-WP-0035-T09. The live order is custody run, then issuer Secret, env patch, this merge and a restart. Nothing -is live, and the image pin is still NK-WP-0046-T02. +is live. The founder keeps the deployed image (NK-WP-0046-T02, 2026-10-06). +Revised the same day: the value lives only in OpenBao (ops-mason MASON-WP-0009) +and has no consumer file. The custody approvals A1-A3 are decision +`2ab717e1-7881-491e-aed4-28946550c289`. ## Verify actual issuance and publish non-secret owner receipt