tegwick
b66ce13e4e
All checks were successful
Build and Publish Container Image / build-and-push (push) Successful in 35s
Every closure criterion now has evidence, taken one at a time rather than as an impression. Custody admitted and provisioned (CCR-2026-0017/0018, both secrets wired, receipt committed). The real callback registered, verified live by its owner, pinned by test. The new contracts deployed and verified at the 2026-09-09 attended rollout: acceptance passed at generation 38, per-client live JWKS verification, exact claims, excess-scope and wrong-secret denial, human consume denied, no credential values emitted. Token types reconciled at the consumer boundary -- ops-warden took option (a) because the proxy's OpenBao token and an issuer JWT were never one thing to cut over between; both lanes owner-confirmed and no route changed. Four handoff receipts retained. The condition that named the gap -- source capability running ahead of live custody and consumer adoption -- no longer holds. What closing it does not claim, stated in both documents: the approver registration is published, not deployed, so the human approval path is registered rather than proved; the deployed image predates most of this revision; the verifier receipt declines real predecessor rotation and observed wall-clock expiry and so do we; and the Qonto rotation is deferred by owner decision on evidence. Those are open items with owners and triggers, which is a different thing from a gap between what this repository claims and what is true. SCOPE's header lineage is consolidated so a reader can ask what changed since a given revision and get an answer, and the test count is refreshed rather than carried. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01NV9oijZukGyGbRQGGKnK4P Assistant: claude-code Assistant-Model: opus Assistant-Process: 713576@bnt-lap001 Assistant-Session: 384c511d-9bce-4cb8-a676-2aef6c0c8df6 |
||
|---|---|---|
| .. | ||
| 2026-09-05-011726-scope-intent-assessment.md | ||
| 2026-09-09-scope-reassessment.md | ||
| KEY-WP-0011-live-secret-exposure-recovery.md | ||
| KEY-WP-0011-rotated-credentials-2026-08-23-final.tar.age | ||