tegwick
5f516a0fbb
All checks were successful
Build and Publish Container Image / build-and-push (push) Successful in 44s
informed-decision asked for the caveat under which a registration-bound human tenant is safe to be a condition of the capability rather than reasoning in a message, so a future change to registration policy has to confront it. They were right that it was only prose: the contract stated it, a separate test asserted registration_endpoint is absent, and nothing connected the two -- so a session adding dynamic registration would have seen a test about discovery metadata, not a warning about relabelling users. The test asserts both halves together: that a client-declared tenant is issued, and that dynamic registration is not advertised. Whichever is removed first, the failure points at the other. The message carries the reasoning rather than the observation -- anyone able to register a client could relabel the users who log in through it -- and names the two ways out. Verified in both directions rather than assumed: advertising a registration_endpoint fails it with the escalation message, and neutering humanTenant fails it with the message saying to remove the guard along with the capability it protects. This is not a vote on the tenant question. It makes one option's precondition checkable; if option 1 lands, the capability and this guard are removed together. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01NV9oijZukGyGbRQGGKnK4P Assistant: claude-code Assistant-Model: opus Assistant-Process: 713576@bnt-lap001 Assistant-Session: 384c511d-9bce-4cb8-a676-2aef6c0c8df6 |
||
|---|---|---|
| .. | ||
| ADHOC-2026-09-05.md | ||
| ADHOC-2026-09-07.md | ||
| KEY-WP-0001-keycape-implementation.md | ||
| KEY-WP-0002-container-image-gitea.md | ||
| KEY-WP-0003-bootstrap-console-oidc-mfa-login.md | ||
| KEY-WP-0004-binky-hedgehog-tenant-onboarding.md | ||
| KEY-WP-0005-iam-profile-core-claims.md | ||
| KEY-WP-0006-client-credentials-service-tokens.md | ||
| KEY-WP-0007-user-engine-portal-oidc-client.md | ||
| KEY-WP-0008-registration-handoff-and-client-mfa-policy.md | ||
| KEY-WP-0009-provider-capabilities-and-service-identities.md | ||
| KEY-WP-0010-openbao-operator-loopback-callback.md | ||
| KEY-WP-0011-live-secret-exposure-recovery.md | ||
| KEY-WP-0012-userinfo-canonical-subject-resolution.md | ||
| KEY-WP-0013-approval-engine-resource-audience.md | ||
| KEY-WP-0014-native-credential-lane-handoff.md | ||
| KEY-WP-0015-scope-intent-assessment.md | ||
| KEY-WP-0016-authorization-code-protocol-hardening.md | ||
| KEY-WP-0017-canonical-model-and-discovery-conformance.md | ||
| KEY-WP-0018-export-completeness-evidence.md | ||
| KEY-WP-0019-upstream-provider-token-verification.md | ||
| KEY-WP-0020-migration-contract-preservation.md | ||
| KEY-WP-0021-snapshot-attribute-validation.md | ||
| KEY-WP-0022-replacement-harness-and-external-conformance.md | ||
| KEY-WP-0023-live-migration-proof.md | ||
| KEY-WP-0024-tenant-roles-opt-in-wiring.md | ||
| KEY-WP-0025-runtime-lifecycle-and-readiness.md | ||
| KEY-WP-0026-packaging-bootstrap-and-credential-handling.md | ||
| KEY-WP-0027-rollout-readiness-and-live-state.md | ||
| KEY-WP-0028-browser-client-field-validation.md | ||
| KEY-WP-0029-scope-reassessment.md | ||
| KEY-WP-0030-tenant-precondition-guard.md | ||