From 56f2aa9a3acb90d6cc1c7cfce6b1e772cbe06e3c Mon Sep 17 00:00:00 2001 From: tegwick Date: Tue, 27 Oct 2026 22:38:30 +0100 Subject: [PATCH] NK-WP-0055-T14: founder chooses digest-pinned mounted policy bundles Co-Authored-By: Claude Opus 5.5 Assistant: claude-code Assistant-Model: opus Assistant-Process: 4515@bnt-lap001 Assistant-Session: 0bf96127-6e04-41be-bfda-d11717c3f354 --- workplans/NK-WP-0055-security-platform-production-readiness.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/workplans/NK-WP-0055-security-platform-production-readiness.md b/workplans/NK-WP-0055-security-platform-production-readiness.md index 16f6bf4..02a0da2 100644 --- a/workplans/NK-WP-0055-security-platform-production-readiness.md +++ b/workplans/NK-WP-0055-security-platform-production-readiness.md @@ -314,6 +314,8 @@ Owner: access-engine. **Done when:** policy changes are imported without rebuild tenant packages split, one production explain receipt exists, and FLEX-WP-0031 (decision records) and FLEX-WP-0024 (signed envelope) are delivered or accepted as exceptions. + +2026-10-27 founder decision: import path **B**, a policy bundle mounted into access-engine and pinned by digest, so policy changes no longer need an image rebuild; move to C (signed bundle) once FLEX-WP-0024 signing custody exists. Delivery sits in access-engine FLEX-WP-0039-T03. ## Register rotation lanes with blast radius and verification ```task