contracts/owner-pins.json pins six public owners; tools/contract-tests/fetch_owners.py partial-clones
them anonymously (pinned on push, main nightly). tools/contract-tests/run.sh is the one suite list
(make contract-test, CI) and fails when any test skips. New: readiness against real owner source,
replaying both 2026-11-04 states from informed-decision history. pytest pinned by PyPI-checked hashes.
test_approval_request no longer hard-codes /home/worsch/informed-decision.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 943911@bnt-lap001
Assistant-Session: fc322940-1c8e-4bed-ab39-86cec99f23a0
CLI entry point and approval-engine/audit-core clients; events carry
occurred_at (audit-core envelope); hash-locked image with pinned lldap
stage builds locally; image workflow and executor tests in CI; pilot
example pins the executed files. rapp reshaping still open.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 994874@bnt-lap001
Assistant-Session: 6017c416-d619-47eb-bd1a-f670a02d7d87
lane.py setup/verify/teardown (attended; CCR-2026-0057 sha256-bound):
generates password and TOTP seed in memory, KV CAS=0 with coding agents
fenced, LLDAP user syn-journey with no groups, privacyIDEA TOTP token with
enrollment confirmation, live journey as proof. SecurityCase for the public
KeyCape client nk-synthetic-journey; syn-journey declared SERVICE (planned);
proposed syn-<check> naming row in the SI standard; founder runbook.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 994874@bnt-lap001
Assistant-Session: 6017c416-d619-47eb-bd1a-f670a02d7d87
Stdlib runner that signs a synthetic user in through KeyCape (PKCE, aal2),
Authelia first factor and the privacyIDEA-backed OTP challenge, verifies the
ID token (RS256 via JWKS, assurance aal2/otp) and writes a value-free receipt
naming the first failed step and the bind on it. 26 tests with per-bind fakes
run in the identity-provider journey acceptance workflow.
Founder decision 2026-10-31: real pinned images for the synthetic stack (T08),
synthetic user and seed in OpenBao (T09), unattended live run (T10).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 994874@bnt-lap001
Assistant-Session: 6017c416-d619-47eb-bd1a-f670a02d7d87
Map uncaught HTTPError from LLDAP login to a structured
dependency_unavailable response, add /readyz as the provisioner-to-directory
preflight, keep /healthz as process liveness, and run the contract in CI.
Auth rejection is not retried during cooldown.
NK-WP-0036-T05 remains in progress until the immutable image is published,
pinned with /readyz, and one native login/create/password-setup journey is
verified.
Assistant: grok
Assistant-Session: 01a09dc6-3f0e-78f1-a884-c8c703c24ddf
