prepare-custody, plan, accounts and verify for ld-admin and the svc-* accounts;
named rotations for the Authelia bind and LLDAP_LDAP_USER_PASS.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 308701@bnt-lap001
Assistant-Session: 5548e447-444c-4dcc-bed1-05c16eebfe56
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 308701@bnt-lap001
Assistant-Session: 5548e447-444c-4dcc-bed1-05c16eebfe56
Custody gains LLDAP_SVC_{AUTHELIA,KEYCAPE,PRIVACYIDEA,PROVISIONER}_PASS and
LLDAP_LDAP_USER_PASS becomes ld-admin's. Authelia, KeyCape, the privacyIDEA
resolver and identity-provisioner (new Secret identity-provisioner-ldap) switch
to svc-* accounts; LLDAP's configured super-admin is ld-admin. The LLDAP image
pin waits for the running digest.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 308701@bnt-lap001
Assistant-Session: 5548e447-444c-4dcc-bed1-05c16eebfe56
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 308701@bnt-lap001
Assistant-Session: 5548e447-444c-4dcc-bed1-05c16eebfe56
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 308701@bnt-lap001
Assistant-Session: 5548e447-444c-4dcc-bed1-05c16eebfe56
Per coordinator r6. New register-client descriptor sha256:434c53e8...43cb;
1.2/1.3 compositions regenerated; 1.3 map and status-only ready_check updated.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 696317@bnt-lap001
Assistant-Session: bab9e511-0915-45b3-926a-2fab552edff6
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 696317@bnt-lap001
Assistant-Session: bab9e511-0915-45b3-926a-2fab552edff6
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 696317@bnt-lap001
Assistant-Session: bab9e511-0915-45b3-926a-2fab552edff6
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 696317@bnt-lap001
Assistant-Session: bab9e511-0915-45b3-926a-2fab552edff6
Requests lowered per the 2026-10-21 node budget; lldap (53.7% throttled)
CPU limit 200m -> 1000m. kubectl diff against live: resources only. No apply.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 276069@bnt-lap001
Assistant-Session: 2e192b3d-b3e8-4403-94d4-d55a2c8b476c
1.3 composes completely with the new lanes and an all-human actor set. 1.2 is
correctly refused on the three moved lanes and stays plan-only. The 1.2
admission test's unique checks move into test_admit_1_3_type.py. Tests run
against ops-warden 117fec9.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 903097@bnt-lap001
Assistant-Session: aa320c8f-c3fa-46e7-8541-0b58e1e45d23
Lane key-cape-oidc-login -> keycape-attended-case-change in the register-client,
ensure-groups and bind-env descriptors; deliver-consumer-secret actor agent ->
human; verify_consumer reports a value-free, exactly-once probe record list bound
into the observation digest. Composition artifacts, type.yaml and admit/compose
tests are left for the orchestrator to regenerate.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 903097@bnt-lap001
Assistant-Session: aa320c8f-c3fa-46e7-8541-0b58e1e45d23
Source-only candidate. The real-kernel admission test shows the remaining gate is an
ops-warden 1.3 parameter pin plus acknowledgment.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 903097@bnt-lap001
Assistant-Session: aa320c8f-c3fa-46e7-8541-0b58e1e45d23
ensure-groups and hand-over accept 1.3 via explicit version_root only (1.1
stays default; hand-over applies 1.2 owner handling to 1.3).
deliver-consumer-secret accepts exactly {1.2, 1.3}. compose-1.2-descriptors
gains --version {1.2,1.3} (default 1.2) and refuses cleanly when
security-case-type-revisions/<version> is absent. The committed 1.2
composition artifact is regenerated with its recorded args: only the adapter
source and descriptor digests of the three edited adapters change.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 903097@bnt-lap001
Assistant-Session: aa320c8f-c3fa-46e7-8541-0b58e1e45d23
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 903097@bnt-lap001
Assistant-Session: aa320c8f-c3fa-46e7-8541-0b58e1e45d23
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 903097@bnt-lap001
Assistant-Session: aa320c8f-c3fa-46e7-8541-0b58e1e45d23
bind-env's source_digest covered bind-env-adapter.py and keycape-client.py
only, but keycape-client.py executes portal-client-rollout.py, which
executes openbao-client-config.py and register-user-engine-portal.py.
Pin the same five-file closure the registration adapter pins, and add a
closure-completeness test that imports every *-adapter.py in a fresh
interpreter and fails on any loaded local file its SOURCE_FILES omits.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 903097@bnt-lap001
Assistant-Session: aa320c8f-c3fa-46e7-8541-0b58e1e45d23
build() now takes case_source, checks it against admitted.pins.case, refuses
non-confidential cases and a client_id differing from the admitted target, and
derives sso/keycape-{client_id}-client (key client-secret) from
platform/workloads/keycape/{client_id} per type 1.2. No caller-chosen
reference remains. Fixtures use the 1.2 forgejo example and real names;
regression tests cover the reviewer's forgejo/grafana demonstration, a public
client and a case-pin mismatch.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 903097@bnt-lap001
Assistant-Session: aa320c8f-c3fa-46e7-8541-0b58e1e45d23
A raising parent-session revocation no longer skips broker-grant revocation,
and the reverse; the first failure is re-raised after both are attempted, so
the attempt is refused rather than reported as success. Regression tests
cover each direction and both failing.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 903097@bnt-lap001
Assistant-Session: aa320c8f-c3fa-46e7-8541-0b58e1e45d23
Run Executor.admit on all seven composed descriptors with the real 1.2
type, example case and reviewed browser validator. Pin agent-mint and
wrong-lane refusals.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 1011674@bnt-lap001
Assistant-Session: b3b5b6f0-3bf5-41a3-8150-3ca4606cc028
Kernel a45cf47 refuses effect mint unless the actor is human, so the
agent descriptor could never be admitted. Regenerate the 1.2 candidate.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 1011674@bnt-lap001
Assistant-Session: b3b5b6f0-3bf5-41a3-8150-3ca4606cc028
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 903097@bnt-lap001
Assistant-Session: aa320c8f-c3fa-46e7-8541-0b58e1e45d23
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 903097@bnt-lap001
Assistant-Session: aa320c8f-c3fa-46e7-8541-0b58e1e45d23
- ensure-groups-adapter.py: descriptor revocation_scopes=('parent-session',);
build() requires revoke_session and calls it in a finally block on every
run/rollback; OwnerResult now carries revoked=True and the session
revocation evidence (previously revoked was set to the rollback flag).
- handover-adapter.py: same revocation fix; descriptor(owner) takes the owner
as a parameter (type 1.2 '{consumer_owner_repo}') instead of hard-coded
'apps'; build() derives it from admitted.owner and a 1.2 case must name
the same consumer_owner_repo.
- Tests: kernel Descriptor.decode accepts both descriptors; revocation runs
even on failed attempts; missing revocation evidence refuses before
publication; 1.2 owner binding.
- descriptor-composition-1.2.candidate.json regenerated (same checker digest,
consumer_owner_repo=railiance-apps): only mint-secret remains refused.
- test_compose_1_2_descriptors.py pins that finding set and checks the
committed artifact equals regeneration.
Outside the assigned file list (needed for the composer to pass the owner):
compose-1.2-descriptors.py passes consumer_owner to hand-over as it does
for deliver-consumer-secret, and drops the stale proposed owner 'apps'.
Not an admission, owner review or pin; mint-secret actor left for owner decision.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 903097@bnt-lap001
Assistant-Session: aa320c8f-c3fa-46e7-8541-0b58e1e45d23
Composes through the explicit 1.2 version root, closes each adapter
descriptor through Warden Descriptor.decode and checks step/owner/lane
against the 1.2 follow_through. Refuses partial, duplicate, unknown,
mismatched and 1.1-default-changing compositions. The generated candidate
artifact is not an admission: the current adapters do not compose
(ensure-groups, mint-secret, hand-over refused) and worker-proposed names
are marked owner_confirmation_required.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 903097@bnt-lap001
Assistant-Session: aa320c8f-c3fa-46e7-8541-0b58e1e45d23
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 903097@bnt-lap001
Assistant-Session: aa320c8f-c3fa-46e7-8541-0b58e1e45d23
build() accepts paired holder/observe read-only capabilities and installs
Adapter.reconcile_original; verify accepts the published reconcile record.
Fixture now exercises the adapter's own path. No add replay, no undo after
restart; missing/ambiguous/changed state stays uncertain. Holder choice
remains an owner gate.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 903097@bnt-lap001
Assistant-Session: aa320c8f-c3fa-46e7-8541-0b58e1e45d23
Source-digest, descriptor, case and acceptance pins; owner-published and
authenticated evidence; parent-session revocation in finally. Existing
reference-only refusals and created-only rollback kept. Synthetic tests only.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 903097@bnt-lap001
Assistant-Session: aa320c8f-c3fa-46e7-8541-0b58e1e45d23
Canonical 1.1 stays the default; oidc-browser-relying-party@1.2 is accepted
only via build(version_root='1.2'). Adds a public group_binding helper pinned
by test to the provisioner's _group_binding, replacing the private call.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 903097@bnt-lap001
Assistant-Session: aa320c8f-c3fa-46e7-8541-0b58e1e45d23
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 903097@bnt-lap001
Assistant-Session: aa320c8f-c3fa-46e7-8541-0b58e1e45d23
Fixture-only reconcile_original owner over the T13 registration adapter,
driven through Warden's actual Executor/Journal (ops-warden a45cf47):
original intent kept separate from the reconcile attempt across restart;
holder-unavailable, missing/ambiguous record, wrong attempt/case/source/
principal, NO_CHANGE original, changed revision and absent client entry
all refuse and stay uncertain with no add replay or undo. The holder is
fixture-only; actual authenticated holder selection stays a T15 owner gate.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 903097@bnt-lap001
Assistant-Session: aa320c8f-c3fa-46e7-8541-0b58e1e45d23
Binds group creation to the T14/T21 PostgreSQL journal seam (exact case,
source and principal binding; refuses untrusted journals), canonical 1.1
case only, created-only rollback via the journal receipt. Source candidate;
owner review and native action remain separate gates.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 903097@bnt-lap001
Assistant-Session: aa320c8f-c3fa-46e7-8541-0b58e1e45d23
Unexercised, injection-only, value-free evidence seam for type 1.2 with
positive/refusal fixtures and created-only rollback. Canonical 1.1 default
unchanged; no owner review or native action supplied.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 903097@bnt-lap001
Assistant-Session: aa320c8f-c3fa-46e7-8541-0b58e1e45d23
Injection-only consumer verification and hand-over receipt seam with
positive/refusal fixtures and created-only rollback. Canonical 1.1 default;
1.2 only by explicit version-root selection. Unexercised; Apps owner review
before pinning remains a separate gate.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 903097@bnt-lap001
Assistant-Session: aa320c8f-c3fa-46e7-8541-0b58e1e45d23
Injection-only seam for the type 1.2 mint-secret step: closed value-free
custody receipts, created-only rollback by exact version, parent-session and
broker-grant revocation. Source candidate only; no owner review or admission.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 903097@bnt-lap001
Assistant-Session: aa320c8f-c3fa-46e7-8541-0b58e1e45d23
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 903097@bnt-lap001
Assistant-Session: aa320c8f-c3fa-46e7-8541-0b58e1e45d23
One-line, byte-preserving edit of sso/keycape-config with inspect, server
dry-run, attended apply and an exact rollback. No values are emitted.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 1041694@bnt-lap001
Assistant-Session: 7af0bb68-ac4a-4ce3-8639-24ddd84c0b52
