From 1c07b65a3cd133ed0b19c2413e040cd69b3432f8 Mon Sep 17 00:00:00 2001 From: tegwick Date: Sat, 10 Oct 2026 12:59:45 +0200 Subject: [PATCH] MASON-WP-0004-T03: founder accepts six owner-supplied custody descriptions Co-Authored-By: Claude Opus 5.5 Assistant: claude-code Assistant-Model: opus Assistant-Process: 327203@bnt-lap001 Assistant-Session: 55028ae3-4914-4bd1-8f5c-815f3527aef0 --- manifests/custody-descriptions.yaml | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/manifests/custody-descriptions.yaml b/manifests/custody-descriptions.yaml index 3825d1b..9dffb3f 100644 --- a/manifests/custody-descriptions.yaml +++ b/manifests/custody-descriptions.yaml @@ -18,7 +18,7 @@ operators/nextcloud/backup: on_loss: Resettable by the founder in the Storage Share provider admin (attended). If the share is recreated, update the workload lane's NC_WEBDAV_TOKEN. Stored backups are unaffected. owner: railiance-platform - review: draft + review: accepted rotation: railiance-platform/docs/backup-credential-recovery.md; railiance-platform/credential-change-requests/CCR-2026-0004-railiance-backup-offsite-lane.yaml sources: - railiance-platform reply 3e490cd4 (2026-10-09) @@ -69,7 +69,7 @@ platform/workloads/agent-harness/forgejo-deploy-key: on_loss: 're-establish by railiance-platform: On railiance01 generate a new ed25519 keypair under ~/.local/agent-harness/ssh/ (mode 600); do not paste the private key into chat or Git.' owner: railiance-platform - review: draft + review: accepted rotation: ops-warden/wiki/playbooks/agent-harness-secrets.md#lane-2-forgejo-deploy-key sources: - ops-warden catalog agent-harness-forgejo-deploy @@ -176,7 +176,7 @@ platform/workloads/coulomb/whynot-design/npm-publish: on_loss: 'Re-issue per rotation: Replace NPM_AUTH_TOKEN value directly in OpenBao and record non-secret rotation evidence.' owner: railiance-platform - review: draft + review: accepted rotation: railiance-platform/credential-change-requests/CCR-2026-0001-whynot-design-npm-publish.yaml#lifecycle.rotate sources: - CCR-2026-0001-whynot-design-npm-publish.yaml @@ -375,7 +375,7 @@ platform/workloads/railiance-telemetry/smtp: on_loss: 'Resettable by the founder in IONOS mail admin; write a new KV version keeping the other fields, wait for ESO refresh. Cost: alert mail and Authelia reset emails fail until then; no data loss.' owner: railiance-platform - review: draft + review: accepted rotation: railiance-platform/credential-change-requests/CCR-2026-0035-authelia-platform-smtp.yaml#lifecycle.rotate sources: - CCR-2026-0035-authelia-platform-smtp.yaml @@ -428,7 +428,7 @@ platform/workloads/rapp-qonto/keycape-client: on_loss: 'rotate by key-cape: Generate a fresh newline-free secret through an approved execution transport; never print it. NOT automatable — no admitted execution and rollback contract (see delegation.blocked_on).' owner: key-cape - review: draft + review: accepted rotation: ops-warden/wiki/CredentialRouting.md#routing-catalog-index sources: - ops-warden catalog rapp-qonto-keycape-client @@ -504,7 +504,7 @@ platform/workloads/telemetry/grafana-admin: on_loss: 'Resettable by a cluster operator with Grafana''s admin reset in the pod, then a new KV version (not yet exercised). Cost: short loss of admin access; dashboards and data unaffected.' owner: railiance-platform - review: draft + review: accepted rotation: 'railiance-platform/docs/credential-lane-designs/telemetry-grafana.md (attended: change the Grafana DB admin password and OpenBao together, then test old fails and new works)' sources: