18 lines
737 B
Markdown
18 lines
737 B
Markdown
|
# Sitting-requester reader session
|
||
|
|
|
||
|
|
CCR-2026-0027 admits only
|
||
|
|
`platform/workloads/informed-decision/sitting-requester`. The contained Warden
|
||
|
|
login uses `informed-decision-sitting-requester-workload-kv-read`. Its owner
|
||
|
|
command checks exact reader policies, sibling denial of
|
||
|
|
`secrets-engine/approval-requester`, and a create-only KeyCape token exchange.
|
||
|
|
It does not POST sittings and never prints the client secret.
|
||
|
|
|
||
|
|
Use the current source catalog explicitly:
|
||
|
|
|
||
|
|
`WARDEN_ROUTING_CATALOG=/home/worsch/ops-warden/registry/routing/catalog.yaml`
|
||
|
|
|
||
|
|
The reviewed child is
|
||
|
|
`/home/worsch/railiance-platform/scripts/prove-sitting-requester-exchange.sh`.
|
||
|
|
OpenBao is reached through `http://127.0.0.1:18200`. Warden self-revokes after
|
||
|
|
the child exits.
|