coulomb/ops-warden
5
0
Fork 0
Code Issues Pull requests Projects Releases 2 Packages Wiki Activity Actions

Catalog keycape-client-secret-generate as draft (RPF-WP-0054)

Browse source 
Pointer to railiance-platform's credential.py generate for the mint-secret
step of oidc-browser-relying-party 1.0. Draft until the issuer policy is bound
to the operator OIDC role, key-cape confirms the secret format and the
RPF-WP-0054-T05 probe passes. Workload-join not_applicable 17 -> 18.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 427672@bnt-lap001
Assistant-Session: a0a2367e-4697-440c-a4e5-9713c009f6d8
This commit is contained in:
tegwick 2026-10-10 10:24:51 +02:00
parent 919b9ab3e5
commit 0ae8a0e467
4 changed files with 82 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

4
tests/test_workload_join.py
View file

@ -26,7 +26,9 @@ def test_repo_catalog_uses_only_explicit_workload_references():
# supplier-account path pattern; concrete consumers keep their own lanes.
# unknown 22 since 2026-10-09: fluid-telegram-operator (MASON-WP-0005-T06)
# names fluid-telegram, which has published no workload declaration.
assert len(report["not_applicable"]) == 17
# not_applicable 18 since 2026-10-10: keycape-client-secret-generate is a
# per-case generation lane; each case's consumer gets its own entry.
assert len(report["not_applicable"]) == 18
assert {row["lane"] for row in report["resolved"]} == {
"ops-warden-warden-sign-token",
"issue-core-ingestion-api-key",