coulomb/ops-warden
5
0
Fork 0
Code Issues Pull requests Projects Releases 2 Packages Wiki Activity Actions

Record attended completion from the CUST-WP-0073 cutover (2026-10-20)

Browse source 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 527080@bnt-lap001
Assistant-Session: 5a0e864a-67be-4605-a77a-16635f7dd292
This commit is contained in:
tegwick 2026-10-21 00:01:56 +02:00
parent 317d42bce0
commit 289b867e33
2 changed files with 4 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

2
WORK-RECORDS.md
View file

@ -186,7 +186,7 @@
| task | WARDEN-WP-0044-T04 | wait | — | workplans/WARDEN-WP-0044-security-case-follow-through.md |
| task | WARDEN-WP-0045-T01 | done | — | workplans/WARDEN-WP-0045-agt-custodian-issuance-profile.md |
| task | WARDEN-WP-0045-T02 | done | — | workplans/WARDEN-WP-0045-agt-custodian-issuance-profile.md |
| task | WARDEN-WP-0045-T03 | wait | — | workplans/WARDEN-WP-0045-agt-custodian-issuance-profile.md |
| task | WARDEN-WP-0045-T03 | done | — | workplans/WARDEN-WP-0045-agt-custodian-issuance-profile.md |
| intake | WARDEN-IN-0001 | closed | — | intakes/intakes.md |
| intake | WARDEN-IN-0002 | closed | — | intakes/intakes.md |
| intake | WARDEN-IN-0003 | closed | — | intakes/intakes.md |

6
workplans/WARDEN-WP-0045-agt-custodian-issuance-profile.md
View file

@ -69,13 +69,13 @@ coverage counts. Tests: `tests/test_agt_custodian_profile.py`.
```task
id: WARDEN-WP-0045-T03
status: wait
status: done
priority: high
needs_human: true
blocking_reason: "Supervisor must add agt-custodian to the operator inventory, confirm the Vault agt-role allows user agt-custodian and extension permit-pty (railiance-platform), and do the first attended issuance after railiance-infra maps custodian-agt."
state_hub_task_id: "166447a5-e704-52f4-9d08-d0fb3061a406"
```
2026-10-20 (recorded 2026-10-21): railiance-infra mapped `custodian-agt` (uid 1001) to principal `agt-custodian`. railiance-platform `agt-role` allowed_extensions = `permit-pty`. The founder issued the first attended certificate via `credential.py exec --grant ops-warden/warden-sign`; it carried no extensions. The founder then reissued it after the role fix, valid 2026-10-20T23:24Z-2026-10-21T11:25Z, with `permit-pty` only, and a pty session worked from the custodian-agents distro. Receipt: the-custodian `docs/evidence/2026-10-20-railiance01-cutover-steps-2-4.md` (CUST-WP-0073-T02). Done.
Do the operator rollout. Copy the `agt-custodian` block into the operator's
`~/.config/warden/inventory.yaml`, out of the agent's reach. railiance-platform
confirms that `ssh/roles/agt-role` has `allowed_users` ⊇ `agt-custodian` and