From 4e15d725ecc4eab9e8bd94ab9b8f522fbb4219ac Mon Sep 17 00:00:00 2001 From: tegwick Date: Tue, 15 Sep 2026 22:25:05 +0200 Subject: [PATCH] Name the sitting-POST child for the sitting-requester login lane. Proof-only child stays prove-sitting-requester-exchange.sh. Create child is informed-decision tools/create_sitting_approvals.py (seven memos, no bind). Requires source catalog and OpenBao at 127.0.0.1:18200. Assistant: grok Assistant-Session: 01a09dc1-b21e-77e1-919e-fcad2f82b267 --- ...formed-decision-sitting-requester-login.md | 38 ++++++++++++++++--- 1 file changed, 32 insertions(+), 6 deletions(-) diff --git a/wiki/playbooks/informed-decision-sitting-requester-login.md b/wiki/playbooks/informed-decision-sitting-requester-login.md index 784e690..41e5bee 100644 --- a/wiki/playbooks/informed-decision-sitting-requester-login.md +++ b/wiki/playbooks/informed-decision-sitting-requester-login.md @@ -5,13 +5,39 @@ CCR-2026-0027 admits only login uses `informed-decision-sitting-requester-workload-kv-read`. Its owner command checks exact reader policies, sibling denial of `secrets-engine/approval-requester`, and a create-only KeyCape token exchange. -It does not POST sittings and never prints the client secret. +It never prints the client secret. -Use the current source catalog explicitly: +Use the current source catalog explicitly (the installed bundle may not list +this id yet): `WARDEN_ROUTING_CATALOG=/home/worsch/ops-warden/registry/routing/catalog.yaml` -The reviewed child is -`/home/worsch/railiance-platform/scripts/prove-sitting-requester-exchange.sh`. -OpenBao is reached through `http://127.0.0.1:18200`. Warden self-revokes after -the child exits. +OpenBao is reached through `http://127.0.0.1:18200` (public +`bao.coulomb.social` is retracted). Warden self-revokes after the child exits. + +## Proof-only child (no sitting POST) + +`/home/worsch/railiance-platform/scripts/prove-sitting-requester-exchange.sh` + +Already verified 2026-09-15. Do not re-run as a substitute for create. + +## Sitting-create child (INFD-WP-0002-T03) + +This is the analog of the T03 requester playbook's create child. It POSTs +seven unapproved `human_control` objects (`c01` skipped) and does not bind +or consume. + +Requires an Approval Engine tunnel at `127.0.0.1:18281`. + +```sh +export WARDEN_ROUTING_CATALOG=/home/worsch/ops-warden/registry/routing/catalog.yaml +export BAO_ADDR=http://127.0.0.1:18200 +export INFD_APPROVAL_ORIGIN=http://127.0.0.1:18281 +warden access informed-decision-sitting-requester-login --exec -- \ + /home/worsch/informed-decision/.venv/bin/python -B \ + /home/worsch/informed-decision/tools/create_sitting_approvals.py \ + --approval-origin http://127.0.0.1:18281 +``` + +Receipt: `informed-decision/docs/evidence/2026-09-15-sitting-approval-creates.json` +(metadata only). Human disposition stays on `informed-decision-approver`.