coulomb/ops-warden
4
0
Fork 0
Code Issues Pull requests Projects Releases 2 Packages Wiki Activity Actions

Name the sitting-POST child for the sitting-requester login lane.
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
Proof-only child stays prove-sitting-requester-exchange.sh. Create child
is informed-decision tools/create_sitting_approvals.py (seven memos, no
bind). Requires source catalog and OpenBao at 127.0.0.1:18200.

Assistant: grok
Assistant-Session: 01a09dc1-b21e-77e1-919e-fcad2f82b267
This commit is contained in:
tegwick 2026-09-15 22:25:05 +02:00
parent 5a232b7f97
commit 4e15d725ec
1 changed files with 32 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

38
wiki/playbooks/informed-decision-sitting-requester-login.md
View file

@ -5,13 +5,39 @@ CCR-2026-0027 admits only
login uses `informed-decision-sitting-requester-workload-kv-read`. Its owner
command checks exact reader policies, sibling denial of
`secrets-engine/approval-requester`, and a create-only KeyCape token exchange.
It does not POST sittings and never prints the client secret.
It never prints the client secret.
Use the current source catalog explicitly:
Use the current source catalog explicitly (the installed bundle may not list
this id yet):
`WARDEN_ROUTING_CATALOG=/home/worsch/ops-warden/registry/routing/catalog.yaml`
The reviewed child is
`/home/worsch/railiance-platform/scripts/prove-sitting-requester-exchange.sh`.
OpenBao is reached through `http://127.0.0.1:18200`. Warden self-revokes after
the child exits.
OpenBao is reached through `http://127.0.0.1:18200` (public
`bao.coulomb.social` is retracted). Warden self-revokes after the child exits.
## Proof-only child (no sitting POST)
`/home/worsch/railiance-platform/scripts/prove-sitting-requester-exchange.sh`
Already verified 2026-09-15. Do not re-run as a substitute for create.
## Sitting-create child (INFD-WP-0002-T03)
This is the analog of the T03 requester playbook's create child. It POSTs
seven unapproved `human_control` objects (`c01` skipped) and does not bind
or consume.
Requires an Approval Engine tunnel at `127.0.0.1:18281`.
```sh
export WARDEN_ROUTING_CATALOG=/home/worsch/ops-warden/registry/routing/catalog.yaml
export BAO_ADDR=http://127.0.0.1:18200
export INFD_APPROVAL_ORIGIN=http://127.0.0.1:18281
warden access informed-decision-sitting-requester-login --exec -- \
/home/worsch/informed-decision/.venv/bin/python -B \
/home/worsch/informed-decision/tools/create_sitting_approvals.py \
--approval-origin http://127.0.0.1:18281
```
Receipt: `informed-decision/docs/evidence/2026-09-15-sitting-approval-creates.json`
(metadata only). Human disposition stays on `informed-decision-approver`.