coulomb/ops-warden
4
0
Fork 0
Code Issues Pull requests Projects Releases 2 Packages Wiki Activity Actions

Route attended T03 requester login to scoped owner reader
All checks were successful
CI Smoke / host-smoke (push) Successful in 1s
Details
CI Smoke / container-smoke (push) Successful in 2s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a09cbb-87c6-7900-a145-4ce53ba9f1a6
This commit is contained in:
tegwick 2026-09-14 02:47:32 +02:00
parent edbe95fe15
commit 73e40af6ca
2 changed files with 40 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

16
wiki/playbooks/secrets-engine-requester-login.md Normal file
View file

@ -0,0 +1,16 @@
# T03 requester session
CCR-2026-0025 admits only the new requester path. The contained Warden login
uses `secrets-engine-requester-workload-kv-read`. Its owner command checks exact
reader policies and denial of the existing consumer path, obtains one in-memory
create-only token and submits only the three frozen T03 records. It cannot bind
or consume an approval and never reads the KeyCape verifier Secret.
Use the current source catalog explicitly while the installed bundle is older:
`WARDEN_ROUTING_CATALOG=/home/worsch/ops-warden/registry/routing/catalog.yaml`.
The reviewed child is
`/home/worsch/informed-decision/.venv/bin/python -B /home/worsch/railiance-platform/scripts/create-t03-approval-requests.py`.
It requires the owner-bound Approval Engine tunnel at 127.0.0.1:18281 and frozen
native evaluator receipts. Its output is metadata-only persisted by the owner;
Warden self-revokes and removes the reader helper after the child exits.