From 919b9ab3e5a34a3d65efc9104cb700ddbc385df4 Mon Sep 17 00:00:00 2001 From: tegwick Date: Fri, 9 Oct 2026 20:01:26 +0200 Subject: [PATCH] WARDEN-WP-0044-T03: record the agreed broker generate contract Co-Authored-By: Claude Opus 5.5 Assistant: claude-code Assistant-Model: opus Assistant-Process: 427672@bnt-lap001 Assistant-Session: a0a2367e-4697-440c-a4e5-9713c009f6d8 --- workplans/WARDEN-WP-0044-security-case-follow-through.md | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/workplans/WARDEN-WP-0044-security-case-follow-through.md b/workplans/WARDEN-WP-0044-security-case-follow-through.md index 23e52d2..103446a 100644 --- a/workplans/WARDEN-WP-0044-security-case-follow-through.md +++ b/workplans/WARDEN-WP-0044-security-case-follow-through.md @@ -161,6 +161,13 @@ reverses exactly this case's steps. Acceptance: the Forgejo reference case (NK-WP-0048-T06) reaches `live` through this path, with no case-specific script. +Agreed with railiance-platform (RPF-WP-0054-T01, 2026-10-09): +- `mint-secret` runs `credential.py generate --grant keycape/client-secret-generate + --client-id --case-ref --case-file ` as the caller's + child process. The broker re-derives the case-ref and checks status and + client_id. +- warden refuses that step when `WARDEN_AGENT_ID` is set. + ```task id: WARDEN-WP-0044-T04 status: wait