coulomb/ops-warden
4
0
Fork 0
Code Issues Pull requests Projects Releases 2 Packages Wiki Activity Actions
ops-warden/wiki/playbooks/informed-decision-sitting-requester-login.md
tegwick 15a4717dd1
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 5s
Details
Point sitting-create at the attended-exec wrapper. 
BAO_ADDR must be the OpenBao tunnel. Failed receipts may be retried.

Assistant: grok
Assistant-Session: 01a09dc1-b21e-77e1-919e-fcad2f82b267
2026-09-15 22:31:44 +02:00

1.7 KiB
Raw Blame History

Sitting-requester reader session

CCR-2026-0027 admits only platform/workloads/informed-decision/sitting-requester. The contained Warden login uses informed-decision-sitting-requester-workload-kv-read. Its owner command checks exact reader policies, sibling denial of secrets-engine/approval-requester, and a create-only KeyCape token exchange. It never prints the client secret.

Use the current source catalog explicitly (the installed bundle may not list this id yet):

WARDEN_ROUTING_CATALOG=/home/worsch/ops-warden/registry/routing/catalog.yaml

OpenBao is reached through http://127.0.0.1:18200 (public bao.coulomb.social is retracted). Warden self-revokes after the child exits.

Proof-only child (no sitting POST)

/home/worsch/railiance-platform/scripts/prove-sitting-requester-exchange.sh

Already verified 2026-09-15. Do not re-run as a substitute for create.

Sitting-create child (INFD-WP-0002-T03)

This is the analog of the T03 requester playbook's create child. It POSTs seven unapproved human_control objects (c01 skipped) and does not bind or consume.

Requires an Approval Engine tunnel at 127.0.0.1:18281. Use the attended wrapper so BAO_ADDR is the OpenBao tunnel, not public bao.coulomb.social. A failed receipt is overwritten; a created receipt is not.

kubectl -n approval-engine port-forward svc/approval-engine 18281:8080
python3 /home/worsch/railiance-platform/scripts/openbao-attended-exec.py \
  --lane informed-decision-sitting-requester-login -- \
  /home/worsch/informed-decision/tools/create_sitting_approvals.sh

Receipt: informed-decision/docs/evidence/2026-09-15-sitting-approval-creates.json (metadata only). Human disposition stays on informed-decision-approver.