tegwick
15a4717dd1
BAO_ADDR must be the OpenBao tunnel. Failed receipts may be retried. Assistant: grok Assistant-Session: 01a09dc1-b21e-77e1-919e-fcad2f82b267
42 lines
1.7 KiB
Markdown
42 lines
1.7 KiB
Markdown
# Sitting-requester reader session
|
|
|
|
CCR-2026-0027 admits only
|
|
`platform/workloads/informed-decision/sitting-requester`. The contained Warden
|
|
login uses `informed-decision-sitting-requester-workload-kv-read`. Its owner
|
|
command checks exact reader policies, sibling denial of
|
|
`secrets-engine/approval-requester`, and a create-only KeyCape token exchange.
|
|
It never prints the client secret.
|
|
|
|
Use the current source catalog explicitly (the installed bundle may not list
|
|
this id yet):
|
|
|
|
`WARDEN_ROUTING_CATALOG=/home/worsch/ops-warden/registry/routing/catalog.yaml`
|
|
|
|
OpenBao is reached through `http://127.0.0.1:18200` (public
|
|
`bao.coulomb.social` is retracted). Warden self-revokes after the child exits.
|
|
|
|
## Proof-only child (no sitting POST)
|
|
|
|
`/home/worsch/railiance-platform/scripts/prove-sitting-requester-exchange.sh`
|
|
|
|
Already verified 2026-09-15. Do not re-run as a substitute for create.
|
|
|
|
## Sitting-create child (INFD-WP-0002-T03)
|
|
|
|
This is the analog of the T03 requester playbook's create child. It POSTs
|
|
seven unapproved `human_control` objects (`c01` skipped) and does not bind
|
|
or consume.
|
|
|
|
Requires an Approval Engine tunnel at `127.0.0.1:18281`. Use the attended
|
|
wrapper so `BAO_ADDR` is the OpenBao tunnel, not public `bao.coulomb.social`.
|
|
A failed receipt is overwritten; a `created` receipt is not.
|
|
|
|
```sh
|
|
kubectl -n approval-engine port-forward svc/approval-engine 18281:8080
|
|
python3 /home/worsch/railiance-platform/scripts/openbao-attended-exec.py \
|
|
--lane informed-decision-sitting-requester-login -- \
|
|
/home/worsch/informed-decision/tools/create_sitting_approvals.sh
|
|
```
|
|
|
|
Receipt: `informed-decision/docs/evidence/2026-09-15-sitting-approval-creates.json`
|
|
(metadata only). Human disposition stays on `informed-decision-approver`.
|