coulomb/ops-warden
4
0
Fork 0
Code Issues Pull requests Projects Releases 2 Packages Wiki Activity Actions
ops-warden/wiki/playbooks/informed-decision-sitting-requester-login.md
tegwick 4e15d725ec
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details
Name the sitting-POST child for the sitting-requester login lane. 
Proof-only child stays prove-sitting-requester-exchange.sh. Create child
is informed-decision tools/create_sitting_approvals.py (seven memos, no
bind). Requires source catalog and OpenBao at 127.0.0.1:18200.

Assistant: grok
Assistant-Session: 01a09dc1-b21e-77e1-919e-fcad2f82b267
2026-09-15 22:25:05 +02:00

1.7 KiB
Raw Blame History

Sitting-requester reader session

CCR-2026-0027 admits only platform/workloads/informed-decision/sitting-requester. The contained Warden login uses informed-decision-sitting-requester-workload-kv-read. Its owner command checks exact reader policies, sibling denial of secrets-engine/approval-requester, and a create-only KeyCape token exchange. It never prints the client secret.

Use the current source catalog explicitly (the installed bundle may not list this id yet):

WARDEN_ROUTING_CATALOG=/home/worsch/ops-warden/registry/routing/catalog.yaml

OpenBao is reached through http://127.0.0.1:18200 (public bao.coulomb.social is retracted). Warden self-revokes after the child exits.

Proof-only child (no sitting POST)

/home/worsch/railiance-platform/scripts/prove-sitting-requester-exchange.sh

Already verified 2026-09-15. Do not re-run as a substitute for create.

Sitting-create child (INFD-WP-0002-T03)

This is the analog of the T03 requester playbook's create child. It POSTs seven unapproved human_control objects (c01 skipped) and does not bind or consume.

Requires an Approval Engine tunnel at 127.0.0.1:18281.

export WARDEN_ROUTING_CATALOG=/home/worsch/ops-warden/registry/routing/catalog.yaml
export BAO_ADDR=http://127.0.0.1:18200
export INFD_APPROVAL_ORIGIN=http://127.0.0.1:18281
warden access informed-decision-sitting-requester-login --exec -- \
  /home/worsch/informed-decision/.venv/bin/python -B \
  /home/worsch/informed-decision/tools/create_sitting_approvals.py \
  --approval-origin http://127.0.0.1:18281

Receipt: informed-decision/docs/evidence/2026-09-15-sitting-approval-creates.json (metadata only). Human disposition stays on informed-decision-approver.