coulomb/ops-warden
4
0
Fork 0
Code Issues Pull requests Projects Releases 2 Packages Wiki Activity Actions
ops-warden/wiki/playbooks/secrets-engine-requester-login.md
tegwick 73e40af6ca
All checks were successful
CI Smoke / host-smoke (push) Successful in 1s
Details
CI Smoke / container-smoke (push) Successful in 2s
Details
Route attended T03 requester login to scoped owner reader 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a09cbb-87c6-7900-a145-4ce53ba9f1a6
2026-09-14 02:47:32 +02:00

953 B
Raw Blame History

T03 requester session

CCR-2026-0025 admits only the new requester path. The contained Warden login uses secrets-engine-requester-workload-kv-read. Its owner command checks exact reader policies and denial of the existing consumer path, obtains one in-memory create-only token and submits only the three frozen T03 records. It cannot bind or consume an approval and never reads the KeyCape verifier Secret.

Use the current source catalog explicitly while the installed bundle is older: WARDEN_ROUTING_CATALOG=/home/worsch/ops-warden/registry/routing/catalog.yaml.

The reviewed child is /home/worsch/informed-decision/.venv/bin/python -B /home/worsch/railiance-platform/scripts/create-t03-approval-requests.py. It requires the owner-bound Approval Engine tunnel at 127.0.0.1:18281 and frozen native evaluator receipts. Its output is metadata-only persisted by the owner; Warden self-revokes and removes the reader helper after the child exits.