tegwick
73e40af6ca
Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a09cbb-87c6-7900-a145-4ce53ba9f1a6
16 lines
953 B
Markdown
16 lines
953 B
Markdown
# T03 requester session
|
|
|
|
CCR-2026-0025 admits only the new requester path. The contained Warden login
|
|
uses `secrets-engine-requester-workload-kv-read`. Its owner command checks exact
|
|
reader policies and denial of the existing consumer path, obtains one in-memory
|
|
create-only token and submits only the three frozen T03 records. It cannot bind
|
|
or consume an approval and never reads the KeyCape verifier Secret.
|
|
|
|
Use the current source catalog explicitly while the installed bundle is older:
|
|
`WARDEN_ROUTING_CATALOG=/home/worsch/ops-warden/registry/routing/catalog.yaml`.
|
|
|
|
The reviewed child is
|
|
`/home/worsch/informed-decision/.venv/bin/python -B /home/worsch/railiance-platform/scripts/create-t03-approval-requests.py`.
|
|
It requires the owner-bound Approval Engine tunnel at 127.0.0.1:18281 and frozen
|
|
native evaluator receipts. Its output is metadata-only persisted by the owner;
|
|
Warden self-revokes and removes the reader helper after the child exits.
|