coulomb/railiance-platform
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix: preserve unrelated live boundary rules during signing lane apply
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a06ed7-828d-7ca0-a8d4-0c3e5a0c4102
This commit is contained in:
codex 2026-09-05 16:43:47 +02:00
parent 80793afe4f
commit 238d261536
4 changed files with 24 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

11
docs/credential-lane-designs/state-hub-preflight-activation.md
View file

@ -96,3 +96,14 @@ custody for reviewed recovery. Never restore a compromised predecessor key.
T04 remains open until live custody/auth negatives, ESO delivery, API-only
exposure, all-replica equality, signed preflight, rotation/invalidation and
recovery receipts pass. Source tests and server dry-run alone are preparation.
## Live policy drift review
The first contained apply refused before mutation because the live shared
boundary lacks the source-only Policy Nexus data/metadata denies. A separate
contained metadata read confirmed that exact difference. The reviewed writer
now pins the observed live baseline and appends only `agent-deny-overlay.hcl`,
preserving every unrelated live rule. It does not deploy the pending Policy
Nexus source-only change as part of this lane. The global source policy retains
its desired rules; live parity for that other lane remains a platform assurance
observation, not an acceptance claim here.