coulomb/railiance-platform
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

CCR-2026-0058: net-kingdom-owner approval; RPF-WP-0069 ready, T02 done, T06 cancelled, T07 approve-tool fix
Some checks failed
CI Smoke / host-smoke (push) Waiting to run
Details
CI Smoke / container-smoke (push) Waiting to run
Details
CCR intake gate / gate (push) Has been cancelled
Details

Browse source 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 994874@bnt-lap001
Assistant-Session: 6017c416-d619-47eb-bd1a-f670a02d7d87
This commit is contained in:
codex 2026-10-31 15:27:50 +01:00
parent 69cc133e9d
commit 2f69a4443d
3 changed files with 33 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

5
WORK-RECORDS.md
View file

@ -227,11 +227,12 @@
| task | RPF-WP-0068-T03 | wait | — | workplans/RPF-WP-0068-email-connect-platform-smtp.md |
| task | RPF-WP-0068-T04 | todo | — | workplans/RPF-WP-0068-email-connect-platform-smtp.md |
| task | RPF-WP-0069-T01 | done | — | workplans/RPF-WP-0069-bounded-executor-lanes.md |
| task | RPF-WP-0069-T02 | wait | — | workplans/RPF-WP-0069-bounded-executor-lanes.md |
| task | RPF-WP-0069-T02 | done | — | workplans/RPF-WP-0069-bounded-executor-lanes.md |
| task | RPF-WP-0069-T03 | wait | — | workplans/RPF-WP-0069-bounded-executor-lanes.md |
| task | RPF-WP-0069-T04 | wait | — | workplans/RPF-WP-0069-bounded-executor-lanes.md |
| task | RPF-WP-0069-T05 | wait | — | workplans/RPF-WP-0069-bounded-executor-lanes.md |
| task | RPF-WP-0069-T06 | wait | — | workplans/RPF-WP-0069-bounded-executor-lanes.md |
| task | RPF-WP-0069-T06 | cancel | — | workplans/RPF-WP-0069-bounded-executor-lanes.md |
| task | RPF-WP-0069-T07 | todo | — | workplans/RPF-WP-0069-bounded-executor-lanes.md |
| intake | RPF-IN-0001 | closed | — | intakes/intakes.md |
| intake | RPF-IN-0002 | open | — | intakes/intakes.md |
| intake | RPF-IN-0003 | open | — | intakes/intakes.md |

7
credential-change-requests/CCR-2026-0058-net-kingdom-bind-executor-svc-authelia-write.yaml
View file

@ -24,6 +24,13 @@ review:
decision: approved
comment: Approved by the founder in session 2026-10-31 as amended (window-scoped
role, bind self-rotation) for NK-WP-0056-T06.
- at: '2026-10-31T14:27:33+00:00'
reviewer: net-kingdom-owner
decision: approved
comment: Approved by the founder in session 2026-10-31 as amended (window-scoped
role, bind self-rotation) for NK-WP-0056-T06. Recorded by hand in the approve
tool's format; the tool refuses the second approval for this request type once the
first sets status approved.
target:
domain: infotech
tenant: platform

25
workplans/RPF-WP-0069-bounded-executor-lanes.md
View file

@ -43,7 +43,7 @@ dispatch in `scripts/credential-change.py`); CCR-2026-0058 drafted `proposed` wi
```task
id: RPF-WP-0069-T02
status: wait
status: done
priority: high
needs_human: true
decision_id: c29c6eda-fa13-4d53-8293-17261eb437c1
@ -105,7 +105,7 @@ ESO into `sso/nk-bind-executor-audit`, ClusterSecretStore restricted to `sso`.
```task
id: RPF-WP-0069-T06
status: wait
status: cancel
priority: medium
needs_human: true
decision_id: 3d0c8f86-7b9c-456b-8951-5ae889829118
@ -116,3 +116,24 @@ state_hub_task_id: "1456b467-f7c9-529d-9f3e-39404aaa36c6"
After secrets-engine answers the lane shape for the executor's LLDAP credential (its Q2),
draft the custody CCR here.
## Founder decisions 2026-10-31
Approved as `ready`. CCR-2026-0058 amended to a window-scoped role (created per admitted run, deleted after the
receipt; hub decision c29c6eda) and approved by platform-owner and net-kingdom-owner. T06 is cancelled: the bind
rotates its own password (hub decision 3d0c8f86), so the executor needs no LLDAP custody lane.
## Approve tool refuses the second approval for workload-kv-write-next-version
```task
id: RPF-WP-0069-T07
status: todo
priority: medium
```
`credential-change.py approve` sets `status: approved` after the first reviewer; for this request type, validation
then requires every role approval, so the second `approve` is refused before it can record itself (CCR-2026-0058's
net-kingdom-owner approval was recorded by hand in the tool's format). Make validation accept an `approved` request
that is still collecting role approvals, or have `approve` set `approved` only once all required roles are present,
with a test.