coulomb/railiance-platform
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Retain qualified coding custody source assessment and plan index
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 2s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a126e1-76f8-7643-8cf3-e93336539ade
This commit is contained in:
codex 2026-10-11 19:47:45 +02:00
parent 9460f6f200
commit 30d2290888
2 changed files with 51 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

3
WORK-RECORDS.md
View file

@ -36,6 +36,7 @@
| workplan | RPF-WP-0055 | backlog | — | workplans/RPF-WP-0055-keycape-client-secret-rotation-residual.md |
| task | RPF-WP-ADHOC-2026-10-10-T01 | done | — | workplans/ADHOC-2026-10-10.md |
| task | RPF-WP-ADHOC-2026-10-11-T01 | done | — | workplans/ADHOC-2026-10-11.md |
| task | RPF-WP-ADHOC-2026-10-11-T02 | done | — | workplans/ADHOC-2026-10-11.md |
| task | RPF-WP-0015-T01 | done | — | workplans/RPF-WP-0015-audit-core-custody-and-recovery-coordination.md |
| task | RPF-WP-0015-T02 | wait | — | workplans/RPF-WP-0015-audit-core-custody-and-recovery-coordination.md |
| task | RPF-WP-0015-T03 | wait | — | workplans/RPF-WP-0015-audit-core-custody-and-recovery-coordination.md |
@ -63,7 +64,7 @@
| task | RPF-WP-0035-T09 | wait | — | workplans/RPF-WP-0035-credential-lane-implementation.md |
| task | RPF-WP-0035-T10 | wait | — | workplans/RPF-WP-0035-credential-lane-implementation.md |
| task | RPF-WP-0035-T11 | done | — | workplans/RPF-WP-0035-credential-lane-implementation.md |
| task | RPF-WP-0035-T12 | todo | — | workplans/RPF-WP-0035-credential-lane-implementation.md |
| task | RPF-WP-0035-T12 | progress | — | workplans/RPF-WP-0035-credential-lane-implementation.md |
| task | RPF-WP-0035-T13 | done | — | workplans/RPF-WP-0035-credential-lane-implementation.md |
| task | RPF-WP-0036-T01 | done | — | workplans/RPF-WP-0036-platform-service-assurance.md |
| task | RPF-WP-0036-T02 | done | — | workplans/RPF-WP-0036-platform-service-assurance.md |

49
docs/reviews/2026-10-11-key39-coding-client-custody-platform-source-assessment.json Normal file
View file

@ -0,0 +1,49 @@
{
"schema": "platform-owner-source-assessment/v1",
"owner": "railiance-platform",
"role": "own custody/delivery source projection; maker qualification, not independent technical approval",
"task": "RPF-WP-ADHOC-2026-10-11-T03",
"completed_owner_record_before_formal_entry": {
"commit": "9460f6f",
"path": "workplans/ADHOC-2026-10-11.md",
"sha256": "c659956b2280bb2fa40d21a7ac6acca9514304aa5e7282b9ff61cd741881b544"
},
"exact_input_manifest_sha256": "18c6cac097104f79ef15e4293c6c8b18bebd617289df8f168b1cfe7d5e69598c",
"exact_proposal_sha256": "959a924adc12283405c529ecd573cad5e16f4dd9c96c258c44cab8df014dc8c0",
"disposition": "qualified_public_source_projection_agreement; actual custody_and_delivery_admission_not_established",
"source_agreement": [
"Current Key client fragment and Platform JWT role bind named codex client and tenant:platform; standing table source correction is exact",
"Current existing JWT role/policy bytes remain unchanged; no direct agent client-secret read grant or token substitution",
"Candidate coordinates are proposed, not observed or installed; no CCR assigned and browser CCR0040 is outside this case",
"Checked Deployment source lacks named env ref; bounded CCR/grant/catalogue source search finds no exact admission receipt; neither fact proves live absence"
],
"checks": {
"passed": 15,
"kind": "offline public-source consistency and counterexamples only",
"script": "/tmp/platform-key39-coding-custody-stage/checks/check_public_source.py",
"sha256": "169a0d8e92088cbeacd4b3f63bc5b6c02169856d15e49f8ccad5757c949fdf01",
"implementation_or_native_proof": false
},
"specific_source_counterexamples": [
"CLI valid signed JWT with wrong coding subject/tenant/type/roles is not rejected by its generic claim verifier; exact coding producer check absent",
"CLI expiry ceiling above900 is not enforced by generic verifier; future exact producer must add it",
"Stale tenant:coulomb source table fails projection agreement",
"Existing shared issuer/ESO admission, browser generation CCR or historical AppRole proof cannot substitute for named client custody/delivery"
],
"required_returns_before_credentials": [
"Exact Platform reviewed CCR/grant/catalogue/custody version and one-use founder reader binding",
"Net privately projected active client registration and env reference with matched custody/issuer versions, dedicated reader and controller/Argo/readiness owners",
"Reviewed private producer binding signature-verified subject/tenant/type/roles/scope/finite900 maximum",
"Actual runtime isolation from agent, exclusive tmpfs/host/process/profile and founder private environment/file delivery",
"Fresh exact authenticated founder native decision, runtime/plugin/leeway/node health and required production maintenance exception",
"Value-free refusal correlation, verified known-token revoke and owner-private unknown recovery"
],
"native_authorized": false,
"custody_reader_authorized": false,
"client_registration_authorized": false,
"transport_authorized": false,
"new_CCR_or_grant": false,
"standing_policy_widened": false,
"RPF55_residual_promoted": false,
"KEY39_native_complete": false
}