coulomb/railiance-platform
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Cancel withdrawn approval operator reader without inventing auth
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a07ff8-19d0-7820-b4d0-1353833cb7fc
This commit is contained in:
codex 2026-09-10 08:10:33 +02:00
parent 07b6b63fe6
commit 3109f950f9
7 changed files with 152 additions and 26 deletions
Download patch file Download diff file Expand all files Collapse all files

10
docs/credential-change-approval.md
View file

@ -90,12 +90,20 @@ superseded
cancelled
```
`in_flight` is the only state that may explicitly omit completion-only fields.
`in_flight` is the only nonterminal state that may explicitly omit completion-only fields.
It must declare every omission in `in_flight.missing_fields`, name the owner and
blocking reason, and remain non-resolvable. The validator still checks every
other field. This is not an applyable state and must never be used to hide a
malformed active lane.
An incomplete request withdrawn by its owner may instead be `cancelled`, retaining
its `in_flight` declaration as history. This requires `cancellation.owner`,
`cancellation.reason` and a non-secret `cancellation.source_ref`, with front-door
readiness `disabled` and `resolvable: false`. Only the same declared omissions are
allowed; all other validation remains. Cancellation cannot authorize apply or
resolve a reader. Moving back to an approval/apply state requires completing the
binding; keeping the historical declaration does not bypass that requirement.
Only `approved` requests may be applied. Only `verified` requests may become
`active`.

29
docs/credential-lane-designs/keycape-approval-client-side-readers.md
View file

@ -4,7 +4,8 @@ RPF-WP-0035-T06, the residual handed over by the completed verifier custody
(T05). Requests:
[CCR-2026-0019](../../credential-change-requests/CCR-2026-0019-secrets-engine-approval-client-read.yaml)
and [CCR-2026-0020](../../credential-change-requests/CCR-2026-0020-approval-engine-operator-client-read.yaml).
Both are `in_flight`, neither is approved, and nothing is applied.
CCR-2026-0019 remains `in_flight` and unapproved. CCR-2026-0020 is
`cancelled` on its requesting owner's explicit withdrawal; neither reader was applied.
## Why this exists as separate requests
@ -52,23 +53,17 @@ the consumer's shape rather than engineered away.
## Reader 2 — approval-engine-operator (CCR-2026-0020)
Held open deliberately. The exact-path read policy
`workload-kv-read-approval-engine-operator-client` is written and committed so
the eventual reader inherits a bounded grant rather than one drafted under time
pressure. Writing the policy is not admitting a reader.
Cancelled 2026-09-10. Approval Engine explicitly requests cancellation because
no presenter exists and no client-side reader is wanted. Source:
`approval-engine@849c75bb094613ff6ac1a1d4cda56a745520c5a1`,
`docs/keycape-service-registrations.md`, operator withdrawal section.
The retained exact-path policy is an unapplied historical artifact, not an
admission. No role, credential delivery, rotation or verifier change follows.
**Missing:** the presenting actor and its placement. This client carries the
widest scope set in the pair — `approval:create`, `read`, `approve`, `revoke`,
`supersede`, `observe`, `emit`, and deliberately not `consume`. approval-engine
records `principal_type` on every entry rather than restricting who may supply
approver evidence, and its owner records that whether a non-human principal
*should* is approval doctrine belonging to `gate-house`. Naming a reader here
would hand the widest approval scope to a guessed identity, so the request names
what is undetermined instead.
The delivery surface follows the actor: an attended operator implies a protected
workstation file; an in-cluster component implies an ExternalSecret into the
eventual `approval-engine` namespace; an agent surface implies neither.
Human approval belongs to informed-decision's PKCE client, INFD-WP-0001-T07/T08;
a future service requester needs its own narrow registration under the existing
Approval Engine owner work. Do not recreate the combined create/approve bundle.
The completed CCR-2026-0018 verifier custody remains unchanged.
## Not in scope