coulomb/railiance-platform
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Sitting requester: accept approval:create+read; one-shot refuses re-run; CCR-0026/0027 amendment proposed
All checks were successful
CCR intake gate / gate (push) Successful in 3m15s
Details
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
key-cape 82b471f (founder decision 2026-11-01) adds approval:read to
informed-decision-sitting-requester. provision-sitting-requester.py contract()
now requires exactly [approval:create, approval:read] and still refuses
consume, approve and openid. The one-shot helper refuses to re-run once its
2026-09-15 receipt is applied, before it could overwrite that evidence, and
names keycape-client.py remove-then-add. Tests updated. CCR-2026-0026/0027:
text-only amendment_proposed; custody, policy, role and delivery unchanged,
so no new CCR and status stays applied.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 5502@bnt-lap001
Assistant-Session: 68b3b02f-5d0f-4e71-8421-796f62e50196
This commit is contained in:
codex 2026-11-01 04:04:15 +01:00
parent 6858bef858
commit 356d84a095
4 changed files with 95 additions and 9 deletions
Download patch file Download diff file Expand all files Collapse all files

23
scripts/provision-sitting-requester.py
View file

@ -28,14 +28,31 @@ rollout = load('requester_rollout', '/home/worsch/net-kingdom/sso-mfa/k8s/keycap
rollout.IDS = ('informed-decision-sitting-requester',)
# key-cape 82b471f (founder decision 2026-11-01): create + read for present_existing intake.
# Still never consume, approve or openid. Custody is unchanged (CCR-2026-0026/0027 amendment).
SCOPES = ['approval:create', 'approval:read']
RERUN_REFUSAL = ('sitting requester already provisioned (receipt status applied, 2026-09-15); this '
'one-shot helper does not re-run. A registration change, such as the 2026-11-01 '
'approval:read scope, is a founder-run remove-then-add through net-kingdom '
'sso-mfa/k8s/keycape/keycape-client.py: see key-cape docs/sitting-requester-read-scope.md.')
def already_provisioned():
try:
return json.loads(RECEIPT.read_text()).get('status') == 'applied'
except (OSError, ValueError):
return False
def contract():
require(CLIENT['clientId'] == 'informed-decision-sitting-requester', 'requester_contract_drift')
require(CLIENT['allowedScopes'] == ['approval:create'], 'requester_contract_drift')
require(CLIENT['allowedScopes'] == SCOPES, 'requester_contract_drift')
require(CLIENT['serviceSubject'] == 'informed-decision', 'requester_contract_drift')
require(CLIENT['audience'] == 'approval-engine', 'requester_contract_drift')
require(CLIENT['tenant'] == 'tenant:platform', 'requester_contract_drift')
require('approval:consume' not in CLIENT['allowedScopes'], 'consume_scope_forbidden')
require('approval:approve' not in CLIENT['allowedScopes'], 'approve_scope_forbidden')
require('openid' not in CLIENT['allowedScopes'], 'openid_scope_forbidden')
def run(receipt):
@ -92,6 +109,10 @@ def run(receipt):
if __name__ == '__main__':
# Refuse before the receipt handler below, which would overwrite the 2026-09-15 evidence.
if already_provisioned():
sys.stderr.write('refused: ' + RERUN_REFUSAL + '\n')
raise SystemExit(2)
receipt = {'observed_at': datetime.now(timezone.utc).isoformat(), 'status': 'failed', 'phase': 'preflight', 'ccrs': list(CCRS), 'credential_values_emitted': False, 'approval_mutations': False, 'sitting_post': False}
try:
run(receipt)