coulomb/railiance-platform
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

SCOPE: record RPF-WP-0062 supervised agent observer access and OpenBao agt role fixes
All checks were successful
CCR intake gate / gate (push) Successful in 1m13s
Details
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 605711@bnt-lap001
Assistant-Session: 1f5e2256-181f-49ed-b7b1-a1c34bf37a61
This commit is contained in:
codex 2026-10-20 23:59:04 +02:00
parent 4b2b72a81c
commit 3e6f2807cf
1 changed files with 20 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

20
SCOPE.md
View file

@ -106,6 +106,13 @@ description: S3 custody, policy and approved runtime credential delivery; packag
keywords: [openbao, secrets, vault-compatible, secret-management, dynamic-credentials, audit, kubernetes-auth]
```
```capability
type: security
title: Supervised agent observer access
description: custodian-agents namespace and ServiceAccount with ClusterRole custodian-supervised-observer (curated read; no secrets, configmaps, logs, exec or writes) for founder-issued short-lived agent tokens, plus the OpenBao agt SSH role limited to permit-pty. Writes are routed through gated-executor approvals.
keywords: [rbac, serviceaccount, supervised-agents, read-only, openbao, ssh-role]
```
## Getting oriented
Read [AGENTS.md](AGENTS.md), [INTENT.md](INTENT.md), then
@ -156,6 +163,19 @@ WP-0029 retains secondary credential invalidation/recovery; its completion
must not be presented as full primary-backup assurance.
## Supervised agent access — 2026-10-20
RPF-WP-0062 adds the `custodian-agents` namespace, the `custodian-agent`
ServiceAccount and ClusterRole `custodian-supervised-observer`: curated read
only, with no secrets, configmaps, logs, exec or writes. It is synced and
pinned at `567d2c6`; the founder issues 24-hour tokens for it under
CUST-WP-0073. The OpenBao `agt` SSH role now allows only the `permit-pty`
extension (`e415da9`). `scripts/openbao-apply-ssh-engine.sh` previously never
wrote roles, because it passed `bao` twice and exited 127; it is fixed at `4b2b72a`.
Privileged actions for these agents go through gated-executor and not through
this role.
## Repository maintenance reuse
The tracked `.generated-work-records.json` adopts the Custodian staged-source