coulomb/railiance-platform
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Approve sitting-requester CCRs and add the attended provisioner.
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
CCR-2026-0026/0027 are approved for the create-only informed-decision
client. Live KeyCape registration and CAS=0 custody stay in the
contained helper; no sitting POST.

Assistant: grok
Assistant-Session: 01a0a23b-3bf0-7341-b4e5-9dc05f72573a
This commit is contained in:
codex 2026-09-15 20:08:02 +02:00
parent 6dfb751e60
commit 4b34c239bc
7 changed files with 162 additions and 9 deletions
Download patch file Download diff file Expand all files Collapse all files

2
workplans/README.md
View file

@ -14,7 +14,7 @@ implementations or independent incidents.
| [RPF-WP-0035](RPF-WP-0035-credential-lane-implementation.md) | Three remaining lanes: secrets-engine JWT, Fluid operator KV, KeyCape approval clients | Signing T04 is complete; T05 admission answered and awaiting owner approval plus a founder-attended window. |
| [RPF-WP-0036](RPF-WP-0036-platform-service-assurance.md) | Implemented local assurance/admission; waits for recurring restore evidence, Q2 reception and owner handoff | Run the assurance commands; live acceptance and external ownership remain gated. |
| [RPF-WP-0038](RPF-WP-0038-forgejo-scaleway-primary-coverage.md) | Native backup, full Scaleway archive recovery and 273 MiB Nextcloud essentials recovery verified; scheduled tier cutover remains | Bind recurring caller/dependencies, verified inventory, quota checks and separate owner retention. |
| [RPF-WP-0042](RPF-WP-0042-informed-decision-sitting-requester.md) | Sitting-requester CCR-2026-0026/0027 allocated; no apply | Do not widen 0024/0025. Attended seed waits on owner reviews and KeyCape row. |
| [RPF-WP-0042](RPF-WP-0042-informed-decision-sitting-requester.md) | Sitting-requester CCRs approved; live KeyCape/OpenBao apply remains | Attended `provision-sitting-requester.sh`; no sitting POST. |
RPF-WP-0036-T02/T05/T07 are complete; T03/T04/T06 retain the remaining
acceptance gates. Treat credential exposure closure as the highest-priority attended

12
workplans/RPF-WP-0042-informed-decision-sitting-requester.md
View file

@ -4,7 +4,7 @@ type: workplan
title: "Allocate Informed Decision sitting-requester custody"
domain: financials
repo: railiance-platform
status: ready
status: active
flavor: implementation
owner: grok
topic_slug: railiance
@ -38,12 +38,12 @@ non-resolvable. ESO projection is unapplied source.
```task
id: RPF-WP-0042-T02
status: wait
status: progress
priority: high
state_hub_task_id: "c6fbf99c-de2b-55be-9f0c-58be9fe7c518"
```
Requires named owner reviews, KeyCape row `informed-decision-sitting-requester`,
attended CAS=0 custody, exact policy/auth readback, sibling
`secrets-engine/approval-requester` denial, and create-only token-exchange proof.
No sitting POST until that proof exists.
Operator approved CCR-2026-0026/0027 on 2026-09-15. Source registration is in
`key-cape/config/service-clients.example.yaml`. Live apply is the silent helper
`scripts/provision-sitting-requester.sh` through `openbao-attended-exec.py`.
No sitting POST until exchange proof exists. Do not widen CCR-2026-0024/0025.