coulomb/railiance-platform
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Record sitting-requester custody apply; keep exchange proof open.
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 3s
Details

Browse source 
Attended helper returned applied, KV version 1, ESO synced, KeyCape
ready. No sitting POST. CCRs 0026/0027 are applied metadata only.

Assistant: grok
Assistant-Session: 01a0a23b-3bf0-7341-b4e5-9dc05f72573a
This commit is contained in:
codex 2026-09-15 20:31:00 +02:00
parent 75e5c1af65
commit 50f031091c
5 changed files with 54 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

13
credential-change-requests/CCR-2026-0026-informed-decision-sitting-requester-verifier.yaml
View file

@ -3,7 +3,7 @@ kind: credential-change-request
schema_version: 1
request_type: workload-kv-read
title: Informed Decision sitting-requester KeyCape verifier custody
status: approved
status: applied
created: '2026-09-15'
updated: '2026-09-15'
requester:
@ -84,6 +84,17 @@ verification:
until attended CAS=0 custody and exact policy/auth readback.
- Separate reader verification and no human entry synthesized.
- No sitting POST until exchange proof exists.
evidence:
- at: '2026-09-15T18:28:28+00:00'
actor: operator via attended sitting-requester custody session
kind: delegated_metadata_apply
result: passed
details:
- Delegated metadata applier ran as operator via attended sitting-requester custody
session using local bao CLI ambient authority.
- 'Policy metadata write: sys/policies/acl/workload-kv-read-keycape-informed-decision-sitting-requester'
- 'Auth role metadata write: auth/kubernetes/role/external-secrets-keycape-informed-decision-sitting-requester'
- No secret values were read, written, printed, or accepted in argv.
lifecycle:
deactivate: Disable the informed-decision-sitting-requester KeyCape registration
and detach only these two sitting-requester reader roles. Preserve CCR-2026-0024/0025

13
credential-change-requests/CCR-2026-0027-informed-decision-sitting-requester-reader.yaml
View file

@ -3,7 +3,7 @@ kind: credential-change-request
schema_version: 1
request_type: workload-kv-read
title: Informed Decision sitting-requester attended operator reader
status: approved
status: applied
created: '2026-09-15'
updated: '2026-09-15'
requester:
@ -93,6 +93,17 @@ verification:
verifier delivery.
- Separate reader verification and no human entry synthesized.
- No sitting POST until exchange proof exists.
evidence:
- at: '2026-09-15T18:28:28+00:00'
actor: operator via attended sitting-requester custody session
kind: delegated_metadata_apply
result: passed
details:
- Delegated metadata applier ran as operator via attended sitting-requester custody
session using local bao CLI ambient authority.
- 'Policy metadata write: sys/policies/acl/workload-kv-read-informed-decision-sitting-requester-client'
- 'Auth role metadata write: auth/netkingdom/role/informed-decision-sitting-requester-workload-kv-read'
- No secret values were read, written, printed, or accepted in argv.
lifecycle:
deactivate: Disable the informed-decision-sitting-requester KeyCape registration
and detach only these two sitting-requester reader roles. Preserve CCR-2026-0024/0025