coulomb/railiance-platform
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Verify scoped approval client delivery through attended reader session
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a09cbb-87c6-7900-a145-4ce53ba9f1a6
This commit is contained in:
codex 2026-09-14 01:46:45 +02:00
parent bbff2bfb93
commit 525664efa3
6 changed files with 301 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

26
docs/evidence/2026-09-14-ccr0019-delivery-check.json Normal file
View file

@ -0,0 +1,26 @@
{
"observed_at": "2026-09-13T23:44:04.757286+00:00",
"ccr_id": "CCR-2026-0019",
"status": "passed",
"approval_mutations": false,
"checks": {
"private_delivery_existing_version_1": true,
"approval:read": {
"native_claim_http_status": 404,
"profile_checked": true
},
"approval:consume": {
"native_claim_http_status": 403,
"profile_checked": true
}
},
"cleanup": true,
"warden_session": "exited_0_after_self_revocation_and_helper_cleanup",
"approval_engine_pod_uid": "7b8c05d9-f1d5-403d-abb3-2250bff9db5e",
"approval_engine_image": "sha256:251941a5cb2724b57cc32cff6b693b1ab0be695bee4f56f02d51961189c0fa49",
"limits": [
"Read request used a fresh nonexistent approval id; 404 proves authenticated routing, not a usable claim.",
"Consume-only token was denied the read route; no real approval was consumed.",
"Wrong-group human login remains untested."
]
}

34
docs/evidence/2026-09-14-ccr0019-reader-preflight.json Normal file
View file

@ -0,0 +1,34 @@
{
"observed_at": "2026-09-13T23:44:04.757314+00:00",
"ccr_id": "CCR-2026-0019",
"secret_values_read": false,
"status": "passed",
"checks": {
"platform/data/workloads/secrets-engine/approval-client": [
"read"
],
"platform/metadata/workloads/secrets-engine/approval-client": [
"read"
],
"platform/data/workloads/approval-engine/operator-client": [
"deny"
],
"platform/metadata/workloads/secrets-engine": [
"deny"
],
"platform/metadata/workloads": [
"deny"
],
"platform/data/workloads/activity-core/llm-connect/llm-connect-provider-secrets": [
"deny"
],
"sys/policies/acl/workload-kv-read-secrets-engine-approval-client": [
"deny"
],
"auth/netkingdom/role/secrets-engine-approval-client-workload-kv-read": [
"deny"
]
},
"identity_policy_scope_verified": true,
"warden_session": "exited_0_after_self_revocation_and_helper_cleanup"
}