coulomb/railiance-platform
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Close issuer pin prerequisite and prepare named custody review decisions
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-5.6-luna
Assistant-Session: 01a07ff8-19d0-7820-b4d0-1353833cb7fc
This commit is contained in:
codex 2026-09-09 00:40:23 +02:00
parent e06d7fc390
commit 52b24eab9a
6 changed files with 166 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

15
workplans/RPF-WP-0035-credential-lane-implementation.md
View file

@ -146,6 +146,8 @@ closure: `history/2026-09-05-preflight-signing-activation-complete.md`.
```task
id: RPF-WP-0035-T05
status: wait
needs_human: true
intervention_note: "Review CCR-2026-0017 and CCR-2026-0018 as platform-operator and key-cape-owner; both pending decisions are linked from the CCRs and the review packet. Signed issuer and exact configuration pin are proved."
priority: high
state_hub_task_id: "e15d62c9-e5da-5721-a135-87c050f7851c"
```
@ -203,6 +205,19 @@ custody mutation or client-side read. Keep the current authority preflight and
this signed-token proof as separate receipts. Live ESO/client/approval and
separate audit/client-side custody acceptance remain open.
2026-09-09 configuration and review-queue return: NetKingdom pinned the verified
HTTPS issuer, using an atomic UID/resourceVersion test and independent readback.
Secret revision `58713343`; unrelated configuration and signing key unchanged;
no Deployment rollout. Receipt: `docs/evidence/2026-09-09-keycape-upstream-issuer-pin.json`.
The two existing CCRs remain proposed. They now link to concrete pending review
decisions, with platform-operator and key-cape-owner named explicitly. See
`docs/credential-lane-designs/keycape-approval-clients-review.md`. T05 owns this
human dependency; HFACT consumes it without a duplicate approval request.
Custody/ESO activation, client verification and the separate client-side/audit
lanes remain open. Current CLI apply plans refuse the proposed requests.
## Dependency review — 2026-09-06
SECRETS-WP-0008-T02 now records the local PIP claim/validation join implemented