Record operator approval of the two factory audit sender lanes

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a07ff8-19d0-7820-b4d0-1353833cb7fc

credential-change-requests/CCR-2026-0021-approval-engine-audit.yaml

@@ -3,29 +3,38 @@ kind: credential-change-request
 schema_version: 1
 request_type: workload-kv-read
 title: approval-engine load-bearing audit sender custody and delivery
-status: proposed
+status: approved
 created: '2026-09-11'
 updated: '2026-09-11'
 requester:
   agent: codex
-  reason: AUDIT-WP-0009-T09 and HFACT-WP-0001-T03 require the existing exact sender declaration. This
-    request supplies the missing platform custody and ESO delivery; receiver compatibility and service
-    rollout remain explicit gates.
+  reason: AUDIT-WP-0009-T09 and HFACT-WP-0001-T03 require the existing exact sender
+    declaration. This request supplies the missing platform custody and ESO delivery;
+    receiver compatibility and service rollout remain explicit gates.
 review:
   required: true
   required_approvers:
   - platform-operator
   - audit-core-owner
   - approval-engine-owner
-  comments: []
+  comments:
+  - at: '2026-09-11T04:36:46+00:00'
+    reviewer: user (platform-operator, audit-core-owner, approval-engine-owner)
+    decision: approved
+    comment: User replied "good, go on" on 2026-09-11 to the explicit approval question
+      for CCR-2026-0021 and CCR-2026-0022 as platform operator and owner of Audit
+      Core, Approval Engine, and Informed Decision. Record this as approval of the
+      reviewed exact sender lane. Compatible receiver, namespace readiness, attended
+      custody and native verification remain prerequisites; no factory execution or
+      broader grant is admitted.
 target:
   domain: financials
   tenant: platform
   workload: approval-engine
   environment: production
   purpose: Provide only the approval-engine sender with source=approval-engine, tenants=[tenant:platform],
-    may_write=true, may_read=false, evidence_kind=load-bearing, secret_policy=redact. Preserve the
-    existing receiver registry and every other sender.
+    may_write=true, may_read=false, evidence_kind=load-bearing, secret_policy=redact.
+    Preserve the existing receiver registry and every other sender.
 openbao:
   mount: platform
   kv_path: platform/workloads/approval-engine/audit-sender
@@ -55,56 +64,64 @@ access_frontdoor:
   resolvable: false
 delivery:
   surface: external-secrets
-  target: 'ClusterSecretStore openbao-approval-engine-audit restricted to namespace approval-engine;
-    ExternalSecret and Secret approval-engine/approval-engine-audit, key audit-token. Source: manifests/factory-audit-senders.yaml.
-    A missing namespace stays a workload-owner prerequisite; this packet creates none.'
+  target: 'ClusterSecretStore openbao-approval-engine-audit restricted to namespace
+    approval-engine; ExternalSecret and Secret approval-engine/approval-engine-audit,
+    key audit-token. Source: manifests/factory-audit-senders.yaml. A missing namespace
+    stays a workload-owner prerequisite; this packet creates none.'
 risk:
   classification: high
   notes:
-  - A bearer permits append for its exact sender and tenant, never reading or changing stored evidence.
-  - The registry update reads existing sender credentials inside the attended platform process only.
-    No registry is delivered to a producer.
-  - OpenBao login TTL limits the ESO reader session, not the audit bearer. Revocation must remove
-    the sender token from the receiver registry and prove refusal.
-  - New paths extend the existing coding-agent deny boundary. No existing high-risk grant is widened.
+  - A bearer permits append for its exact sender and tenant, never reading or changing
+    stored evidence.
+  - The registry update reads existing sender credentials inside the attended platform
+    process only. No registry is delivered to a producer.
+  - OpenBao login TTL limits the ESO reader session, not the audit bearer. Revocation
+    must remove the sender token from the receiver registry and prove refusal.
+  - New paths extend the existing coding-agent deny boundary. No existing high-risk
+    grant is widened.
 verification:
   positive:
-  - Independent CAS=0 token creation and exact sender merge with registry-version compare-and-set;
-    repeated runs preserve both tokens and other registry fields.
-  - ESO delivers only AUDIT_TOKEN into approval-engine/approval-engine-audit:audit-token; source and
-    receiver copies agree without displaying values.
-  - Compatible deployed receiver accepts and deduplicates a declared synthetic event for the exact
-    sender and tenant, retaining load-bearing/redact declarations.
+  - Independent CAS=0 token creation and exact sender merge with registry-version
+    compare-and-set; repeated runs preserve both tokens and other registry fields.
+  - ESO delivers only AUDIT_TOKEN into approval-engine/approval-engine-audit:audit-token;
+    source and receiver copies agree without displaying values.
+  - Compatible deployed receiver accepts and deduplicates a declared synthetic event
+    for the exact sender and tenant, retaining load-bearing/redact declarations.
   negative:
-  - Sibling sender path, full registry and parent listing are denied to each workload reader. Wrong
-    service account/namespace and disallowed store namespace fail.
-  - Receiver denies sibling source, wrong tenant, every read route and revoked token. No existing
-    sender is removed or re-scoped.
-  - Proposed or altered CCR, legacy receiver, malformed/duplicate registry identity, token collision,
-    stale registry version or partial/conflicting custody refuses without overwriting.
+  - Sibling sender path, full registry and parent listing are denied to each workload
+    reader. Wrong service account/namespace and disallowed store namespace fail.
+  - Receiver denies sibling source, wrong tenant, every read route and revoked token.
+    No existing sender is removed or re-scoped.
+  - Proposed or altered CCR, legacy receiver, malformed/duplicate registry identity,
+    token collision, stale registry version or partial/conflicting custody refuses
+    without overwriting.
   activation_conditions:
   - All three named owner reviews are approved before any native credential mutation.
-  - A current image supporting evidence_kind is published/admitted by audit-core and deployed with
-    its source scope and network policy; current c2fe39a image fails compatibility.
-  - Use the Warden attended platform-admin login envelope; preserve independent receipt and revoke
-    the session on exit.
-  - Apply reviewed policy/auth metadata and ESO projection only after receiver compatibility and namespace
-    readiness. An interrupted seed resumes from durable KV values, never blindly rotates or deletes.
-  - Record native positive/negative evidence before declaring verified or active. Custody alone does
-    not admit UI, human approval or factory execution.
+  - A current image supporting evidence_kind is published/admitted by audit-core and
+    deployed with its source scope and network policy; current c2fe39a image fails
+    compatibility.
+  - Use the Warden attended platform-admin login envelope; preserve independent receipt
+    and revoke the session on exit.
+  - Apply reviewed policy/auth metadata and ESO projection only after receiver compatibility
+    and namespace readiness. An interrupted seed resumes from durable KV values, never
+    blindly rotates or deletes.
+  - Record native positive/negative evidence before declaring verified or active.
+    Custody alone does not admit UI, human approval or factory execution.
 lifecycle:
-  deactivate: Stop the exact producer; remove only its admitted token from the registry using CAS
-    and reload/verify receiver refusal. Then detach its reader policy and remove its ExternalSecret/projection,
-    retaining KV versions for investigation. Do not delete audit events or other sender entries.
-  rotate: 'Reviewed overlap-first rotation: append a replacement to this sender only, deliver it,
-    prove acceptance, then remove the predecessor and prove refusal. The first-provision helper refuses
-    rotation and unexpected existing values.'
-  compromised: Stop affected producer and revoke the exact receiver token first; inspect affected
-    source/tenant events, rotate through a separate reviewed action, and preserve the independent
-    audit trail.
+  deactivate: Stop the exact producer; remove only its admitted token from the registry
+    using CAS and reload/verify receiver refusal. Then detach its reader policy and
+    remove its ExternalSecret/projection, retaining KV versions for investigation.
+    Do not delete audit events or other sender entries.
+  rotate: 'Reviewed overlap-first rotation: append a replacement to this sender only,
+    deliver it, prove acceptance, then remove the predecessor and prove refusal. The
+    first-provision helper refuses rotation and unexpected existing values.'
+  compromised: Stop affected producer and revoke the exact receiver token first; inspect
+    affected source/tenant events, rotate through a separate reviewed action, and
+    preserve the independent audit trail.
 state_hub:
   workplan_id: RPF-WP-0035
   task_id: RPF-WP-0035-T08
   related_workplan: AUDIT-WP-0009-T09
   decision_id: 2c9fe9f0-034a-41d7-9d49-b99df488fdc8
   decision_api_url: http://127.0.0.1:8000/decisions/2c9fe9f0-034a-41d7-9d49-b99df488fdc8
+  decision_resolved_at: '2026-09-11T04:36:46.312720Z'

credential-change-requests/CCR-2026-0022-informed-decision-audit.yaml

@@ -3,29 +3,39 @@ kind: credential-change-request
 schema_version: 1
 request_type: workload-kv-read
 title: informed-decision load-bearing audit sender custody and delivery
-status: proposed
+status: approved
 created: '2026-09-11'
 updated: '2026-09-11'
 requester:
   agent: codex
-  reason: AUDIT-WP-0009-T11 and HFACT-WP-0001-T03 require the existing exact sender declaration. This
-    request supplies the missing platform custody and ESO delivery; receiver compatibility and service
-    rollout remain explicit gates.
+  reason: AUDIT-WP-0009-T11 and HFACT-WP-0001-T03 require the existing exact sender
+    declaration. This request supplies the missing platform custody and ESO delivery;
+    receiver compatibility and service rollout remain explicit gates.
 review:
   required: true
   required_approvers:
   - platform-operator
   - audit-core-owner
   - informed-decision-owner
-  comments: []
+  comments:
+  - at: '2026-09-11T04:36:46+00:00'
+    reviewer: user (platform-operator, audit-core-owner, informed-decision-owner)
+    decision: approved
+    comment: User replied "good, go on" on 2026-09-11 to the explicit approval question
+      for CCR-2026-0021 and CCR-2026-0022 as platform operator and owner of Audit
+      Core, Approval Engine, and Informed Decision. Record this as approval of the
+      reviewed exact sender lane. Compatible receiver, namespace readiness, attended
+      custody and native verification remain prerequisites; no factory execution or
+      broader grant is admitted.
 target:
   domain: financials
   tenant: platform
   workload: informed-decision
   environment: production
-  purpose: Provide only the informed-decision sender with source=informed-decision, tenants=[tenant:platform],
-    may_write=true, may_read=false, evidence_kind=load-bearing, secret_policy=redact. Preserve the
-    existing receiver registry and every other sender.
+  purpose: Provide only the informed-decision sender with source=informed-decision,
+    tenants=[tenant:platform], may_write=true, may_read=false, evidence_kind=load-bearing,
+    secret_policy=redact. Preserve the existing receiver registry and every other
+    sender.
 openbao:
   mount: platform
   kv_path: platform/workloads/informed-decision/audit-sender
@@ -55,56 +65,64 @@ access_frontdoor:
   resolvable: false
 delivery:
   surface: external-secrets
-  target: 'ClusterSecretStore openbao-informed-decision-audit restricted to namespace informed-decision;
-    ExternalSecret and Secret informed-decision/informed-decision-audit, key token. Source: manifests/factory-audit-senders.yaml.
-    A missing namespace stays a workload-owner prerequisite; this packet creates none.'
+  target: 'ClusterSecretStore openbao-informed-decision-audit restricted to namespace
+    informed-decision; ExternalSecret and Secret informed-decision/informed-decision-audit,
+    key token. Source: manifests/factory-audit-senders.yaml. A missing namespace stays
+    a workload-owner prerequisite; this packet creates none.'
 risk:
   classification: high
   notes:
-  - A bearer permits append for its exact sender and tenant, never reading or changing stored evidence.
-  - The registry update reads existing sender credentials inside the attended platform process only.
-    No registry is delivered to a producer.
-  - OpenBao login TTL limits the ESO reader session, not the audit bearer. Revocation must remove
-    the sender token from the receiver registry and prove refusal.
-  - New paths extend the existing coding-agent deny boundary. No existing high-risk grant is widened.
+  - A bearer permits append for its exact sender and tenant, never reading or changing
+    stored evidence.
+  - The registry update reads existing sender credentials inside the attended platform
+    process only. No registry is delivered to a producer.
+  - OpenBao login TTL limits the ESO reader session, not the audit bearer. Revocation
+    must remove the sender token from the receiver registry and prove refusal.
+  - New paths extend the existing coding-agent deny boundary. No existing high-risk
+    grant is widened.
 verification:
   positive:
-  - Independent CAS=0 token creation and exact sender merge with registry-version compare-and-set;
-    repeated runs preserve both tokens and other registry fields.
-  - ESO delivers only AUDIT_TOKEN into informed-decision/informed-decision-audit:token; source and
-    receiver copies agree without displaying values.
-  - Compatible deployed receiver accepts and deduplicates a declared synthetic event for the exact
-    sender and tenant, retaining load-bearing/redact declarations.
+  - Independent CAS=0 token creation and exact sender merge with registry-version
+    compare-and-set; repeated runs preserve both tokens and other registry fields.
+  - ESO delivers only AUDIT_TOKEN into informed-decision/informed-decision-audit:token;
+    source and receiver copies agree without displaying values.
+  - Compatible deployed receiver accepts and deduplicates a declared synthetic event
+    for the exact sender and tenant, retaining load-bearing/redact declarations.
   negative:
-  - Sibling sender path, full registry and parent listing are denied to each workload reader. Wrong
-    service account/namespace and disallowed store namespace fail.
-  - Receiver denies sibling source, wrong tenant, every read route and revoked token. No existing
-    sender is removed or re-scoped.
-  - Proposed or altered CCR, legacy receiver, malformed/duplicate registry identity, token collision,
-    stale registry version or partial/conflicting custody refuses without overwriting.
+  - Sibling sender path, full registry and parent listing are denied to each workload
+    reader. Wrong service account/namespace and disallowed store namespace fail.
+  - Receiver denies sibling source, wrong tenant, every read route and revoked token.
+    No existing sender is removed or re-scoped.
+  - Proposed or altered CCR, legacy receiver, malformed/duplicate registry identity,
+    token collision, stale registry version or partial/conflicting custody refuses
+    without overwriting.
   activation_conditions:
   - All three named owner reviews are approved before any native credential mutation.
-  - A current image supporting evidence_kind is published/admitted by audit-core and deployed with
-    its source scope and network policy; current c2fe39a image fails compatibility.
-  - Use the Warden attended platform-admin login envelope; preserve independent receipt and revoke
-    the session on exit.
-  - Apply reviewed policy/auth metadata and ESO projection only after receiver compatibility and namespace
-    readiness. An interrupted seed resumes from durable KV values, never blindly rotates or deletes.
-  - Record native positive/negative evidence before declaring verified or active. Custody alone does
-    not admit UI, human approval or factory execution.
+  - A current image supporting evidence_kind is published/admitted by audit-core and
+    deployed with its source scope and network policy; current c2fe39a image fails
+    compatibility.
+  - Use the Warden attended platform-admin login envelope; preserve independent receipt
+    and revoke the session on exit.
+  - Apply reviewed policy/auth metadata and ESO projection only after receiver compatibility
+    and namespace readiness. An interrupted seed resumes from durable KV values, never
+    blindly rotates or deletes.
+  - Record native positive/negative evidence before declaring verified or active.
+    Custody alone does not admit UI, human approval or factory execution.
 lifecycle:
-  deactivate: Stop the exact producer; remove only its admitted token from the registry using CAS
-    and reload/verify receiver refusal. Then detach its reader policy and remove its ExternalSecret/projection,
-    retaining KV versions for investigation. Do not delete audit events or other sender entries.
-  rotate: 'Reviewed overlap-first rotation: append a replacement to this sender only, deliver it,
-    prove acceptance, then remove the predecessor and prove refusal. The first-provision helper refuses
-    rotation and unexpected existing values.'
-  compromised: Stop affected producer and revoke the exact receiver token first; inspect affected
-    source/tenant events, rotate through a separate reviewed action, and preserve the independent
-    audit trail.
+  deactivate: Stop the exact producer; remove only its admitted token from the registry
+    using CAS and reload/verify receiver refusal. Then detach its reader policy and
+    remove its ExternalSecret/projection, retaining KV versions for investigation.
+    Do not delete audit events or other sender entries.
+  rotate: 'Reviewed overlap-first rotation: append a replacement to this sender only,
+    deliver it, prove acceptance, then remove the predecessor and prove refusal. The
+    first-provision helper refuses rotation and unexpected existing values.'
+  compromised: Stop affected producer and revoke the exact receiver token first; inspect
+    affected source/tenant events, rotate through a separate reviewed action, and
+    preserve the independent audit trail.
 state_hub:
   workplan_id: RPF-WP-0035
   task_id: RPF-WP-0035-T08
   related_workplan: AUDIT-WP-0009-T11
   decision_id: ee4ff001-256a-4406-9cb8-51be2cd5d31b
   decision_api_url: http://127.0.0.1:8000/decisions/ee4ff001-256a-4406-9cb8-51be2cd5d31b
+  decision_resolved_at: '2026-09-11T04:36:46.480026Z'