coulomb/railiance-platform
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

agent-high-risk-boundary: deny agent reads of the core-hub Forgejo source token (CCR-2026-0031)
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
Matches the policy-nexus entries; ops-warden now lists the path as high-risk
(catalog 2f8387c, generated paths f1e25c3). make agent-high-risk-boundary-check: ok.
Live apply needs an attended platform-admin session.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 3775@bnt-lap001
Assistant-Session: cfacb6a5-ad5b-4f79-ac67-053e3b0d34a3
This commit is contained in:
codex 2026-10-03 12:57:47 +02:00
parent 963a4f8234
commit 6bf31b61cf
1 changed files with 8 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

8
openbao/policies/agent-high-risk-boundary.hcl
View file

@ -108,6 +108,14 @@ path "platform/metadata/workloads/policy-nexus/forgejo-source-read" {
capabilities = ["deny"]
}
# CCR-2026-0031: core-hub private-source read token is ESO-only.
path "platform/data/workloads/core-hub/forgejo-source-read" {
capabilities = ["deny"]
}
path "platform/metadata/workloads/core-hub/forgejo-source-read" {
capabilities = ["deny"]
}
# RPF-WP-0035-T04: preflight signing key is API-only.
path "platform/data/workloads/state-hub/repository-rename-preflight" {
capabilities = ["deny"]