coulomb/railiance-platform
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Requalify tasks after round-2 founder decisions and fix mislabeled human gates (2026-10-11)
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
See the-custodian docs/decisions/2026-10-11-security-unblock-decisions.md.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 1370019@bnt-lap001
Assistant-Session: d462dd63-16de-4189-ae70-b9cd6566bf87
This commit is contained in:
codex 2026-10-11 20:48:41 +02:00
parent 12ae540434
commit 73f7f55e5c
1 changed files with 12 additions and 7 deletions
Download patch file Download diff file Expand all files Collapse all files

19
workplans/RPF-WP-0035-credential-lane-implementation.md
View file

@ -44,14 +44,15 @@ the signing dependency belongs to the proposed FLEX-WP-0020-T05 cutover.
```task
id: RPF-WP-0035-T02
status: wait
needs_human: true
decision_id: 62aa95e4-3ccc-4867-8806-5e3db005b483
depends_on: [KEY-WP-0037-T02, KEY-WP-0037-T03, KEY-WP-0037-T04]
blocking_reason: "CCR-2026-0038 applied 2026-10-08. The login proof passed 2026-10-10 (secrets-engine a963a77, message 0dba7e04), and the consumer contract is published at docs/contracts/secrets-engine-openbao-jwt-login.yaml. No-fallback check passed 2026-10-10 (secrets-engine 9ec4e0b). Still waits on the claim refusals (key-cape KEY-WP-0039 probe session, scripts/openbao_negative_probe.py bae9f85) and capabilities-self deny on the guarded paths, then ops-mason MASON-WP-0009-T05."
depends_on: [KEY-WP-0039-T02, MASON-WP-0009-T05]
blocking_reason: "Agent work, not a human gate: claim refusals (KEY-WP-0039-T02 probe) and capabilities-self deny, then ops-mason MASON-WP-0009-T05."
priority: high
state_hub_task_id: "e0c82ea9-05a5-537e-8fbf-67534263572e"
```
2026-10-11: requalified — the remaining waits are other owners' tasks, not a human gate. See the-custodian docs/decisions/2026-10-11-security-unblock-decisions.md.
Supersedes RPF-WP-0032-T02. Design:
`docs/credential-lane-designs/secrets-engine-service-jwt.md`.
@ -174,13 +175,15 @@ and ops-mason MASON-WP-0009-T05 rechecks invariant (ii).
```task
id: RPF-WP-0035-T03
status: wait
needs_human: true
decision_id: 62aa95e4-3ccc-4867-8806-5e3db005b483
blocking_reason: "Founder session done 2026-10-09: CCR-2026-0039 applied (readback matched), custody moved to coulomb, duplicate retired (docs/evidence/2026-10-09-fluid-telegram-t03-founder-session.json). Waits on ops-mason verification (MASON-WP-0005-T05: positive matrix, sibling/agent/non-member denial) and the owner salt CAS probe (FT-WP-0002)."
blocking_reason: "Founder session done 2026-10-09; waits on ops-mason verification (MASON-WP-0005-T05) and the FT-WP-0002 owner salt CAS probe."
priority: high
depends_on: [MASON-WP-0005-T05, FT-WP-0002]
state_hub_task_id: "f47e5bc5-6f3c-54bb-aa35-260ad03892ba"
```
2026-10-11: requalified — founder part done; remaining waits are owner tasks. See the-custodian docs/decisions/2026-10-11-security-unblock-decisions.md.
Supersedes RPF-WP-0033-T02. Design:
`docs/credential-lane-designs/fluid-telegram-operator-kv.md`.
@ -534,15 +537,17 @@ into this client-identity grant.
```task
id: RPF-WP-0035-T08
status: wait
needs_human: true
decision_id: "ab85ae8a-12a0-4945-ae64-1d3d86d5b26f"
blocking_reason: "Provisioned and delivered 2026-09-11 (CCR-2026-0021/0022 applied); do not repeat. Receiver rollout with evidence_kind and native producer acceptance passed 2026-09-11. Remaining human acceptance: independent archive readback and revocation of the interim audit bearer tokens."
blocking_reason: "Approved conditionally (ab85ae8a, standing change rule): executes once independent archive readback and the interim bearer revocation receipt exist; owner work with audit-core."
priority: high
assignee: railiance-platform
intervention_note: null
blocked_on: message-from:audit-core
state_hub_task_id: "0ef52c26-2669-5cd1-8149-b1f6fcdda6cb"
```
2026-10-11: requalified — ab85ae8a resolved under the standing build-mode change rule. See the-custodian docs/decisions/2026-10-11-security-unblock-decisions.md.
2026-10-03 correction (CUST-WP-0075, informed-decision sitting draft `55fb078`): the D1 routing was wrong. First provision and delivery already ran on 2026-09-11, with seed and delivery receipts, and the review packet says not to repeat them. The task is not a provisioning-window act. It was taken off decision D1, and its blocking_reason now names what actually remains. railiance-platform should re-qualify it further if the receiver rollout has since happened.
2026-10-03 (CUST-WP-0075): re-qualified. The receiver rollout already happened: Audit Core c82e0442de0f carries evidence_kind and native producer accepted/duplicate and scope/read-refusal checks passed 2026-09-11 10:42 UTC (`docs/credential-lane-designs/factory-audit-senders-review.md`, `factory-native-acceptance.md`). Remaining: independent archive readback and audit bearer-revocation acceptance. Still not a provisioning-window act.