coulomb/railiance-platform
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

RPF-WP-0061: render-policy and plan_ref for ops-mason submissions; approvals only via sync-decision
All checks were successful
CCR intake gate / gate (push) Successful in 3m12s
Details
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 306568@bnt-lap001
Assistant-Session: 8bdf8150-ea56-41e7-9132-13f04f6b0b91
This commit is contained in:
codex 2026-10-18 12:53:19 +02:00
parent 04f18c8c73
commit 7e7ca8be51
3 changed files with 56 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

11
docs/credential-change-approval.md
View file

@ -325,6 +325,11 @@ still goes to the `railiance-platform` inbox.
Run these in a railiance-platform checkout that is up to date with `main`:
```bash
# 0. Generate the policy instead of writing it, so it is byte-equal by construction.
python3 scripts/credential-change.py render-policy --kv-path <platform/...> > <policy.hcl>
# Optional: plan_ref: {repo, path, commit} in the draft links the client's
# construction plan; submit keeps it and review-standard only checks its shape.
# 1. File the draft. Allocates the CCR id, copies the policy, runs the review.
python3 scripts/credential-change.py submit \
--ccr <draft.yaml> --policy <policy.hcl> --slug <slug> \
@ -342,7 +347,11 @@ git commit -m "<id>: request founder decision" -- credential-change-requests/<id
git push origin main
```
After step 3, the client waits. The **founder** resolves the State Hub decision.
After step 3, the client waits and does not edit `status` or `review.comments`
itself. Approvals reach the file only through `sync-decision`, even when the
founder approved the client's plan elsewhere. The hub decision is the single
approval record for both the client plan and the CCR; clients copy their plan
approval *from* it after the sync. The **founder** resolves the State Hub decision.
Then a **platform session or the founder** runs `sync-decision <id>`. Clients do
not run `sync-decision` on their own CCRs. State Hub does not authenticate who
resolved a decision (`decided_by` is free text). Until founder approval can be