coulomb/railiance-platform
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

security: record native backup reader and ESO delivery acceptance
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a13eab-1e6a-7b33-9c37-372e90ada3a2
This commit is contained in:
codex 2026-10-16 09:21:38 +02:00
parent e2b832b5d4
commit 8164c57467
2 changed files with 32 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

19
credential-change-requests/CCR-2026-0048-net-kingdom-backup-publisher.yaml
View file

@ -4,7 +4,7 @@
"schema_version": 1, "schema_version": 1,
"request_type": "workload-kv-read", "request_type": "workload-kv-read",
"title": "NetKingdom identity backup publisher delivery", "title": "NetKingdom identity backup publisher delivery",
"status": "approved", "status": "applied",
"created": "2026-10-16", "created": "2026-10-16",
"updated": "2026-10-16", "updated": "2026-10-16",
"requester": { "requester": {
@ -79,7 +79,7 @@
"sso" "sso"
] ]
}, },
"bound_claims_confirmed": false "bound_claims_confirmed": true
} }
}, },
"provider": { "provider": {
@ -130,7 +130,20 @@
"Native exact namespace/ServiceAccount/audience verification and bounded role readback; no coding-agent access.", "Native exact namespace/ServiceAccount/audience verification and bounded role readback; no coding-agent access.",
"First real encrypted capture, off-host readback, independent-key recovery and cleanup before enabling timers.", "First real encrypted capture, off-host readback, independent-key recovery and cleanup before enabling timers.",
"Retention protects the independently recovered point and newest backup; no automatic deletion of pre-existing backups." "Retention protects the independently recovered point and newest backup; no automatic deletion of pre-existing backups."
] ],
"actual_native_receipt": {
"repository": "net-kingdom",
"path": "docs/evidence/2026-10-16-identity-backup-live/publisher-native-delivery-verified.json",
"source_ccr_sha256": "a7d5c356ce0c4df9de439a58ad3d36e1578f27cda327c9387e97cfc2e9dc7cdc",
"status": "reader_and_delivery_verified",
"kv_version": 1,
"wrong_service_account_denied": true,
"wrong_namespace_denied": true,
"wrong_audience_denied": true,
"bounded_policy_ttl": true,
"eso_equality_verified": true,
"temporary_reader_revoked": true
}
}, },
"state_hub": { "state_hub": {
"workplan_id": "NK-WP-0049", "workplan_id": "NK-WP-0049",

19
credential-change-requests/CCR-2026-0049-net-kingdom-backup-retention.yaml
View file

@ -4,7 +4,7 @@
"schema_version": 1, "schema_version": 1,
"request_type": "workload-kv-read", "request_type": "workload-kv-read",
"title": "NetKingdom identity backup retention delivery", "title": "NetKingdom identity backup retention delivery",
"status": "approved", "status": "applied",
"created": "2026-10-16", "created": "2026-10-16",
"updated": "2026-10-16", "updated": "2026-10-16",
"requester": { "requester": {
@ -79,7 +79,7 @@
"sso" "sso"
] ]
}, },
"bound_claims_confirmed": false "bound_claims_confirmed": true
} }
}, },
"provider": { "provider": {
@ -130,7 +130,20 @@
"Native exact namespace/ServiceAccount/audience verification and bounded role readback; no coding-agent access.", "Native exact namespace/ServiceAccount/audience verification and bounded role readback; no coding-agent access.",
"First real encrypted capture, off-host readback, independent-key recovery and cleanup before enabling timers.", "First real encrypted capture, off-host readback, independent-key recovery and cleanup before enabling timers.",
"Retention protects the independently recovered point and newest backup; no automatic deletion of pre-existing backups." "Retention protects the independently recovered point and newest backup; no automatic deletion of pre-existing backups."
] ],
"actual_native_receipt": {
"repository": "net-kingdom",
"path": "docs/evidence/2026-10-16-identity-backup-live/retention-native-delivery-verified.json",
"source_ccr_sha256": "d391018abbda0fbc1acec4b5a22c0f99ce65525de940431df376a7552b3746cf",
"status": "reader_and_delivery_verified",
"kv_version": 1,
"wrong_service_account_denied": true,
"wrong_namespace_denied": true,
"wrong_audience_denied": true,
"bounded_policy_ttl": true,
"eso_equality_verified": true,
"temporary_reader_revoked": true
}
}, },
"state_hub": { "state_hub": {
"workplan_id": "NK-WP-0049", "workplan_id": "NK-WP-0049",