RPF-WP-0061-T04: request-decision opens the founder hub decision; CCR-2026-0051 decision e633607e

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 306568@bnt-lap001
Assistant-Session: 8bdf8150-ea56-41e7-9132-13f04f6b0b91

scripts/ccr_intake.py

@@ -29,6 +29,7 @@ CCR_FILE_RE = re.compile(r"^(CCR-\d{4}-\d{4})(-[a-z0-9-]+)?\.ya?ml$")
 SLUG_RE = re.compile(r"^[a-z0-9][a-z0-9-]*$")
 TTL_UNITS = {"s": 1, "m": 60, "h": 3600, "d": 86400}
 PLATFORM_OWNER = "railiance-platform-owner"
+PLATFORM_TOPIC_ID = "ca369340-a64e-442e-98f1-a4fa7dc74a38"
 
 
 def load_profile(path: Path = DEFAULT_PROFILE) -> tuple[dict[str, Any], str]:
@@ -278,6 +279,63 @@ def command_check_branch(args: argparse.Namespace, cc: Any) -> int:
     return 1 if errors else 0
 
 
+def decision_payload(ccr: dict[str, Any], cc: Any) -> dict[str, Any]:
+    openbao = ccr["openbao"]
+    auth = openbao["auth"]
+    review = ccr["review"]["comments"][-1]
+    description = "\n".join([
+        f"Founder decision for {ccr['id']}: {ccr.get('title')}.",
+        "",
+        "Non-secret request summary:",
+        f"- Requester: {(ccr.get('requester') or {}).get('agent')}",
+        f"- OpenBao path: {openbao.get('kv_path')} fields {openbao.get('fields')}",
+        f"- Policy: {openbao.get('policy_name')} ({openbao.get('policy_file')})",
+        f"- Auth: {auth.get('method')} role {auth.get('role')}, SA {bound_list(auth, 'service_account_names')}"
+        f" in {bound_list(auth, 'service_account_namespaces')}, ttl {auth.get('ttl')}",
+        f"- Risk: {(ccr.get('risk') or {}).get('classification')}",
+        f"- Platform review: {review.get('reviewer')}: {review.get('comment')}",
+        "",
+        cc.render_decision_templates(ccr),
+        "",
+        "Approval permits apply after confirm-binding; it exposes and stores no value.",
+    ])
+    return {
+        "topic_id": PLATFORM_TOPIC_ID,
+        "title": f"Review {ccr['id']} {ccr.get('title')}",
+        "description": description,
+        "escalation_note": "Founder decision required before OpenBao credential lane apply.",
+    }
+
+
+def request_decision(path: Path, cc: Any, base_url: str) -> dict[str, Any]:
+    """Open the founder's State Hub decision for a platform-reviewed CCR (RPF-WP-0061-T04)."""
+    ccr, _warnings = cc.validate_or_exit(path)
+    if ccr.get("status") != "proposed":
+        cc.fail(f"request-decision requires status proposed, got {ccr.get('status')}")
+    if (ccr.get("state_hub") or {}).get("decision_id"):
+        cc.fail(f"{ccr['id']} already has State Hub decision {ccr['state_hub']['decision_id']}")
+    comments = (ccr.get("review") or {}).get("comments") or []
+    last = comments[-1] if comments else {}
+    if last.get("decision") != "approved" or not str(last.get("reviewer", "")).startswith(PLATFORM_OWNER):
+        cc.fail("request-decision requires a platform-owner approval as the latest review comment")
+    decision = cc.state_hub_post_json(base_url, "/decisions/", decision_payload(ccr, cc))
+    if not decision.get("id") or decision.get("status") not in (None, "open"):
+        cc.fail(f"State Hub returned an unexpected decision: {decision.get('id')} {decision.get('status')}")
+    state_hub = ccr.setdefault("state_hub", {})
+    state_hub["decision_id"] = decision["id"]
+    state_hub["decision_api_url"] = f"{base_url.rstrip('/')}/decisions/{decision['id']}"
+    ccr["updated"] = datetime.now(timezone.utc).date().isoformat()
+    cc.dump_yaml(path, ccr)
+    return decision
+
+
+def command_request_decision(args: argparse.Namespace, cc: Any) -> int:
+    path = cc.resolve_ccr(args.ref)
+    decision = request_decision(path, cc, args.state_hub_url)
+    print(f"[OK] {path.name}: State Hub decision {decision['id']} opened; commit the CCR file")
+    return 0
+
+
 def git(*argv: str) -> None:
     subprocess.run(["git", "-C", str(REPO_DIR), *argv], check=True)
 
@@ -359,6 +417,13 @@ def add_parsers(sub: Any, cc: Any, state_hub_url: str) -> None:
     check_branch.add_argument("--main-root", required=True, help="tree of main to compare against")
     check_branch.set_defaults(func=lambda args: command_check_branch(args, cc))
 
+    decision_p = sub.add_parser(
+        "request-decision", help="Open the founder State Hub decision for a platform-reviewed proposed CCR"
+    )
+    decision_p.add_argument("ref")
+    decision_p.add_argument("--state-hub-url", default=state_hub_url)
+    decision_p.set_defaults(func=lambda args: command_request_decision(args, cc))
+
     submit_p = sub.add_parser(
         "submit",
         help="File a client CCR draft under the next CCR id and run the standard review",