coulomb/railiance-platform
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

CCR-2026-0055: state the gate precisely (attended pi-admin, MFA login proves the write)
All checks were successful
CCR intake gate / gate (push) Successful in 9s
Details
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 896183@bnt-lap001
Assistant-Session: 3a18c01a-3205-4d02-94db-9efff25649a2
This commit is contained in:
codex 2026-10-31 11:07:05 +01:00
parent 2d4a3838bf
commit 8cab281ffc
3 changed files with 17 additions and 13 deletions
Download patch file Download diff file Expand all files Collapse all files

4
scripts/attended_service_delivery.py
View file

@ -2,8 +2,8 @@
"""attended-service-credential-delivery CCRs: a value in platform custody that no workload reads.
NetKingdom NK-WP-0056-T04 (svc-privacyidea). Some services keep a credential in
their own encrypted store and accept it only through an administrator API that
requires a person's MFA (privacyIDEA's LDAP resolver bind). The value is held in
their own encrypted store and accept it only through an administrator API
(privacyIDEA's LDAP resolver bind) that a person operates. The value is held in
OpenBao, written once with CAS=0 from the attended platform-admin session, and
delivered by an attended procedure that reads it in memory and writes it into
the service. No Kubernetes or workload auth role, policy or ESO object exists,