coulomb/railiance-platform
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

RPF-WP-0065: record hub ids

Browse source 
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: sonnet
Assistant-Process: 328925@bnt-lap001
Assistant-Session: 14b795fd-c632-4c01-8d28-e7e490c7b0ed
This commit is contained in:
codex 2026-10-24 23:53:35 +02:00
parent bca66d1d2e
commit 8f3b4a7e85
1 changed files with 6 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

6
workplans/RPF-WP-0065-netkingdom-role-claim-bindings.md
View file

@ -13,6 +13,7 @@ related:
- NK-WP-0054
- RPF-WP-0022
- RPF-WP-0035
state_hub_workstream_id: "a042bef1-3370-5731-9f62-a974fa0cb7be"
---
# RPF-WP-0065 — Role claim bindings from the NK-WP-0054 review
@ -50,6 +51,7 @@ so the rollout below keeps an open admin session and a one-command rollback.
id: RPF-WP-0065-T01
status: done
priority: high
state_hub_task_id: "1e8f9164-dc8e-5f75-8fb8-58182092347a"
```
**Coding-agent transition (option a).** `coding-agent-jwt-role.json` now binds
`principal_type` to `["service", "agent"]` (OpenBao list = any-of). Sub, audience, tenant, roles,
@ -66,6 +68,7 @@ standing identity. At removal also bind `/agent/mode` to the agreed mode(s). Rev
id: RPF-WP-0065-T02
status: done
priority: high
state_hub_task_id: "67b76351-eb4c-5236-af9f-c5c9eca4d862"
```
**platform-admin aal2 (founder decision 2026-10-24).** `netkingdom-platform-admin-role.json`
now binds `groups: [net-kingdom-admins]` and `"/assurance/level": "aal2"`, as the credential-broker
@ -75,6 +78,7 @@ role does. Closes exception SI-X4 once applied.
id: RPF-WP-0065-T03
status: done
priority: medium
state_hub_task_id: "b7bfdb19-a806-589b-b287-fb3abffc2e78"
```
**Tests.** `tests/test_netkingdom_role_files.py` (new) and the bound-claims assertion in
`tests/test_openbao_platform_admin_callback_prune.py` now follow the declaration:
@ -84,6 +88,7 @@ priority: medium
id: RPF-WP-0065-T04
status: wait
priority: high
state_hub_task_id: "abd78db2-03ad-5942-a9ef-12bbada54b28"
```
**Founder live step: apply platform-admin aal2 (needs the founder).** See runbook below.
@ -91,6 +96,7 @@ priority: high
id: RPF-WP-0065-T05
status: wait
priority: medium
state_hub_task_id: "e0e8d3f5-24c2-5106-a2d7-3ebe0845f840"
```
**Coding-agent: issuer first, then role.** Blocked on the KeyCape owner (see rollout order).
Then the founder applies the role and later removes `service`.