From 93a4bc2a9f950a7626a168e6aee863947029f8bd Mon Sep 17 00:00:00 2001 From: codex Date: Fri, 9 Oct 2026 19:53:59 +0200 Subject: [PATCH] CCR-2026-0038: allow local probe input before the login proof; refresh design status secrets-engine a9ecbd6b: the contract file was promised only after the proof, which needs it. The founder may write a non-secret probe input from the applied values; platform publishes or confirms the contract after the proof. Co-Authored-By: Claude Opus 5.5 Assistant: claude-code Assistant-Model: opus Assistant-Process: 469992@bnt-lap001 Assistant-Session: e4b8e420-df0a-441d-83ae-7f19130594d9 --- .../CCR-2026-0038-secrets-engine-service-jwt-login.yaml | 8 ++++++-- .../credential-lane-designs/secrets-engine-service-jwt.md | 3 ++- 2 files changed, 8 insertions(+), 3 deletions(-) diff --git a/credential-change-requests/CCR-2026-0038-secrets-engine-service-jwt-login.yaml b/credential-change-requests/CCR-2026-0038-secrets-engine-service-jwt-login.yaml index b36e1bc..812661b 100644 --- a/credential-change-requests/CCR-2026-0038-secrets-engine-service-jwt-login.yaml +++ b/credential-change-requests/CCR-2026-0038-secrets-engine-service-jwt-login.yaml @@ -69,8 +69,12 @@ access_frontdoor: resolvable: false delivery: surface: none - target: No value is delivered. The consumer contract file (mount, role, bound_issuer) - is published only after the login proof passes. + target: No value is delivered. Before the login proof, the founder may write a local, + non-secret probe input from the applied values (mount keycape-services, role + secrets-engine-openbao, bound_issuer https://kc.coulomb.social; secrets-engine + docs/keycape-openbao-consumer-custody.md, e94dc07). That file is probe input, + not the platform contract. railiance-platform publishes the consumer contract + file, or confirms the probe input as it, only after the login proof passes. risk: classification: medium notes: diff --git a/docs/credential-lane-designs/secrets-engine-service-jwt.md b/docs/credential-lane-designs/secrets-engine-service-jwt.md index c6c5099..ec670dc 100644 --- a/docs/credential-lane-designs/secrets-engine-service-jwt.md +++ b/docs/credential-lane-designs/secrets-engine-service-jwt.md @@ -1,6 +1,7 @@ # Secrets-engine service JWT login -Status: source complete as CCR-2026-0038 (proposed), not provisioned. Owner: railiance-platform, RPF-WP-0035-T02 (design origin RPF-WP-0032). +Status: CCR-2026-0038 applied 2026-10-08 (founder, readback matched); login proof +(SECRETS-WP-0012-T03 probe-openbao) pending. Owner: railiance-platform, RPF-WP-0035-T02 (design origin RPF-WP-0032). Demand: State Hub message `38b47122-07eb-4a7f-a5df-13a38f50e110`. ## Contract and ownership