coulomb/railiance-platform
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Prepare proposed KEY39 coding client custody admission

Browse source 
Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a126e1-76f8-7643-8cf3-e93336539ade
This commit is contained in:
codex 2026-10-11 19:45:10 +02:00
parent 5ae70642a7
commit 9460f6f200
3 changed files with 169 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

15
docs/coding-agent-openbao-identity.md
View file

@ -56,7 +56,7 @@ coordinates:
| `aud` / client id | `codex-railiance-platform` |
| `sub` | `service:codex:railiance-platform` |
| `principal_type` | `service` |
| `tenant` | `tenant:coulomb` |
| `tenant` | `tenant:platform` |
| `roles` | contains `coding-agent` |
| requested scope | `openbao:login` |
@ -115,3 +115,16 @@ check. Revoke the issued OpenBao token if it remains live.
differs from the reviewed body or its verifier fails.
- Revoke the test OpenBao token, disable the KeyCape client, and rotate its
confidential secret after suspected disclosure.
## Source clarification — 2026-10-11
The tenant table now follows current `coding-agent-jwt-role.json`, KeyCape
`config/service-clients.example.yaml` and the 2026-09-27 Platform tenant review.
This correction grants no additional policy or custody access. Historical
AppRole verification and earlier migration examples above do not establish
current named coding-client registration, confidential-secret delivery or a
KEY39 producer admission. The source-only candidate in
`proposals/2026-10-11-key39-coding-client-custody-proposal.json` is not an installed
CCR, grant, catalogue entry or credential request. Follow its separate owner
and founder prerequisites before any client-secret retrieval or JWT exchange.