coulomb/railiance-platform
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

CCR-2026-0059: standing reader (founder decision 2026-10-31)
All checks were successful
CCR intake gate / gate (push) Successful in 1m11s
Details
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 5502@bnt-lap001
Assistant-Session: 68b3b02f-5d0f-4e71-8421-796f62e50196
This commit is contained in:
codex 2026-10-31 19:00:03 +01:00
parent c9b68ea4e4
commit 98a8b08bf6
1 changed files with 4 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

9
credential-change-requests/CCR-2026-0059-net-kingdom-bind-executor-syn-journey-read.yaml
View file

@ -79,11 +79,10 @@ agent_fence:
note: The syn-journey data and metadata paths are denied to coding agents since CCR-2026-0057;
setup re-checks the deny before the role is created.
lifecycle:
role_window: 'Standing (proposed; founder decides). Unlike the CCR-2026-0058 write
role, this role only reads a group-less synthetic identity, and a standing reader
lets the journey run as a scheduled check (T10) without a platform-admin per run.
Alternative: window-scoped like CCR-2026-0058, created and deleted with each admitted
run.'
role_window: 'Standing (founder decision 2026-10-31, net-kingdom session). Unlike
the CCR-2026-0058 write role, this role only reads a group-less synthetic identity,
and a standing reader lets the journey run as a scheduled check (T10) without a
platform-admin per run.'
deactivate: Delete the role, then the policy. The KV entry, the LLDAP user and the
privacyIDEA token stay under CCR-2026-0057.
rotate: As in CCR-2026-0057 (lane.py teardown and setup); the reader needs no change,