From 98a8b08bf64e6677b393e3afa857d9f284f61068 Mon Sep 17 00:00:00 2001 From: codex Date: Sat, 31 Oct 2026 19:00:03 +0100 Subject: [PATCH] CCR-2026-0059: standing reader (founder decision 2026-10-31) Co-Authored-By: Claude Opus 5.5 Assistant: claude-code Assistant-Model: opus Assistant-Process: 5502@bnt-lap001 Assistant-Session: 68b3b02f-5d0f-4e71-8421-796f62e50196 --- ...-0059-net-kingdom-bind-executor-syn-journey-read.yaml | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) diff --git a/credential-change-requests/CCR-2026-0059-net-kingdom-bind-executor-syn-journey-read.yaml b/credential-change-requests/CCR-2026-0059-net-kingdom-bind-executor-syn-journey-read.yaml index 1f2254d..ff4bdd8 100644 --- a/credential-change-requests/CCR-2026-0059-net-kingdom-bind-executor-syn-journey-read.yaml +++ b/credential-change-requests/CCR-2026-0059-net-kingdom-bind-executor-syn-journey-read.yaml @@ -79,11 +79,10 @@ agent_fence: note: The syn-journey data and metadata paths are denied to coding agents since CCR-2026-0057; setup re-checks the deny before the role is created. lifecycle: - role_window: 'Standing (proposed; founder decides). Unlike the CCR-2026-0058 write - role, this role only reads a group-less synthetic identity, and a standing reader - lets the journey run as a scheduled check (T10) without a platform-admin per run. - Alternative: window-scoped like CCR-2026-0058, created and deleted with each admitted - run.' + role_window: 'Standing (founder decision 2026-10-31, net-kingdom session). Unlike + the CCR-2026-0058 write role, this role only reads a group-less synthetic identity, + and a standing reader lets the journey run as a scheduled check (T10) without a + platform-admin per run.' deactivate: Delete the role, then the policy. The KV entry, the LLDAP user and the privacyIDEA token stay under CCR-2026-0057. rotate: As in CCR-2026-0057 (lane.py teardown and setup); the reader needs no change,