coulomb/railiance-platform
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Settle the npm lane field, and record an ungoverned duplicate
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
The attended session enumerated field names at the governed path: NPM_AUTH_TOKEN
is the only field present, at KV version 2. This repository's record was correct.
secrets-engine's lowercase field name and the ops-warden catalog change made on
that statement both name a field absent from that path, so that change points the
front door at nothing and must be reverted before next use. The both-fields
reconciliation is ruled out.

The same session found the legacy path is real: secret/coulomb/whynot-design/
npm/publish exists at version 1, created five days after the governed lane was
verified, outside its policy and outside any CCR. Only metadata was read; field
names were not enumerated and nothing was deleted. Disposition is the new
RPF-WP-0035-T07, which asks first whether the consumer's proven publish has been
reading the duplicate rather than the governed lane.

Receipt carries field names only, attended_identity true, no mutation.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WLUjpv3ssxNRAEPPgLFnEB

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 1275505@bnt-lap001
Assistant-Session: 97265baa-f08f-4032-b290-a1e2965a69c5
This commit is contained in:
codex 2026-09-10 09:03:22 +02:00
parent 18f4ddec2b
commit 9d24086004
4 changed files with 104 additions and 13 deletions
Download patch file Download diff file Expand all files Collapse all files

30
docs/evidence/2026-09-10-npm-lane-field-resolution.json Normal file
View file

@ -0,0 +1,30 @@
{
"schema": "platform.openbao-open-questions-session.v1",
"observed_at": "2026-09-10T07:00:55.690609+00:00",
"operation": "read-only observation",
"credential_values_emitted": false,
"openbao_mutations": 0,
"questions": [
"Q1",
"Q2"
],
"attended_identity": true,
"ambient_token_vars_present": [],
"q1_legacy_npm_path": {
"legacy_mount_present": true,
"legacy_path": "secret/coulomb/whynot-design/npm/publish",
"legacy_path_present": true,
"current_version": 1,
"created_time": "2026-07-03T15:00:44.99885594Z",
"updated_time": "2026-07-03T15:00:44.99885594Z"
},
"q2_npm_lane": {
"path": "platform/workloads/coulomb/whynot-design/npm-publish",
"readable": true,
"field_names": [
"NPM_AUTH_TOKEN"
],
"kv_version": 2,
"values_recorded": false
}
}

29
docs/workload-kv-access-lanes.md
View file

@ -64,19 +64,22 @@ caller-scoped lane. The sibling lanes `issue-core-ingestion-api-key` and
`openrouter-llm-connect` remain draft and are tracked separately by
`RAILIANCE-WP-0009` and `RAILIANCE-WP-0010`.
> **Field name contested, 2026-09-09 — do not change this on either side yet.**
> secrets-engine states the KV field is `npm_token` and that `NPM_AUTH_TOKEN` is
> only the environment variable their publication-scope policy injects;
> ops-warden has already corrected their catalog and playbook on that statement.
> This repository holds two dated live receipts naming `NPM_AUTH_TOKEN` as the
> OpenBao **field**, in `CCR-2026-0001`: a field-presence check on
> 2026-06-28T10:37:42Z, and an attended fetch by the founder on
> 2026-06-28T15:22:29Z that exited successfully with output to `/dev/null` — a
> `-field=` fetch that exits zero means that field exists. Both records can be
> true if the path carries **both** fields. Q2 of the attended session
> (`docs/openbao-open-questions-session.md`) enumerates the actual field names
> and settles it. Until then this table stays as written, because it is the side
> backed by receipts.
> **Field name settled, 2026-09-10 — attended read, `NPM_AUTH_TOKEN` confirmed.**
> An attended founder session enumerated the field names at this path: the only
> field present is `NPM_AUTH_TOKEN`, at KV version 2. The table above is correct
> as written and needs no change. secrets-engine's `npm_token` and the
> ops-warden catalog change made on that statement both name a field that does
> not exist at this path, so that change must be reverted before the lane is
> next used. The "both fields exist" reconciliation is ruled out.
> Receipt: [2026-09-10 field resolution](evidence/2026-09-10-npm-lane-field-resolution.json)
> — field names only, no value emitted, `attended_identity: true`.
>
> **The same session found the legacy path is real.**
> `secret/coulomb/whynot-design/npm/publish` exists at version 1, created
> 2026-07-03T15:00:44Z and never updated — five days *after* this governed lane
> was verified. It sits outside this lane's exact-path policy and outside
> CCR-2026-0001. Its field names were not enumerated. Disposition is
> RPF-WP-0035-T07; do not read, copy or delete it outside that task.
The fetch command returns the secret value to the authenticated caller. Run it
only in an attended shell or through a process that consumes the value without