coulomb/railiance-platform
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Prepare bounded State Hub preflight signing lane
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a06ecb-456a-71c2-b41e-0755d336e883
This commit is contained in:
codex 2026-09-05 11:50:27 +02:00
parent 234b1b559f
commit a46a6d8213
10 changed files with 501 additions and 14 deletions
Download patch file Download diff file Expand all files Collapse all files

8
openbao/policies/agent-high-risk-boundary.hcl
View file

@ -107,3 +107,11 @@ path "platform/data/workloads/policy-nexus/forgejo-source-read" {
path "platform/metadata/workloads/policy-nexus/forgejo-source-read" {
capabilities = ["deny"]
}
# RPF-WP-0035-T04: preflight signing key is API-only.
path "platform/data/workloads/state-hub/repository-rename-preflight" {
capabilities = ["deny"]
}
path "platform/metadata/workloads/state-hub/repository-rename-preflight" {
capabilities = ["deny"]
}

1
openbao/policies/inputs/state-hub-preflight-boundary-baseline.sha256 Normal file
View file

@ -0,0 +1 @@
8cbbe133516466bd70ee412fb2214fbe3d1fe5d455f513186eb149743a30636d

3
openbao/policies/workload-kv-read-state-hub-rename-preflight.hcl Normal file
View file

@ -0,0 +1,3 @@
path "platform/data/workloads/state-hub/repository-rename-preflight" {
capabilities = ["read"]
}