coulomb/railiance-platform
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

docs(custody): record attended KeyCape first-provision authority proof
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-5.6-luna
Assistant-Session: 01a07ff8-19d0-7820-b4d0-1353833cb7fc
This commit is contained in:
tegwick 2026-09-08 22:40:04 +02:00
parent a0bbae842c
commit a94d06dbcf
5 changed files with 204 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

26
workplans/RPF-WP-0035-credential-lane-implementation.md
View file

@ -147,6 +147,7 @@ closure: `history/2026-09-05-preflight-signing-activation-complete.md`.
id: RPF-WP-0035-T05
status: wait
priority: high
state_hub_task_id: "e15d62c9-e5da-5721-a135-87c050f7851c"
```
Answers KEY-WP-0013-T02 (State Hub message
@ -194,3 +195,28 @@ and access-engine Check (SECRETS-WP-0007-T04). Do not carry forward the old loca
stub as a blocker. T02 still needs the accepted service issuer/JWKS, claims,
audience and consumer binding. T03 still needs confirmed operator group/tenant
and consumer semantics; T04 is already complete. No new owner acceptance inferred.
### 2026-09-08 attended capability preflight
HFACT-WP-0001's continued execution verified the existing first-provision
front door without provisioning anything. `warden plan` selected
`openbao-platform-admin-login` / founder_required / one oidc_login. The native
`scripts/openbao-attended-exec.py` supplied the existing WSL browser launcher;
a direct attempt had no launcher and failed before handoff. Its first revocation
result was unconfirmed and is preserved in the receipt rather than silently
reclassified. The two subsequent contained sessions completed self-revocation
and helper cleanup.
`scripts/keycape-approval-custody-preflight.py --receipt <new-private-file>` is
a silent, read-only command for that envelope. The installed Bao CLI supports
one path per `token capabilities` call; the final run used six single-path calls.
Create/update authority is present on both exact policy paths, both Kubernetes
auth-role paths and both KV data paths from CCR-2026-0017/0018. This is authority
metadata, not a secret-data read or policy/role/KV mutation. Receipt:
`docs/evidence/2026-09-08-keycape-approval-custody-preflight.json`.
T05 remains wait: both CCRs are still proposed, the actual upstream ID-token
issuer precondition remains open, and no verifier-side credential is provisioned.
Client-side retrieval and audit-sender custody are still separate owner returns.
The capability receipt is not a review approval or service readiness proof.