coulomb/railiance-platform
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

RPF-WP-0069-T07: approve sets approved only once every required role approves.
All checks were successful
CCR intake gate / gate (push) Successful in 4m15s
Details
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
credential-change.py approve set status approved after the first reviewer; for
role-gated request types validation then refused the second approve before it
was recorded. append_decision now records each approval and keeps the prior
status while the lane validator still reports a missing role approval.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 509845@bnt-lap001
Assistant-Session: ed7a7d95-d8eb-455c-b594-963fb1830f76
This commit is contained in:
codex 2026-11-03 22:41:22 +01:00
parent 371f787493
commit aeb21434bd
5 changed files with 108 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

8
docs/credential-change-approval.md
View file

@ -191,6 +191,14 @@ renders the reviewed non-secret `bao policy write` and `bao write auth/.../role`
commands for a platform operator; the actual secret value is still provisioned
through approved OpenBao/operator custody only.
For request types that require an explicit approval from every role in
`review.required_approvers` (for example `workload-kv-write-next-version`,
`attended-service-credential-delivery`, `attended-host-key-delivery`), each
`approve` records that reviewer's approval. The CCR moves to `approved` only when
the last required role approves; until then it keeps its prior status and the
tool prints the roles still awaited. Run `approve` once per role with
`--reviewer <role>`.
The same operations can be exposed through chat by having the agent create the
proposal, show the rendered summary, then call the CLI only after the human
gives an explicit approval phrase.