CCR-2026-0050: record access-engine-owner approval; runbook uses Access public-receipt tool and pin

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 809600@bnt-lap001
Assistant-Session: 40ba228f-c8a0-4ec9-bb29-3129951afdc4

credential-change-requests/CCR-2026-0050-flex-auth-envelope-signing.yaml

@@ -26,9 +26,12 @@ review:
   - reviewer: secrets-engine-owner (agent secrets-engine, hub message e73c9ffc-8a6d-4a17-9604-84324c678dc0)
     decision: approved
     comment: "2026-10-21, consumer side only. Consumer has no KV read role and receives no seed; public trust is admitted through a founder ssh-keygen -Y signed trust file (secrets-engine ebd8e49, docs/founder-admission.md, SECRETS-WP-0014-T04, decision e4eee965). Conditions: (1) the public receipt (kid, Ed25519 public key as 43-char unpadded base64url, evaluator/mode/policy_package/policy_version/policy_package_digest) is emitted by the attended writer at creation time or derived from its public output, never from a later read of the KV document; (2) the receipt carries the KV version and source/image provenance hashes. Not founder approval, native execution or a binding."
+  - reviewer: access-engine-owner (agent access-engine, hub message 6529bacf-6065-4fb9-a9a2-a41b7ed8fa83)
+    decision: approved
+    comment: "2026-10-21, Access scope only (retained workload/release source, Helm values, candidate image 84c78e0 / sha256:09a83b27...981f, signer delivery/mount, process/outbox fencing/rollback). Reviewed CCR sha256:66b3ea12d3f3bb870fa0aa0e7598e32abdb9bf39efe1adcfac286407abeb98e4 (before the 2026-10-21 review-comment edits), policy sha256:b9f816da25c7770863a5fc7b3b873e9da90b087e71a9052e766bf0a187ff85ef, native plan sha256:22306d50e082fc35c5ff22c31e739a53c7584176969063f7907bc01d77e506e5, R2 manifest sha256:5be7a7f438624dcb35b7dbc96e7c9e5a8e2d5d1b1966cb4338aa5aecbe3a8b59. Notes: seed read once at startup so rotation stays a fenced restart; bound_claims_confirmed needs native readback before activation; consumer policy pin comes from access-engine docs/native-signer-public-pin.json and the public receipt is prepared with access-engine tools/prepare_signer_public_receipt.py (public fields only); keep writer receipt fields kid/public_key/public_fingerprint/kv_version/status/path/source_ccr_sha256 stable. Access rollout founder go is separate: decision 4fab263d-686b-4a06-9cea-8df619c87c03 (FLEX-WP-0024-T07). Not founder approval or native execution."
   - reviewer: railiance-platform-owner (agent railiance-platform, claude)
     decision: approved
-    comment: "2026-10-21 runbook review: docs/runbooks/flex-auth-envelope-signing-attended-creation.md prepared. Secrets condition 1 is met for kid/public key/fingerprint/kv_version/source/image hashes by deriving the consumer receipt from the writer receipt (no KV read); the evaluator/mode/policy_package/policy_version/policy_package_digest fields are not in the writer receipt and must come from Access's published pin. Review-scope digest no longer binds expires_at so owner reviews can precede the 120 s window. Pending: access-engine-owner (awaited), cluster-runtime-storage-owner (railiance-cluster, requested f8b4b229), founder. Nothing executed."
+    comment: "2026-10-21 runbook review: docs/runbooks/flex-auth-envelope-signing-attended-creation.md prepared. Secrets condition 1 is met for kid/public key/fingerprint/kv_version/source/image hashes by deriving the consumer receipt from the writer receipt (no KV read); the evaluator/mode/policy_package/policy_version/policy_package_digest fields are not in the writer receipt and must come from Access's published pin. Review-scope digest no longer binds expires_at so owner reviews can precede the 120 s window. Pending: cluster-runtime-storage-owner (railiance-cluster, requested f8b4b229), founder. Nothing executed."
 target:
   domain: infotech
   tenant: platform

docs/runbooks/flex-auth-envelope-signing-attended-creation.md

@@ -108,20 +108,21 @@ and no automatic retry. Forward-only recovery under a newly reviewed action.
 ## 3. Public receipt for secrets-engine (no private read)
 
 Derive the consumer receipt from the writer receipt, never from a KV read (the
-KV document also holds the seed and reads are not field-filtered):
+KV document also holds the seed and reads are not field-filtered). Use Access's
+existing tool, which reads public fields only, together with Access's published
+policy pin (`access-engine docs/native-signer-public-pin.json`: flex-auth/local,
+standalone, `secrets-engine.catalog-lane.lifecycle` v2,
+`sha256:bd11c5fe77ce6439c65fea225ad6b71d2110efc5e7b5bc9b499c59cd0a53b8b4`):
 
 ```bash
 R=/home/worsch/.local/state/railiance-platform/flex-auth-envelope-signing/<operation_id>.json
-jq '{kid, public_key, public_fingerprint, kv_version, writer_sha256,
-     image_sha256: .bindings.image_sha256, policy_sha256: .bindings.policy_sha256,
-     executed_revision_sha256: .bindings.executed_revision_sha256,
-     deployment_sha256: .bindings.deployment_sha256, proposal_sha256: .bindings.proposal_sha256}' "$R" \
-  > flex-auth-envelope-signing-public-receipt.json
+python3 ~/access-engine/tools/prepare_signer_public_receipt.py --help   # then run per its usage on "$R"
 ```
 
-Then add the policy pin fields secrets-engine requires (`evaluator`, `mode`,
-`policy_package`, `policy_version`, `policy_package_digest`) from Access's
-published pin for the candidate release; these are not in the writer receipt.
+The result must carry kid, public key, fingerprint, KV version, writer and
+source/image/deployment hashes and the pin fields (`evaluator`, `mode`,
+`policy_package`, `policy_version`, `policy_package_digest`); these are the two
+secrets-engine conditions recorded in the CCR.
 `public_key` is unpadded base64url, 43 characters. `public_fingerprint` is
 `sha256:` + hex SHA-256 of that ASCII string, not of the raw bytes. The founder
 delivers the file to the secrets-engine owner over an authenticated channel and

workplans/RPF-WP-0035-credential-lane-implementation.md

@@ -1434,7 +1434,8 @@ still needs the founder's go at the time.
 
 2026-10-21 state: railiance-platform-owner approved (runbook review);
 secrets-engine-owner approved with two receipt conditions (hub message
-e73c9ffc, recorded in the CCR); access-engine-owner disposition awaited;
+e73c9ffc, recorded in the CCR); access-engine-owner approved for Access scope
+(hub message 6529bacf; its rollout go is separate decision 4fab263d);
 cluster-runtime-storage-owner (railiance-cluster) review requested in hub
 message f8b4b229. The warden routing defect from 2026-10-16 no longer
 reproduces (`docs/evidence/2026-10-21-flex-auth-signer-warden-route.json`).