coulomb/railiance-platform
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

CCR-2026-0050: record access-engine-owner approval; runbook uses Access public-receipt tool and pin
All checks were successful
CCR intake gate / gate (push) Successful in 1m9s
Details
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 809600@bnt-lap001
Assistant-Session: 40ba228f-c8a0-4ec9-bb29-3129951afdc4
This commit is contained in:
codex 2026-10-21 01:35:14 +02:00
parent c03fce06e2
commit b3f12b2ffa
3 changed files with 16 additions and 11 deletions
Download patch file Download diff file Expand all files Collapse all files

19
docs/runbooks/flex-auth-envelope-signing-attended-creation.md
View file

@ -108,20 +108,21 @@ and no automatic retry. Forward-only recovery under a newly reviewed action.
## 3. Public receipt for secrets-engine (no private read)
Derive the consumer receipt from the writer receipt, never from a KV read (the
KV document also holds the seed and reads are not field-filtered):
KV document also holds the seed and reads are not field-filtered). Use Access's
existing tool, which reads public fields only, together with Access's published
policy pin (`access-engine docs/native-signer-public-pin.json`: flex-auth/local,
standalone, `secrets-engine.catalog-lane.lifecycle` v2,
`sha256:bd11c5fe77ce6439c65fea225ad6b71d2110efc5e7b5bc9b499c59cd0a53b8b4`):
```bash
R=/home/worsch/.local/state/railiance-platform/flex-auth-envelope-signing/<operation_id>.json
jq '{kid, public_key, public_fingerprint, kv_version, writer_sha256,
image_sha256: .bindings.image_sha256, policy_sha256: .bindings.policy_sha256,
executed_revision_sha256: .bindings.executed_revision_sha256,
deployment_sha256: .bindings.deployment_sha256, proposal_sha256: .bindings.proposal_sha256}' "$R" \
> flex-auth-envelope-signing-public-receipt.json
python3 ~/access-engine/tools/prepare_signer_public_receipt.py --help # then run per its usage on "$R"
```
Then add the policy pin fields secrets-engine requires (`evaluator`, `mode`,
`policy_package`, `policy_version`, `policy_package_digest`) from Access's
published pin for the candidate release; these are not in the writer receipt.
The result must carry kid, public key, fingerprint, KV version, writer and
source/image/deployment hashes and the pin fields (`evaluator`, `mode`,
`policy_package`, `policy_version`, `policy_package_digest`); these are the two
secrets-engine conditions recorded in the CCR.
`public_key` is unpadded base64url, 43 characters. `public_fingerprint` is
`sha256:` + hex SHA-256 of that ASCII string, not of the raw bytes. The founder
delivers the file to the secrets-engine owner over an authenticated channel and