From b51e91cc6f5fb08a64ac9ea2a7bc954ed22cb516 Mon Sep 17 00:00:00 2001 From: tegwick Date: Mon, 5 Oct 2026 00:13:30 +0200 Subject: [PATCH] Accept requester workload delivery and retain separate rotation residual Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a10780-6d41-7952-9718-dfbc1f41236f --- .../applications/state-hub-memo-dispatch.yaml | 2 +- ...026-10-05-requester-receiving-service.json | 11 ++++++++++ intakes/intakes.md | 20 +++++++++++++++++ ...ed-decision-requester-workload-delivery.md | 22 ++++++++++++++----- 4 files changed, 49 insertions(+), 6 deletions(-) create mode 100644 docs/evidence/2026-10-05-requester-receiving-service.json diff --git a/argocd/railiance01/applications/state-hub-memo-dispatch.yaml b/argocd/railiance01/applications/state-hub-memo-dispatch.yaml index d861794..f1d418d 100644 --- a/argocd/railiance01/applications/state-hub-memo-dispatch.yaml +++ b/argocd/railiance01/applications/state-hub-memo-dispatch.yaml @@ -7,7 +7,7 @@ spec: project: informed-decision-lifecycle source: repoURL: https://forgejo.coulomb.social/coulomb/state-hub.git - targetRevision: c69c4c6f2cff4ab460fa69b01993a432a730bb46 + targetRevision: 1321361d85cf773aa6d051360be0159ac672eff2 path: deploy/informed-decision destination: server: https://kubernetes.default.svc diff --git a/docs/evidence/2026-10-05-requester-receiving-service.json b/docs/evidence/2026-10-05-requester-receiving-service.json new file mode 100644 index 0000000..65ddc0c --- /dev/null +++ b/docs/evidence/2026-10-05-requester-receiving-service.json @@ -0,0 +1,11 @@ +{ + "status": "passed", + "workplan": "RPF-WP-0051", + "service_image": "sha256:804d89fb0bb3d691720380eedde4f361133bada717d1773c2eb349004346ebf1", + "actual_receiving_mount_mode": "0440", + "actual_receiving_mount_readonly": true, + "actual_receiving_signed_create_only_exchange": true, + "native_approval_id": "22b30fe7-c565-46f2-8193-d8875975ad9e", + "issuer_rotation_performed": false, + "rotation_residual": "RPF-IN-0004" +} diff --git a/intakes/intakes.md b/intakes/intakes.md index ba0bda9..9a740db 100644 --- a/intakes/intakes.md +++ b/intakes/intakes.md @@ -77,3 +77,23 @@ description: >- migration gate in RPF-WP-0035. state_hub_intake_id: "01a0fedd-7d19-76de-8857-59409393b2b0" ``` + +## RPF-IN-0004 — Sitting-requester issuer rotation and projection proof + +```yaml +id: RPF-IN-0004 +kind: intake +title: "Sitting-requester issuer rotation and changed-projection proof" +status: open +origin: residual +origin_ref: RPF-WP-0051 +priority: medium +owner: railiance-platform +requested_by: codex +description: >- + Initial requester workload delivery is accepted under CCR-2026-0032. Plan + separately governed issuer rotation with KeyCape and informed-decision, + including actual changed-file pickup and predecessor credential rejection. + Initial cutover approval excludes rotation; do not rotate or broaden custody + under that approval. Preserve exact path, scope and human-control boundaries. +``` diff --git a/workplans/RPF-WP-0051-informed-decision-requester-workload-delivery.md b/workplans/RPF-WP-0051-informed-decision-requester-workload-delivery.md index 5bdecf0..f0fc435 100644 --- a/workplans/RPF-WP-0051-informed-decision-requester-workload-delivery.md +++ b/workplans/RPF-WP-0051-informed-decision-requester-workload-delivery.md @@ -4,11 +4,11 @@ type: workplan title: "Prepare and admit informed-decision requester workload delivery" domain: financials repo: railiance-platform -status: active +status: finished owner: codex topic_slug: platform-services created: "2026-10-04" -updated: "2026-10-04" +updated: "2026-10-05" flavor: implementation origin: routed origin_ref: "RPF-WP-0050-T03; INFD-WP-0005-T05; cd811073-d6db-41cf-8a57-10df0b360eab" @@ -86,12 +86,11 @@ are in this window's `dependency-requirements.md`. ```task id: RPF-WP-0051-T03 -status: progress +status: done priority: high depends_on: [RPF-WP-0051-T02] -needs_human: true +needs_human: false decision_id: "0d6792b6-59e4-4fa0-887a-c4e51ea8e131" -blocking_reason: "Metadata amendment and native delivery proofs passed. Final receiving service mount/cutover acceptance awaits INFD-WP-0007 rollout go; no further requester metadata approval is needed." state_hub_task_id: "abbe62c9-8520-563a-9f8a-e12b5209af77" ``` @@ -178,3 +177,16 @@ The test reader self-revoked and post-revoke lookup fails; all eight temporary verification objects are removed. CCR is applied; actual review Deployment mount and cutover acceptance remain T03. Issuer rotation stays separately governed, not inferred from unchanged-file projection or callback unit tests. + +## Receiving service acceptance — 2026-10-05 + +The approved schema-5 service is live. Its actual receiving pod mounts the +requester field read-only at 0440 and completes the pinned, signed create-only +KeyCape exchange. Native intake created approval 22b30fe7-c565-46f2-8193-d8875975ad9e +and retained its exact binding receipt. Public/private isolation, wrong caller +and crossed-audience checks pass. No credential value was emitted. + +Initial workload delivery is complete. Residual RPF-IN-0004 owns the separately +governed issuer rotation and changed-projection/predecessor-rejection proof; +this cutover neither performs nor authorizes rotation. Human acceptance of the +decision product stays with INFD-WP-0007-T07 / STATE-WP-0096-T03.