feat: admit and exercise KeyCape verifier custody activation
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
CI Smoke / container-smoke (push) Successful in 1s

Assistant: codex
Assistant-Model: gpt-5.6-luna
Assistant-Session: 01a07ff8-19d0-7820-b4d0-1353833cb7fc
This commit is contained in:
codex 2026-09-09 01:32:45 +02:00
parent 52b24eab9a
commit b7861de20e
8 changed files with 662 additions and 184 deletions

View file

@ -145,9 +145,9 @@ closure: `history/2026-09-05-preflight-signing-activation-complete.md`.
```task
id: RPF-WP-0035-T05
status: wait
needs_human: true
intervention_note: "Review CCR-2026-0017 and CCR-2026-0018 as platform-operator and key-cape-owner; both pending decisions are linked from the CCRs and the review packet. Signed issuer and exact configuration pin are proved."
status: progress
needs_human: false
intervention_note: ""
priority: high
state_hub_task_id: "e15d62c9-e5da-5721-a135-87c050f7851c"
```
@ -218,6 +218,16 @@ human dependency; HFACT consumes it without a duplicate approval request.
Custody/ESO activation, client verification and the separate client-side/audit
lanes remain open. Current CLI apply plans refuse the proposed requests.
2026-09-09 admission: the user explicitly approved both CCRs in the named
platform-operator and key-cape-owner roles. Both source requests are approved
and both linked Hub decisions are resolved. Receipt:
`docs/evidence/2026-09-09-keycape-approval-admission.json`. The completed review
intervention is cleared; T05 is progress while the contained first-provision
procedure is exercised and the admitted attended rollout is carried through.
Verifier-side scope, separate client-side/audit lanes and live acceptance remain
as defined in the reviewed requests.
## Dependency review — 2026-09-06
SECRETS-WP-0008-T02 now records the local PIP claim/validation join implemented