coulomb/railiance-platform
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Return not-yet-ready attended items to owners (2026-10-11)
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 1370019@bnt-lap001
Assistant-Session: d462dd63-16de-4189-ae70-b9cd6566bf87
This commit is contained in:
codex 2026-10-11 21:08:43 +02:00
parent bd8931f92a
commit c45c058283
2 changed files with 11 additions and 7 deletions
Download patch file Download diff file Expand all files Collapse all files

13
workplans/RPF-WP-0027-keycape-live-secret-exposure-recovery.md
View file

@ -58,14 +58,14 @@ predecessor revocation, and sanitized evidence.
```task
id: RPF-WP-0027-T03
status: wait
needs_human: true
decision_id: 62aa95e4-3ccc-4867-8806-5e3db005b483
blocked_on: message-from:net-kingdom
blocking_reason: "Attended resolver run: postchecks outstanding; NetKingdom asked to package the complete sequence as one receipt-producing command for the next attended session."
blocking_reason: "Owner work first: NetKingdom packages the complete resolver sequence as one receipt-producing command; then it enters the attended-window checklist (D1 standing rule)."
priority: high
state_hub_task_id: "714ae011-903d-55e2-ac47-801b8ef879d1"
```
2026-10-11: not founder-ready (no packaged command yet); returned to owner. See the-custodian docs/attended-window/2026-10-11-checklist.md.
KeyCape supplied source revision `93704fd2424503007c20b458b62a7f7d994bb288`,
post-rotation JWKS SHA-256
`c6faac5dfeef2453daf9cfc14671f62b535dd321befdf6014e3ee5c2cf1f1156`, and
@ -131,13 +131,14 @@ status, timestamps, and cleanup receipts.
```task
id: RPF-WP-0027-T06
status: wait
needs_human: true
decision_id: 62aa95e4-3ccc-4867-8806-5e3db005b483
blocking_reason: "Platform/OpenBao owner must publish the non-secret routing receipt for both lanes through the attended handoff; values are never inferred."
blocking_reason: "Owner work first: the OpenBao owner confirms mount/path/fields and writer/reader authority and publishes the non-secret routing receipt; the handoff enters the attended window only when a command exists."
priority: high
blocked_on: message-from:rapp-openbao
state_hub_task_id: "3b9748c4-2906-5ba7-9d34-0a7067a59283"
```
2026-10-11: not founder-ready; returned to owner.
The platform/OpenBao owner must publish a non-secret receipt for both routing
lanes: canonical mount/path, field name, KV version semantics, least-privilege
policy and auth method, expiry/rotation/revocation semantics, and the approved

5
workplans/RPF-WP-0035-credential-lane-implementation.md
View file

@ -873,11 +873,14 @@ native/adoption obligations. Historical per-step exclusions remain above.
```task
id: RPF-WP-0035-T10
status: wait
needs_human: true
priority: medium
blocked_on: message-from:approval-engine
blocking_reason: "Blue lane under the standing change rule (removing access, with reviewed order, rollback and receipts): executes once approval-engine confirms there is no presenter. No founder window needed."
state_hub_task_id: "af2d4dba-f83a-5819-9a8b-671bae799364"
```
2026-10-11: access removal is blue lane (canon build-mode-change-authorization_v0.1); no founder window.
key-cape proposed a joint disablement on 2026-10-10 (message `7f2128fb`).
Precondition: approval-engine reconfirms there is no presenter. The order is the
reverse of provisioning, so KeyCape never starts with a client whose secret is