From d0ff5349dbd05874c39159c78effa0a7722fb236 Mon Sep 17 00:00:00 2001 From: codex Date: Sat, 31 Oct 2026 16:46:32 +0100 Subject: [PATCH] CCR-2026-0058: re-approved with the corrected policy (platform-owner, net-kingdom-owner) Founder re-approval in session 2026-10-31 after the required_parameters fix. Co-Authored-By: Claude Opus 5.5 Assistant: claude-code Assistant-Model: opus Assistant-Process: 994874@bnt-lap001 Assistant-Session: 6017c416-d619-47eb-bd1a-f670a02d7d87 --- ...gdom-bind-executor-svc-authelia-write.yaml | 27 +++++++++++++------ 1 file changed, 19 insertions(+), 8 deletions(-) diff --git a/credential-change-requests/CCR-2026-0058-net-kingdom-bind-executor-svc-authelia-write.yaml b/credential-change-requests/CCR-2026-0058-net-kingdom-bind-executor-svc-authelia-write.yaml index 60a8e52..174db49 100644 --- a/credential-change-requests/CCR-2026-0058-net-kingdom-bind-executor-svc-authelia-write.yaml +++ b/credential-change-requests/CCR-2026-0058-net-kingdom-bind-executor-svc-authelia-write.yaml @@ -3,7 +3,7 @@ kind: credential-change-request schema_version: 1 request_type: workload-kv-write-next-version title: NetKingdom bounded executor writes the next svc-authelia bind version (pilot) -status: proposed +status: approved created: '2026-10-31' updated: '2026-10-31' requester: @@ -29,8 +29,18 @@ review: decision: approved comment: Approved by the founder in session 2026-10-31 as amended (window-scoped role, bind self-rotation) for NK-WP-0056-T06. Recorded by hand in the approve - tool's format; the tool refuses the second approval for this request type once the - first sets status approved. + tool's format; the tool refuses the second approval for this request type once + the first sets status approved. + - at: '2026-10-31T15:46:26+00:00' + reviewer: platform-owner + decision: approved + comment: Re-approved by the founder in session 2026-10-31 with the corrected policy + (required_parameters removed; NK-WP-0056-T12 synthetic pilot evidence). + - at: '2026-10-31T15:46:26+00:00' + reviewer: net-kingdom-owner + decision: approved + comment: Re-approved by the founder in session 2026-10-31 with the corrected policy + (required_parameters removed; NK-WP-0056-T12 synthetic pilot evidence). target: domain: infotech tenant: platform @@ -90,11 +100,12 @@ agent_fence: amendments: - at: '2026-10-31' by: claude-code - change: 'Policy file corrected: removed required_parameters = ["options"]. OpenBao 2.5.4 - applies it to reads as well, so the executor could not read the version it must name for CAS - (net-kingdom NK-WP-0056-T12 synthetic pilot, docs/evidence/2026-10-31-nk56-t12-synthetic-pilot/). Writes - without options.cas are still refused by cas_required on the key; metadata, delete, sibling and new paths - stay denied (tested). Status reset to proposed: the approved policy file changed, re-approval needed.' + change: 'Policy file corrected: removed required_parameters = ["options"]. OpenBao + 2.5.4 applies it to reads as well, so the executor could not read the version + it must name for CAS (net-kingdom NK-WP-0056-T12 synthetic pilot, docs/evidence/2026-10-31-nk56-t12-synthetic-pilot/). + Writes without options.cas are still refused by cas_required on the key; metadata, + delete, sibling and new paths stay denied (tested). Status reset to proposed: + the approved policy file changed, re-approval needed.' lifecycle: role_window: 'Window-scoped (founder decision 2026-10-31, hub c29c6eda): the policy is applied once and grants nothing on its own; the Kubernetes-auth role is created