coulomb/railiance-platform
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

CCR-2026-0058: re-approved with the corrected policy (platform-owner, net-kingdom-owner)
All checks were successful
CCR intake gate / gate (push) Successful in 1m10s
Details
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
Founder re-approval in session 2026-10-31 after the required_parameters fix.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 994874@bnt-lap001
Assistant-Session: 6017c416-d619-47eb-bd1a-f670a02d7d87
This commit is contained in:
codex 2026-10-31 16:46:32 +01:00
parent c20bf329fd
commit d0ff5349db
1 changed files with 19 additions and 8 deletions
Download patch file Download diff file Expand all files Collapse all files

27
credential-change-requests/CCR-2026-0058-net-kingdom-bind-executor-svc-authelia-write.yaml
View file

@ -3,7 +3,7 @@ kind: credential-change-request
schema_version: 1
request_type: workload-kv-write-next-version
title: NetKingdom bounded executor writes the next svc-authelia bind version (pilot)
status: proposed
status: approved
created: '2026-10-31'
updated: '2026-10-31'
requester:
@ -29,8 +29,18 @@ review:
decision: approved
comment: Approved by the founder in session 2026-10-31 as amended (window-scoped
role, bind self-rotation) for NK-WP-0056-T06. Recorded by hand in the approve
tool's format; the tool refuses the second approval for this request type once the
first sets status approved.
tool's format; the tool refuses the second approval for this request type once
the first sets status approved.
- at: '2026-10-31T15:46:26+00:00'
reviewer: platform-owner
decision: approved
comment: Re-approved by the founder in session 2026-10-31 with the corrected policy
(required_parameters removed; NK-WP-0056-T12 synthetic pilot evidence).
- at: '2026-10-31T15:46:26+00:00'
reviewer: net-kingdom-owner
decision: approved
comment: Re-approved by the founder in session 2026-10-31 with the corrected policy
(required_parameters removed; NK-WP-0056-T12 synthetic pilot evidence).
target:
domain: infotech
tenant: platform
@ -90,11 +100,12 @@ agent_fence:
amendments:
- at: '2026-10-31'
by: claude-code
change: 'Policy file corrected: removed required_parameters = ["options"]. OpenBao 2.5.4
applies it to reads as well, so the executor could not read the version it must name for CAS
(net-kingdom NK-WP-0056-T12 synthetic pilot, docs/evidence/2026-10-31-nk56-t12-synthetic-pilot/). Writes
without options.cas are still refused by cas_required on the key; metadata, delete, sibling and new paths
stay denied (tested). Status reset to proposed: the approved policy file changed, re-approval needed.'
change: 'Policy file corrected: removed required_parameters = ["options"]. OpenBao
2.5.4 applies it to reads as well, so the executor could not read the version
it must name for CAS (net-kingdom NK-WP-0056-T12 synthetic pilot, docs/evidence/2026-10-31-nk56-t12-synthetic-pilot/).
Writes without options.cas are still refused by cas_required on the key; metadata,
delete, sibling and new paths stay denied (tested). Status reset to proposed:
the approved policy file changed, re-approval needed.'
lifecycle:
role_window: 'Window-scoped (founder decision 2026-10-31, hub c29c6eda): the policy
is applied once and grants nothing on its own; the Kubernetes-auth role is created