coulomb/railiance-platform
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Finalize proposed CCR-2026-0033 and its attended custody child (source only).
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
Correct the KV path into platform/workloads/, record secrets-engine consumer
coordinates (D1-D4 pending), rotation ownership, live order and rollback, and
add a decision-gated custody child with fake-only tests. Nothing executed.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 132360@bnt-lap001
Assistant-Session: 769b1afd-4330-4c86-96b2-e510e26db42b
This commit is contained in:
codex 2026-10-06 13:46:12 +02:00
parent 01e0576132
commit df24a77482
9 changed files with 538 additions and 10 deletions
Download patch file Download diff file Expand all files Collapse all files

29
workplans/RPF-WP-0035-credential-lane-implementation.md
View file

@ -96,6 +96,16 @@ remains pending its scoped historical identity repair. Requirements and acceptan
boundaries: `docs/provisioning-windows/2026-10-04-1000/dependency-requirements.md`.
This workplan was already blocked and remains blocked on its open owner/live gates.
2026-10-06: secrets-engine returned consumer custody source acceptance
(message 680136e2, SECRETS-WP-0012, commit a3897c2). CCR-2026-0033 finalized as
**proposed**: KV path corrected to `platform/workloads/keycape/secrets-engine-openbao`
(applier scope), consumer copy coordinates with D1-D4 pending founder choice,
rotation/revocation ownership, live order and rollback. Attended custody child
`scripts/keycape_secrets_engine_openbao_custody.py` with fake-only tests
(`tests/test_keycape_secrets_engine_openbao_custody.py`) refuses without an exact
founder decision id recorded in the approved CCR. Nothing executed, generated or
applied; nothing added to active GitOps. The founder approval it needs is T09.
## Implement the platform operator-write CCR contract and Fluid lane
```task
@ -751,3 +761,22 @@ neither source reconciliation nor the historical pilot is that evidence.
## Loose-end review — 2026-09-27
T08 now explicitly waits for formerly-valid audit-bearer revocation acceptance from AUDIT-WP-0009-T09/T11. Native delivery, producer checks and independent readback already passed; do not reopen login, seed or review gates. T02/T03/T06/T07 retain their latest exact service registration, signed-in human acceptance, owner delivery/disposition and governed-consumer migration dependencies. No credential value was read or changed.
## Founder approval of the CCR-2026-0033 custody child
```task
id: RPF-WP-0035-T09
status: wait
needs_human: true
priority: high
depends_on: [SECRETS-WP-0012-T02]
blocking_reason: "Founder must approve proposed CCR-2026-0033 (platform-owner, key-cape-owner, net-kingdom-owner reviews; bound claims confirmed) and the exact attended custody child run with a decision id recorded in the CCR review. Boundary decision 632a8893 does not cover generation, write or delivery. secrets-engine D1-D4 resolve first."
```
Packet: `credential-change-requests/CCR-2026-0033.yaml` (custody_child,
consumer_copy, live_order, rollback). Run after approval, attended:
`python3 scripts/keycape_secrets_engine_openbao_custody.py provision
--approval-decision <id> --receipt <new path>` inside the warden platform-admin
envelope. Later live steps (ESO, NetKingdom patch, registration, restart,
KEY-WP-0037-T04 issuance, T02 JWT login proof) each need their own go.