coulomb/railiance-platform
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Record founder batched attended custody choice
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 5s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a1046b-5629-7f52-badd-f718eadb6042
This commit is contained in:
codex 2026-10-04 03:00:33 +02:00
parent f5b7ff5118
commit e1caa378cf
2 changed files with 26 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

22
docs/attended-provisioning-window.md
View file

@ -11,3 +11,25 @@ Each item must additionally bind the exact reviewed revision/digest, expected re
## P3 draft for founder ruling
The current rule remains attended value custody. Choose explicitly between (a) batched attended custody, (b) response-wrapped issuer delivery with one-time unwrap, and (c) a scoped MFA writer through a silent contained helper. Review exact actor/path/audience, TTL/single use, audit boundary, child-output suppression, crash cleanup, replay refusal and rollback before adopting b/c. Wrapped tokens are credentials and stay out of files, Hub, chat and logs. No option grants broad write or changes existing lanes. RPF-WP-0050-T02 is routed to D3; a generic D3 resolution still requires a specific value-path disposition, so lack of an explicit answer does not unblock it.
## Founder choice — 2026-10-04
Bernd selected **batched attended custody (existing approach)** in this session.
This completes the P3 choice for RPF-WP-0050-T02; it does not resolve the other
subjects in the shared D3 decision.
The existing boundary applies: the founder performs OIDC/MFA in their own
terminal through `warden access openbao-platform-admin-login --exec --
<reviewed-command>`. Every item retains its exact reviewed actor, path, audience,
CCR revision, upstream gates and receipt contract. Batching groups preparation
and attendance; it grants no additional paths, delegated writer or reusable
authority. Existing lane and session TTL/revocation requirements remain in force.
The reviewed child suppresses all output and errors, compares before writing,
refuses differing objects and returns only the reviewed non-secret receipt.
On failure or interruption, stop, establish the actual state and session cleanup,
and revalidate the remaining items before retrying. Applied custody is excluded
from replay; each item keeps its own abort, verification and rollback contract.
Values remain outside Git, Hub, chat and logs.
The dated scope and owner mappings remain RPF-WP-0050-T03. This custody choice
does not authorize a live command or activate a schedule.

8
workplans/RPF-WP-0050-attended-provisioning-preparation.md
View file

@ -8,7 +8,7 @@ status: active
owner: codex
topic_slug: platform-services
created: "2026-10-03"
updated: "2026-10-03"
updated: "2026-10-04"
flavor: implementation
state_hub_workstream_id: "0c7e3b0c-1c36-568c-af51-b06f912a0f1d"
---
@ -30,16 +30,16 @@ Implemented `credential-change.py window-checklist` and `scripts/provisioning_wi
```task
id: RPF-WP-0050-T02
status: wait
status: done
priority: high
needs_human: true
decision_id: "1591daa1-6e85-4dfd-aadd-5a9fe1ef47fa"
blocking_reason: "Founder must explicitly choose batched attended custody, response-wrapped issuer delivery, or scoped MFA silent writer, and approve its exact boundary. Generic D3 resolution without this disposition is insufficient."
state_hub_task_id: "99b73b3f-66b1-57a9-9f68-43e3fe12bf26"
```
P3 options and required review boundaries are drafted in the contract. Existing attended custody remains in force. No delivery helper, delegated value role or policy change is admitted by preparation.
2026-10-04: Bernd explicitly selected "Batched attended custody (existing approach)" in this session. T02 is done for that choice under the existing attended-login boundary, recorded in `docs/attended-provisioning-window.md`: founder OIDC/MFA, exact per-item reviewed CCR/actor/path/audience, contained silent child, existing TTL/revocation, compare-before-write, replay refusal and per-item abort/verification/rollback. No alternate delivery lane is adopted. Shared D3 has other unresolved subjects and is not resolved by this task completion. T03 still requires the dated scope and owner receipt mappings; no live command or schedule is authorized by this choice.
## Bind a real dated window and owner receipt manifests
```task