coulomb/railiance-platform
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Record founder batched attended custody choice
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 5s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a1046b-5629-7f52-badd-f718eadb6042
This commit is contained in:
codex 2026-10-04 03:00:33 +02:00
parent f5b7ff5118
commit e1caa378cf
2 changed files with 26 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

22
docs/attended-provisioning-window.md
View file

@ -11,3 +11,25 @@ Each item must additionally bind the exact reviewed revision/digest, expected re
## P3 draft for founder ruling
The current rule remains attended value custody. Choose explicitly between (a) batched attended custody, (b) response-wrapped issuer delivery with one-time unwrap, and (c) a scoped MFA writer through a silent contained helper. Review exact actor/path/audience, TTL/single use, audit boundary, child-output suppression, crash cleanup, replay refusal and rollback before adopting b/c. Wrapped tokens are credentials and stay out of files, Hub, chat and logs. No option grants broad write or changes existing lanes. RPF-WP-0050-T02 is routed to D3; a generic D3 resolution still requires a specific value-path disposition, so lack of an explicit answer does not unblock it.
## Founder choice — 2026-10-04
Bernd selected **batched attended custody (existing approach)** in this session.
This completes the P3 choice for RPF-WP-0050-T02; it does not resolve the other
subjects in the shared D3 decision.
The existing boundary applies: the founder performs OIDC/MFA in their own
terminal through `warden access openbao-platform-admin-login --exec --
<reviewed-command>`. Every item retains its exact reviewed actor, path, audience,
CCR revision, upstream gates and receipt contract. Batching groups preparation
and attendance; it grants no additional paths, delegated writer or reusable
authority. Existing lane and session TTL/revocation requirements remain in force.
The reviewed child suppresses all output and errors, compares before writing,
refuses differing objects and returns only the reviewed non-secret receipt.
On failure or interruption, stop, establish the actual state and session cleanup,
and revalidate the remaining items before retrying. Applied custody is excluded
from replay; each item keeps its own abort, verification and rollback contract.
Values remain outside Git, Hub, chat and logs.
The dated scope and owner mappings remain RPF-WP-0050-T03. This custody choice
does not authorize a live command or activate a schedule.