coulomb/railiance-platform
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Record founder batched attended custody choice
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 5s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a1046b-5629-7f52-badd-f718eadb6042
This commit is contained in:
codex 2026-10-04 03:00:33 +02:00
parent f5b7ff5118
commit e1caa378cf
2 changed files with 26 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

22
docs/attended-provisioning-window.md
View file

@ -11,3 +11,25 @@ Each item must additionally bind the exact reviewed revision/digest, expected re
## P3 draft for founder ruling ## P3 draft for founder ruling
The current rule remains attended value custody. Choose explicitly between (a) batched attended custody, (b) response-wrapped issuer delivery with one-time unwrap, and (c) a scoped MFA writer through a silent contained helper. Review exact actor/path/audience, TTL/single use, audit boundary, child-output suppression, crash cleanup, replay refusal and rollback before adopting b/c. Wrapped tokens are credentials and stay out of files, Hub, chat and logs. No option grants broad write or changes existing lanes. RPF-WP-0050-T02 is routed to D3; a generic D3 resolution still requires a specific value-path disposition, so lack of an explicit answer does not unblock it. The current rule remains attended value custody. Choose explicitly between (a) batched attended custody, (b) response-wrapped issuer delivery with one-time unwrap, and (c) a scoped MFA writer through a silent contained helper. Review exact actor/path/audience, TTL/single use, audit boundary, child-output suppression, crash cleanup, replay refusal and rollback before adopting b/c. Wrapped tokens are credentials and stay out of files, Hub, chat and logs. No option grants broad write or changes existing lanes. RPF-WP-0050-T02 is routed to D3; a generic D3 resolution still requires a specific value-path disposition, so lack of an explicit answer does not unblock it.
## Founder choice — 2026-10-04
Bernd selected **batched attended custody (existing approach)** in this session.
This completes the P3 choice for RPF-WP-0050-T02; it does not resolve the other
subjects in the shared D3 decision.
The existing boundary applies: the founder performs OIDC/MFA in their own
terminal through `warden access openbao-platform-admin-login --exec --
<reviewed-command>`. Every item retains its exact reviewed actor, path, audience,
CCR revision, upstream gates and receipt contract. Batching groups preparation
and attendance; it grants no additional paths, delegated writer or reusable
authority. Existing lane and session TTL/revocation requirements remain in force.
The reviewed child suppresses all output and errors, compares before writing,
refuses differing objects and returns only the reviewed non-secret receipt.
On failure or interruption, stop, establish the actual state and session cleanup,
and revalidate the remaining items before retrying. Applied custody is excluded
from replay; each item keeps its own abort, verification and rollback contract.
Values remain outside Git, Hub, chat and logs.
The dated scope and owner mappings remain RPF-WP-0050-T03. This custody choice
does not authorize a live command or activate a schedule.

8
workplans/RPF-WP-0050-attended-provisioning-preparation.md
View file

@ -8,7 +8,7 @@ status: active
owner: codex owner: codex
topic_slug: platform-services topic_slug: platform-services
created: "2026-10-03" created: "2026-10-03"
updated: "2026-10-03" updated: "2026-10-04"
flavor: implementation flavor: implementation
state_hub_workstream_id: "0c7e3b0c-1c36-568c-af51-b06f912a0f1d" state_hub_workstream_id: "0c7e3b0c-1c36-568c-af51-b06f912a0f1d"
--- ---
@ -30,16 +30,16 @@ Implemented `credential-change.py window-checklist` and `scripts/provisioning_wi
```task ```task
id: RPF-WP-0050-T02 id: RPF-WP-0050-T02
status: wait status: done
priority: high priority: high
needs_human: true
decision_id: "1591daa1-6e85-4dfd-aadd-5a9fe1ef47fa" decision_id: "1591daa1-6e85-4dfd-aadd-5a9fe1ef47fa"
blocking_reason: "Founder must explicitly choose batched attended custody, response-wrapped issuer delivery, or scoped MFA silent writer, and approve its exact boundary. Generic D3 resolution without this disposition is insufficient."
state_hub_task_id: "99b73b3f-66b1-57a9-9f68-43e3fe12bf26" state_hub_task_id: "99b73b3f-66b1-57a9-9f68-43e3fe12bf26"
``` ```
P3 options and required review boundaries are drafted in the contract. Existing attended custody remains in force. No delivery helper, delegated value role or policy change is admitted by preparation. P3 options and required review boundaries are drafted in the contract. Existing attended custody remains in force. No delivery helper, delegated value role or policy change is admitted by preparation.
2026-10-04: Bernd explicitly selected "Batched attended custody (existing approach)" in this session. T02 is done for that choice under the existing attended-login boundary, recorded in `docs/attended-provisioning-window.md`: founder OIDC/MFA, exact per-item reviewed CCR/actor/path/audience, contained silent child, existing TTL/revocation, compare-before-write, replay refusal and per-item abort/verification/rollback. No alternate delivery lane is adopted. Shared D3 has other unresolved subjects and is not resolved by this task completion. T03 still requires the dated scope and owner receipt mappings; no live command or schedule is authorized by this choice.
## Bind a real dated window and owner receipt manifests ## Bind a real dated window and owner receipt manifests
```task ```task