coulomb/railiance-platform
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

RPF-WP-0065-T04: done; founder applied and verified the platform-admin aal2 binding

Browse source 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 4515@bnt-lap001
Assistant-Session: 0bf96127-6e04-41be-bfda-d11717c3f354
This commit is contained in:
codex 2026-10-27 23:23:11 +01:00
parent bedab6f5ab
commit e3bc1ab32b
2 changed files with 4 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

2
WORK-RECORDS.md
View file

@ -207,7 +207,7 @@
| task | RPF-WP-0065-T01 | done | — | workplans/RPF-WP-0065-netkingdom-role-claim-bindings.md |
| task | RPF-WP-0065-T02 | done | — | workplans/RPF-WP-0065-netkingdom-role-claim-bindings.md |
| task | RPF-WP-0065-T03 | done | — | workplans/RPF-WP-0065-netkingdom-role-claim-bindings.md |
| task | RPF-WP-0065-T04 | wait | — | workplans/RPF-WP-0065-netkingdom-role-claim-bindings.md |
| task | RPF-WP-0065-T04 | done | — | workplans/RPF-WP-0065-netkingdom-role-claim-bindings.md |
| task | RPF-WP-0065-T05 | wait | — | workplans/RPF-WP-0065-netkingdom-role-claim-bindings.md |
| task | RPF-WP-0066-T01 | todo | — | workplans/RPF-WP-0066-openbao-durable-audit-snapshots-conformance.md |
| task | RPF-WP-0066-T02 | wait | — | workplans/RPF-WP-0066-openbao-durable-audit-snapshots-conformance.md |

4
workplans/RPF-WP-0065-netkingdom-role-claim-bindings.md
View file

@ -87,11 +87,13 @@ state_hub_task_id: "b7bfdb19-a806-589b-b287-fb3abffc2e78"
```task
id: RPF-WP-0065-T04
status: wait
status: done
priority: high
state_hub_task_id: "abd78db2-03ad-5942-a9ef-12bbada54b28"
```
**Founder live step: apply platform-admin aal2 (needs the founder).** See runbook below, rebuilt
2026-10-27, founder-run through the warden lane with `scripts/openbao-platform-admin-aal2.sh`: prepare (22:19Z, role backup plus `/assurance/level` claim mapping), apply (22:21Z, gate passed; `bound_claims` read back as `{"groups":["net-kingdom-admins"],"/assurance/level":"aal2"}`), verify (22:21Z, fresh MFA login). Value-free receipts at `~/.local/state/railiance/rpf-wp-0065-t04/` on the founder workstation. Two repeated `prepare` runs refused on the existing receipt path before contacting OpenBao. SI-X4 closed in net-kingdom.
2026-10-27 for the silent warden lane (`scripts/openbao-platform-admin-aal2.sh`). The declaration
now also maps `/assurance/level` to token metadata `assurance_level` for the pre-apply gate.