From e3bc1ab32b3a3753dc12bfd5543f0933f8cf0a98 Mon Sep 17 00:00:00 2001 From: codex Date: Tue, 27 Oct 2026 23:23:11 +0100 Subject: [PATCH] RPF-WP-0065-T04: done; founder applied and verified the platform-admin aal2 binding Co-Authored-By: Claude Opus 5.5 Assistant: claude-code Assistant-Model: opus Assistant-Process: 4515@bnt-lap001 Assistant-Session: 0bf96127-6e04-41be-bfda-d11717c3f354 --- WORK-RECORDS.md | 2 +- workplans/RPF-WP-0065-netkingdom-role-claim-bindings.md | 4 +++- 2 files changed, 4 insertions(+), 2 deletions(-) diff --git a/WORK-RECORDS.md b/WORK-RECORDS.md index 39a4fa7..cf2b810 100644 --- a/WORK-RECORDS.md +++ b/WORK-RECORDS.md @@ -207,7 +207,7 @@ | task | RPF-WP-0065-T01 | done | — | workplans/RPF-WP-0065-netkingdom-role-claim-bindings.md | | task | RPF-WP-0065-T02 | done | — | workplans/RPF-WP-0065-netkingdom-role-claim-bindings.md | | task | RPF-WP-0065-T03 | done | — | workplans/RPF-WP-0065-netkingdom-role-claim-bindings.md | -| task | RPF-WP-0065-T04 | wait | — | workplans/RPF-WP-0065-netkingdom-role-claim-bindings.md | +| task | RPF-WP-0065-T04 | done | — | workplans/RPF-WP-0065-netkingdom-role-claim-bindings.md | | task | RPF-WP-0065-T05 | wait | — | workplans/RPF-WP-0065-netkingdom-role-claim-bindings.md | | task | RPF-WP-0066-T01 | todo | — | workplans/RPF-WP-0066-openbao-durable-audit-snapshots-conformance.md | | task | RPF-WP-0066-T02 | wait | — | workplans/RPF-WP-0066-openbao-durable-audit-snapshots-conformance.md | diff --git a/workplans/RPF-WP-0065-netkingdom-role-claim-bindings.md b/workplans/RPF-WP-0065-netkingdom-role-claim-bindings.md index 27b1ced..5129241 100644 --- a/workplans/RPF-WP-0065-netkingdom-role-claim-bindings.md +++ b/workplans/RPF-WP-0065-netkingdom-role-claim-bindings.md @@ -87,11 +87,13 @@ state_hub_task_id: "b7bfdb19-a806-589b-b287-fb3abffc2e78" ```task id: RPF-WP-0065-T04 -status: wait +status: done priority: high state_hub_task_id: "abd78db2-03ad-5942-a9ef-12bbada54b28" ``` **Founder live step: apply platform-admin aal2 (needs the founder).** See runbook below, rebuilt + +2026-10-27, founder-run through the warden lane with `scripts/openbao-platform-admin-aal2.sh`: prepare (22:19Z, role backup plus `/assurance/level` claim mapping), apply (22:21Z, gate passed; `bound_claims` read back as `{"groups":["net-kingdom-admins"],"/assurance/level":"aal2"}`), verify (22:21Z, fresh MFA login). Value-free receipts at `~/.local/state/railiance/rpf-wp-0065-t04/` on the founder workstation. Two repeated `prepare` runs refused on the existing receipt path before contacting OpenBao. SI-X4 closed in net-kingdom. 2026-10-27 for the silent warden lane (`scripts/openbao-platform-admin-aal2.sh`). The declaration now also maps `/assurance/level` to token metadata `assurance_level` for the pre-apply gate.