codex
715b0064ce
Preview unadmitted backup pair custody.
...
The helper checks both draft archive CCRs and refuses a CAS write until the writer identity is admitted. No provider key is created.
Assistant: grok
Assistant-Session: 01a11cdb-f9fe-7011-947c-936e72007e54
2026-10-08 21:28:07 +02:00
codex
a8fc1a3438
Prepare immutable application archive transfer and retention admission
...
CI Smoke / host-smoke (push) Successful in 0s
CI Smoke / container-smoke (push) Successful in 2s
Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a11538-05ea-7b63-b3c7-a2df5f38898d
2026-10-07 23:23:33 +02:00
codex
720277bd39
Silence applier-apply under --quiet and drop the retired bao callback default
...
CI Smoke / host-smoke (push) Successful in 0s
CI Smoke / container-smoke (push) Successful in 1s
The warden attended wrapper refuses any output, so --quiet now captures bao's
own messages and skips the [OK] lines; a failure reports only the step and exit
code. New OIDC scaffolds default to the operator-tunnel UI callback rather than
bao.coulomb.social, which was retired on 2026-09-15. Existing CCRs keep their
lists until amended. The CCR-2026-0033 test pins move to its approved/applied state.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 132360@bnt-lap001
Assistant-Session: 769b1afd-4330-4c86-96b2-e510e26db42b
2026-10-07 09:16:58 +02:00
codex
26dd803410
Place the ESO audience under serviceAccountRef (ESO v1 schema)
...
The server dry run rejected spec.provider.vault.auth.kubernetes.audiences. The
same audience, openbao, now sits under serviceAccountRef, as in openbao-reuse.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 132360@bnt-lap001
Assistant-Session: 769b1afd-4330-4c86-96b2-e510e26db42b
2026-10-07 02:05:53 +02:00
codex
71607d277c
Record founder approval 2ab717e1 on CCR-2026-0033/0034 and the ESO admission
...
CI Smoke / host-smoke (push) Successful in 0s
CI Smoke / container-smoke (push) Successful in 2s
The custody refusal test now checks proposed copies instead of the committed
CCRs, which are approved.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 132360@bnt-lap001
Assistant-Session: 769b1afd-4330-4c86-96b2-e510e26db42b
2026-10-07 00:25:37 +02:00
0fada49c38
Complete scoped Authelia SMTP admission and record rotation consumers
...
CI Smoke / host-smoke (push) Successful in 0s
CI Smoke / container-smoke (push) Successful in 1s
Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a10e2d-a5ef-7e92-b03d-b1694e915680
2026-10-06 20:38:28 +02:00
codex
4a284f0a3b
Revise KeyCape secrets-engine-openbao custody: OpenBao-only, operator reader CCR-2026-0034 (source only)
...
CI Smoke / host-smoke (push) Successful in 1s
CI Smoke / container-smoke (push) Successful in 2s
Founder direction 2026-10-06 and ops-mason plan keycape-secrets-engine-openbao-client-custody
(658cdbc, MASON-WP-0009): the client secret lives only in OpenBao.
- CCR-2026-0033: consumer file and secrets-engine D1-D4 removed; KV metadata declared
(cas_required, max_versions=2, delete_version_after=0s, custom_metadata); target.domain
infotech; live order and roll-forward rollback revised; status stays proposed.
- New sibling CCR-2026-0034 + policy: attended OIDC operator reader on auth/netkingdom,
read data path + revoke-self only, 5m/4 uses, no default policy, bound
groups=net-kingdom-admins and /assurance/level=aal2 (KeyCape 7d96ee4). Proposed,
bound claims unconfirmed (founder item for both readers).
- credential-change.py: OIDC roles carry token_max_ttl/explicit_max_ttl/no_default_policy/
num_uses/type and bound_claims_type (string only); token_revoke_self policy option;
validated openbao.kv_metadata. Tests added.
- Custody child: consumer write and check-secret-file removed; cas=0 create / --rotate
cas=<current>; compare-before-write metadata put; refusals unchanged.
- Founder runbook (keycape/founder-runbook.md), window docs, RPF-WP-0035-T09 (waits on A1/A2/A3).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 132360@bnt-lap001
Assistant-Session: 769b1afd-4330-4c86-96b2-e510e26db42b
2026-10-06 14:26:42 +02:00
codex
df24a77482
Finalize proposed CCR-2026-0033 and its attended custody child (source only).
...
CI Smoke / host-smoke (push) Successful in 0s
CI Smoke / container-smoke (push) Successful in 1s
Correct the KV path into platform/workloads/, record secrets-engine consumer
coordinates (D1-D4 pending), rotation ownership, live order and rollback, and
add a decision-gated custody child with fake-only tests. Nothing executed.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 132360@bnt-lap001
Assistant-Session: 769b1afd-4330-4c86-96b2-e510e26db42b
2026-10-06 13:46:12 +02:00
codex
01e0576132
Prepare password-free inbound-library IMAP entry for attended custody
...
CI Smoke / host-smoke (push) Successful in 0s
CI Smoke / container-smoke (push) Successful in 1s
Sibling of the telemetry SMTP entry for library@coulomb.social
(inbound-library ILIB-WP-0002-T07).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 1170398@bnt-lap001
Assistant-Session: 622cd705-cb31-4322-ba08-dd42e44fa583
2026-10-05 11:14:54 +02:00
codex
d54ba38b48
Accept the policy-nexus multi-source shape and draft the Application.
...
CI Smoke / host-smoke (push) Successful in 1s
CI Smoke / container-smoke (push) Has been cancelled
T02 records the tenant's answer. The draft stays under docs and is not applied.
Assistant: grok
Assistant-Session: 01a10946-16b2-7771-88ac-c6dcb564b159
2026-10-05 01:37:43 +02:00
b51e91cc6f
Accept requester workload delivery and retain separate rotation residual
...
CI Smoke / host-smoke (push) Successful in 1s
CI Smoke / container-smoke (push) Successful in 2s
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a10780-6d41-7952-9718-dfbc1f41236f
2026-10-05 00:13:30 +02:00
4ed39d91d0
Accept native requester delivery proofs and preserve final cutover gate
...
CI Smoke / host-smoke (push) Successful in 0s
CI Smoke / container-smoke (push) Successful in 1s
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a10780-6d41-7952-9718-dfbc1f41236f
2026-10-04 23:50:18 +02:00
f3dbff6a77
Match native proof HTTPS egress to the service ingress peer
...
CI Smoke / host-smoke (push) Successful in 0s
CI Smoke / container-smoke (push) Successful in 8s
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a10780-6d41-7952-9718-dfbc1f41236f
2026-10-04 23:44:47 +02:00
6f4b87d44e
Align native proof with KeyCape Basic authentication and corrected image
...
CI Smoke / host-smoke (push) Successful in 0s
CI Smoke / container-smoke (push) Successful in 1s
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a10780-6d41-7952-9718-dfbc1f41236f
2026-10-04 23:42:15 +02:00
4db8563eff
Prepare bounded native requester and wrong-identity proofs
...
CI Smoke / host-smoke (push) Successful in 0s
CI Smoke / container-smoke (push) Successful in 2s
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a10780-6d41-7952-9718-dfbc1f41236f
2026-10-04 23:32:00 +02:00
bbb016f8b6
Record founder approval of exact ESO self-token amendment
...
CI Smoke / host-smoke (push) Successful in 0s
CI Smoke / container-smoke (push) Successful in 1s
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a10780-6d41-7952-9718-dfbc1f41236f
2026-10-04 23:24:05 +02:00
e84b68db01
Record native ESO result and prepare scoped self-token amendment
...
CI Smoke / host-smoke (push) Successful in 0s
CI Smoke / container-smoke (push) Successful in 1s
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a10780-6d41-7952-9718-dfbc1f41236f
2026-10-04 23:21:55 +02:00
4332c391ea
Align requester audience projection with installed ESO schema
...
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a10780-6d41-7952-9718-dfbc1f41236f
2026-10-04 23:18:33 +02:00
562d991489
Promote approved requester delivery manifests and metadata receipt
...
CI Smoke / host-smoke (push) Successful in 0s
CI Smoke / container-smoke (push) Successful in 1s
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a10780-6d41-7952-9718-dfbc1f41236f
2026-10-04 23:17:19 +02:00
f0c9a15235
Handle actual Bao absence response and retain safe attempt phases
...
CI Smoke / host-smoke (push) Successful in 0s
CI Smoke / container-smoke (push) Successful in 1s
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a10780-6d41-7952-9718-dfbc1f41236f
2026-10-04 23:13:47 +02:00
a7bc33b867
Record approved requester delivery and attended execution packet
...
CI Smoke / host-smoke (push) Successful in 0s
CI Smoke / container-smoke (push) Successful in 1s
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a10780-6d41-7952-9718-dfbc1f41236f
2026-10-04 23:02:28 +02:00
codex
7008d84dc0
Record the attended IR-WP-0005 key-check delivery receipts.
...
CI Smoke / host-smoke (push) Successful in 0s
CI Smoke / container-smoke (push) Successful in 1s
Assistant: grok
Assistant-Session: 01a106a5-fc07-78c2-b64f-8e04cea25daf
2026-10-04 17:13:00 +02:00
codex
209e7e38bf
Draft the activity-core repo-manager Forgejo read lane (proposed)
...
CI Smoke / host-smoke (push) Successful in 0s
CI Smoke / container-smoke (push) Successful in 2s
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 692292@bnt-lap001
Assistant-Session: 89c7d8e8-e1b3-47eb-9411-a0ab227fca2f
2026-10-04 16:30:36 +02:00
codex
e59b5fa70f
Record the three unapproved T03 memo version 3 approval requests.
...
CI Smoke / host-smoke (push) Successful in 0s
CI Smoke / container-smoke (push) Successful in 2s
Assistant: grok
Assistant-Session: 01a10745-04a2-78c1-99f7-822afb404d5f
2026-10-04 16:27:41 +02:00
codex
8c7c34e84b
Implement issuer reader preparation and qualify blocked owner dependencies
...
CI Smoke / host-smoke (push) Successful in 0s
CI Smoke / container-smoke (push) Successful in 1s
Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a1046b-5629-7f52-badd-f718eadb6042
2026-10-04 11:32:13 +02:00
codex
ecbe3b9dd5
Record authorized requester and service identity owner review requests
...
CI Smoke / host-smoke (push) Successful in 0s
CI Smoke / container-smoke (push) Successful in 2s
Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a1046b-5629-7f52-badd-f718eadb6042
2026-10-04 11:03:41 +02:00
codex
6b91d51039
Record founder requester design approval and retain execution gates
...
CI Smoke / host-smoke (push) Successful in 0s
CI Smoke / container-smoke (push) Successful in 1s
Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a1046b-5629-7f52-badd-f718eadb6042
2026-10-04 10:59:26 +02:00
codex
7713a45923
Prepare informed-decision workload reader and contained metadata child
...
Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a1046b-5629-7f52-badd-f718eadb6042
2026-10-04 08:59:02 +02:00
codex
1da1c7760f
Prepare October 4 attended window priorities and readiness evidence
...
CI Smoke / host-smoke (push) Successful in 0s
CI Smoke / container-smoke (push) Successful in 1s
Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a1046b-5629-7f52-badd-f718eadb6042
2026-10-04 03:04:42 +02:00
codex
e1caa378cf
Record founder batched attended custody choice
...
CI Smoke / host-smoke (push) Successful in 0s
CI Smoke / container-smoke (push) Successful in 5s
Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a1046b-5629-7f52-badd-f718eadb6042
2026-10-04 03:00:33 +02:00
codex
f5b7ff5118
Implement offline catalog lane scaffold generation
...
CI Smoke / host-smoke (push) Successful in 0s
CI Smoke / container-smoke (push) Successful in 1s
Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a10391-6355-7b41-b0fa-3e14e874f091
2026-10-04 02:24:40 +02:00
codex
46eb8bea9e
Prepare offline attended provisioning checklists and route remaining custody gates
...
CI Smoke / host-smoke (push) Successful in 0s
CI Smoke / container-smoke (push) Successful in 2s
Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a10391-6355-7b41-b0fa-3e14e874f091
2026-10-04 00:27:00 +02:00
codex
2151879c68
docs(custody): close producer delivery with verified provider recovery
...
CI Smoke / host-smoke (push) Successful in 0s
CI Smoke / container-smoke (push) Successful in 2s
Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a1029d-2c93-7500-a0e0-e3e089668b29
2026-10-03 21:59:29 +02:00
codex
33ff82210e
Diagnose attended custody finish failures with safe staged receipts
...
CI Smoke / host-smoke (push) Successful in 0s
CI Smoke / container-smoke (push) Successful in 1s
Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a1029d-2c93-7500-a0e0-e3e089668b29
2026-10-03 21:08:56 +02:00
codex
b8f8a7ada6
Record live custody reader audit and remote history recovery receipts
...
CI Smoke / host-smoke (push) Successful in 0s
CI Smoke / container-smoke (push) Successful in 3s
Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a1029d-2c93-7500-a0e0-e3e089668b29
2026-10-03 20:49:59 +02:00
codex
a252447058
Prove isolated custody recovery and prepare governed offsite finish
...
CI Smoke / host-smoke (push) Successful in 0s
CI Smoke / container-smoke (push) Successful in 1s
Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a1029d-2c93-7500-a0e0-e3e089668b29
2026-10-03 20:47:48 +02:00
codex
dff2d6e9f7
Record verified root reader admission and empty custody publication
...
CI Smoke / host-smoke (push) Successful in 0s
CI Smoke / container-smoke (push) Successful in 1s
Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a1029d-2c93-7500-a0e0-e3e089668b29
2026-10-03 20:24:57 +02:00
codex
790aab025f
evidence: tenant-engine sender seed verified already_identical (exit 0, target v1)
...
CI Smoke / host-smoke (push) Successful in 0s
CI Smoke / container-smoke (push) Successful in 1s
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 3775@bnt-lap001
Assistant-Session: cfacb6a5-ad5b-4f79-ac67-053e3b0d34a3
2026-10-03 08:38:08 +02:00
codex
e60c6fb7ef
evidence: tenant-engine sender seed dry-run (exit 6, target already present at v1; 0 value reads)
...
CI Smoke / host-smoke (push) Successful in 0s
CI Smoke / container-smoke (push) Successful in 1s
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 3775@bnt-lap001
Assistant-Session: cfacb6a5-ad5b-4f79-ac67-053e3b0d34a3
2026-10-03 08:36:24 +02:00
codex
bfa99d2e41
tenant-engine audit-core sender seed: founder approval recorded (MASON-WP-0007-T05)
...
CI Smoke / host-smoke (push) Successful in 0s
CI Smoke / container-smoke (push) Successful in 1s
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 3775@bnt-lap001
Assistant-Session: cfacb6a5-ad5b-4f79-ac67-053e3b0d34a3
2026-10-03 08:35:24 +02:00
codex
e7eb9db57e
CUST-WP-0075: tenant-engine sender seed helper; re-qualify RPF-WP-0035-T02/T08
...
CI Smoke / host-smoke (push) Successful in 0s
CI Smoke / container-smoke (push) Has been cancelled
- scripts/tenant_engine_audit_core_sender_seed.py: silent attended row-7 seed
for MASON-WP-0007-T05 (wrap-migrate technique, CAS 0, never overwrites,
metadata-only --dry-run, documented exit codes), with offline fake-bao tests.
- Lane review doc with the exact founder sequence and the read-only ESO
token-create can-i check for MASON-WP-0007-T06.
- RPF-WP-0035-T02: SECRETS-WP-0007-T04 is done; real blocker is live KeyCape
registration and client custody of secrets-engine-openbao (blocked_on
key-cape). Design stays proposed.
- RPF-WP-0035-T08: receiver rollout with evidence_kind already accepted
2026-09-11; moved the misplaced D1 correction note here from T02.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 3775@bnt-lap001
Assistant-Session: cfacb6a5-ad5b-4f79-ac67-053e3b0d34a3
2026-10-03 08:28:32 +02:00
codex
401765f184
CUST-WP-0075: dedicated core-hub Forgejo read identity CCR draft
...
CI Smoke / host-smoke (push) Successful in 0s
CI Smoke / container-smoke (push) Successful in 1s
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 3775@bnt-lap001
Assistant-Session: cfacb6a5-ad5b-4f79-ac67-053e3b0d34a3
2026-10-03 08:27:56 +02:00
codex
2e02e69c34
Record verified SMTP custody and scoped reader admission
...
CI Smoke / host-smoke (push) Successful in 0s
CI Smoke / container-smoke (push) Successful in 4s
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a0e6f1-443f-7783-9920-a16b2ffc467f
2026-09-28 11:27:00 +02:00
codex
56fcc4c921
Add attended SMTP verification and exact reader admission
...
CI Smoke / host-smoke (push) Successful in 2s
CI Smoke / container-smoke (push) Successful in 4s
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a0e6f1-443f-7783-9920-a16b2ffc467f
2026-09-28 11:21:57 +02:00
codex
3d43a9b1a3
Prepare password-free telemetry SMTP entry for attended custody
...
CI Smoke / host-smoke (push) Successful in 0s
CI Smoke / container-smoke (push) Successful in 1s
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a0e6f1-443f-7783-9920-a16b2ffc467f
2026-09-28 11:11:34 +02:00
codex
2f4485a4b6
Record approved metered requester extension and six native creates
...
CI Smoke / host-smoke (push) Successful in 0s
CI Smoke / container-smoke (push) Successful in 4s
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a0e387-534d-70e3-ad53-4ea05676db8c
2026-09-27 21:08:43 +02:00
codex
b15ab5774f
Prepare exact metered requester extension with scope refusal tests
...
CI Smoke / host-smoke (push) Successful in 1s
CI Smoke / container-smoke (push) Successful in 3s
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a0e387-534d-70e3-ad53-4ea05676db8c
2026-09-27 20:34:52 +02:00
codex
debf981097
Close verified incident task and finish local workplan loose ends
...
CI Smoke / host-smoke (push) Successful in 0s
CI Smoke / container-smoke (push) Successful in 3s
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a0e3c3-621b-7350-9f77-50a8d3ee7657
2026-09-27 19:04:54 +02:00
codex
5781d34b3b
Prepare tenant-zero OpenBao roles and review platform essentials
...
CI Smoke / host-smoke (push) Successful in 0s
CI Smoke / container-smoke (push) Successful in 1s
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a0e324-abce-7e51-bb2b-496f097afdb0
2026-09-27 16:43:32 +02:00
codex
4f20e755c4
Close digest-retention task with verified GitOps runtime projection
...
CI Smoke / host-smoke (push) Successful in 0s
CI Smoke / container-smoke (push) Successful in 3s
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a0e241-8285-7a63-8c0c-51c9cb824dc3
2026-09-27 16:08:17 +02:00
