The attended platform-admin login timed out before the gate ran, so the live policy, workload pair, and delivery admission are unchanged.
Assistant: grok
Assistant-Session: 01a198fa-fd27-7e41-a0a2-57355c3e4efd
CCR-2026-0062 names the prefix reader for platform-pg/application-archives/mas/.
It is not approved, and this change creates no IAM application, OpenBao value,
ServiceAccount, or node file.
Assistant: grok
Assistant-Session: 01a198fa-fd27-7e41-a0a2-57355c3e4efd
The founder acknowledged oidc-service-client 0.2 on 2026-11-01 (memo r2, hub
decision f8044f81, net-kingdom 9ce0d60), meeting the RPF-WP-0060-T01 rule
from review R1. keycape_client_secret_generate.py pins the 0.2 type bytes,
keys parameter pins by exact type reference, and derives confidentiality per
type: browser 1.1 keeps its client_type check, the service type is
confidential by construction (no client_type, unconditional custody path);
a service case carrying client_type is refused. Create-only is unchanged.
Eleven new tests; the existing browser tests are unchanged apart from the
re-keyed pin. CCR-2026-0060/0061 match the 0.2 materialization; references
updated, still proposed. T09 (wait) tracks their approval and apply.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 5502@bnt-lap001
Assistant-Session: 68b3b02f-5d0f-4e71-8421-796f62e50196
Review of net-kingdom's proposed SecurityCaseType oidc-service-client 0.1
(hub message 4ec57765): mint grant covers the keycape/<client_id> family but
the broker does not admit the type yet (R1); consumer role shape consistent
(R2); ESO bodies, consumer role name and rotation text need a type r2
(R3-R5, R7); per-case CCRs required (R6), drafted for nk-bind-executor-approval.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 5502@bnt-lap001
Assistant-Session: 68b3b02f-5d0f-4e71-8421-796f62e50196
workload-kv-read for platform/workloads/net-kingdom/synthetic-journey/syn-journey:
read on the data path only, own role bound to sso/nk-bind-executor (audience
openbao, 15m), separate from the CCR-2026-0058 write role. Widens
CCR-2026-0057 runtime_access (stated). Standing reader proposed; founder
decides. RPF-WP-0069-T04 updated. Not approved, not applied.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 5502@bnt-lap001
Assistant-Session: 68b3b02f-5d0f-4e71-8421-796f62e50196
OpenBao 2.5.4 applies required_parameters to reads, so the executor could not
read the version it must name for CAS (net-kingdom NK-WP-0056-T12 synthetic
pilot). cas_required on the key still refuses writes without options.cas;
metadata, delete, sibling and new paths stay denied (tested). Renderer, test
and policy file corrected.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 994874@bnt-lap001
Assistant-Session: 6017c416-d619-47eb-bd1a-f670a02d7d87
Owner answer for the bounded executor (hub 9d08288d): one Kubernetes role per
lane for sso/nk-bind-executor; new contract-only request type for a CAS
next-version write (no create, metadata or delete, 15m, agents fenced);
CCR-2026-0058 drafted as proposed, not approved; audit sender in the
CCR-2026-0021/0022 shape once audit-core admits it.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 994874@bnt-lap001
Assistant-Session: 6017c416-d619-47eb-bd1a-f670a02d7d87
Third NK-WP-0056-T04 lane. ESO owns a dedicated Secret sso/keycape-lldap-bind
read by KeyCape as KEYCAPE_LLDAP_BIND_PW (key-cape KEY-WP-0046). Binding
unconfirmed; apply blocked until owner approval and confirm-binding.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 896183@bnt-lap001
Assistant-Session: 3a18c01a-3205-4d02-94db-9efff25649a2
Second NK-WP-0056-T04 lane after the svc-provisioner pilot (CCR-2026-0052): read-only
reader for platform/workloads/net-kingdom/directory-binds/svc-authelia, ESO Merge of
ldap_password only into sso/authelia-secrets. Binding unconfirmed; apply stays blocked
until owner approval and confirm-binding.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 896183@bnt-lap001
Assistant-Session: 3a18c01a-3205-4d02-94db-9efff25649a2
Requested by net-kingdom NK-WP-0056-T04. Read-only lane, CAS=0 first write from current
live value, Merge into existing sso/identity-provisioner-ldap. Nothing applied.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 673304@bnt-lap001
Assistant-Session: 959b12c7-cf2e-440b-a60d-91229cc9e96e
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 306568@bnt-lap001
Assistant-Session: 8bdf8150-ea56-41e7-9132-13f04f6b0b91
credential-change.py generates sys/capabilities-self (update) when
openbao.token_capabilities_self is true. Proposed CCR-2026-0045 sets it
for workload-kv-read-reuse-surface-runtime so the ops-mason proof stops
calling sys/capabilities with a root token. The OpenBao login page keeps
its platform-admin button and adds an allow-listed workload role choice.
Repo only; nothing applied to OpenBao or the cluster.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 1041694@bnt-lap001
Assistant-Session: 7af0bb68-ac4a-4ce3-8639-24ddd84c0b52
Founder approval covers platform-operator and reuse-surface-owner. The policy file gains lookup-self and revoke-self. No KV write.
Assistant: grok
Assistant-Session: 01a13b2d-5f6d-7a32-b2c9-384625c55ca6
CCR-2026-0043 applied cleanly, but generate could not mint the grant token
(OpenBao refuses child tokens from a limited-use token; the role had
token_num_uses 8) and revoke-self was denied (missing from the issuer
policy). The role now uses 0, which the validator requires, and the issuer
policy grants revoke-self. Nothing was written by the probe.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 469992@bnt-lap001
Assistant-Session: e4b8e420-df0a-441d-83ae-7f19130594d9
From ops-mason SecurityCase forgejo-netkingdom-oidc (MASON-WP-0010-T03, render
sha256:fb8b114d...). Policies regenerated from the CCRs: the case render
omitted the lookup-self/revoke-self stanzas that token_self_lifecycle
requires. CCR-0042 stays in_flight until railiance-apps binds forgejo's reader.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 469992@bnt-lap001
Assistant-Session: e4b8e420-df0a-441d-83ae-7f19130594d9
- New CCR request type custody-generate-grant (scripts/broker_grant_lane.py):
grant policy (create on keycape/+ data, read on metadata, deny on reserved
entries, revoke-self; no update, data read, metadata write, list or
delete), broker issuer policy and a 5m orphan non-renewable token role,
with readback. Binds no identity, so the apply is inert until T01.
- CCR-2026-0040 (proposed), catalog grant (pilot, approval-required,
exec-env only), generated policies, tests.
- T03 drops custom_metadata: a metadata write would also allow changing
other entries' version settings.
- test_operator_matrix_lane follows CCR-2026-0039 now being applied.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 469992@bnt-lap001
Assistant-Session: e4b8e420-df0a-441d-83ae-7f19130594d9
- New CCR request type workload-kv-operator-matrix (scripts/operator_matrix_lane.py):
exact per-entry create/read/update, OIDC role on the existing netkingdom mount,
and exact agent denies appended to the live agent-high-risk-boundary (live
content preserved, partial presence refused). credential-change.py now
dispatches lane request types through one module table.
- CCR-2026-0039 (proposed): hall-of-helix four-entry matrix at tenant coulomb
per the founder ruling of 2026-10-09; policy, role and overlay sources.
- scripts/fluid_telegram_custody_move.py: silent CAS-0 move of the four
undocumented infotech entries, deleting sources only after all verify.
- scripts/kv_duplicate_retire.py: silent retirement of
activity-core/default/llm-connect-provider-secrets once no live non-admin
policy grants it.
- Founder session commands recorded in the T03 note.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 469992@bnt-lap001
Assistant-Session: e4b8e420-df0a-441d-83ae-7f19130594d9
Package the reviewed keycape-services JWT mount, secrets-engine-openbao role
and secrets-engine-login-self policy as CCR-2026-0038 and teach the delegated
applier a narrow service-jwt-login request type: fixed mount, generated
login-self policy, allow-listed role/config keys, bounded TTL/uses, refusal on
a foreign mount type and a value-free readback compare. The policy now denies
the client-secret data/metadata paths explicitly (MASON-WP-0009 invariant ii).
Proposed only; founder approval and delegated apply pending.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 327203@bnt-lap001
Assistant-Session: 55028ae3-4914-4bd1-8f5c-815f3527aef0
The OpenBao policy matches the reviewed file. Both publisher KV paths are still empty because the bootstrap key cannot create IAM applications.
Assistant: grok
Assistant-Session: 01a11cdb-f9fe-7011-947c-936e72007e54
The helper previews delivery with no OpenBao or node effect and refuses execution while the CCRs stay draft. Policies are read-only on each workload path. No provider key is included.
Assistant: grok
Assistant-Session: 01a11cdb-f9fe-7011-947c-936e72007e54
ESO validates a store with auth/token/lookup-self, and the role drops the
default policy, so the applied store failed with 403. Adds lookup-self and
revoke-self on the reader's own token, as in CCR-2026-0005 and the
keycape-factor-read lane. Needs founder approval before re-apply.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 132360@bnt-lap001
Assistant-Session: 769b1afd-4330-4c86-96b2-e510e26db42b
Correct the KV path into platform/workloads/, record secrets-engine consumer
coordinates (D1-D4 pending), rotation ownership, live order and rollback, and
add a decision-gated custody child with fake-only tests. Nothing executed.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 132360@bnt-lap001
Assistant-Session: 769b1afd-4330-4c86-96b2-e510e26db42b
Matches the policy-nexus entries; ops-warden now lists the path as high-risk
(catalog 2f8387c, generated paths f1e25c3). make agent-high-risk-boundary-check: ok.
Live apply needs an attended platform-admin session.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 3775@bnt-lap001
Assistant-Session: cfacb6a5-ad5b-4f79-ac67-053e3b0d34a3
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 3775@bnt-lap001
Assistant-Session: cfacb6a5-ad5b-4f79-ac67-053e3b0d34a3
ACTIVITY-WP-0039-T02. Add read on the two exact worker-token paths to
workload-kv-read-activity-core-eso, one CCR per worker identity. Adds
scripts/openbao-policy-sync.sh, a silent attended policy writer that refuses
undeclared live drift and verifies on readback. Not applied; CCRs await
platform-operator and activity-core-owner approval.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 150322@bnt-lap001
Assistant-Session: 16a7b788-374e-4915-a1df-fc87ffd9a5e4
Answers the-custodian 641673a4. An attended read-only check (receipt
docs/evidence/2026-09-23-openbao-platform-admin-check.json) found:
- live platform-admin policy = repo file + reins/* (ops-mason, 2026-07-27);
repo now matches live (sha256 0ca5b821...). No live write.
- role also attaches operator-custody (undeclared); declared here.
- role declared as openbao/auth/netkingdom-platform-admin-role.json.
- default policy is attached and grants revoke-self/lookup-self, so the
suspected missing grant is not the cause of warden's unconfirmed revocation.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 150322@bnt-lap001
Assistant-Session: 16a7b788-374e-4915-a1df-fc87ffd9a5e4
Declares target store specs, two exact-path policies and two ESO
ServiceAccounts. Nothing applied; live steps wait on the founder.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 63291@bnt-lap001
Assistant-Session: 8bd77868-ca68-4f49-bb1e-d539ecc0d703
CCR-2026-0026/0027 are proposed source only: new KV path, no apply,
and no widening of 0024/0025. Record destroy-after-confirm for the
npm duplicate, coordinated 0018 disablement, blocked historical
NetKingdom paths, and no Forgejo retention cutover.
Assistant: grok
Assistant-Session: 01a0a23b-3bf0-7341-b4e5-9dc05f72573a
RPF-WP-0035-T06. Adds CCR-2026-0019 (secrets-engine) and CCR-2026-0020
(approval-engine-operator) with their exact-path read policies, reusing the
existing version-1 custody from the verifier activation. No reseed, rotation,
shared reader or verifier Secret reuse; both requests are in_flight and nothing
is applied.
The two shapes were decided by read-only survey rather than assumed.
secrets-engine consumes its client secret through an operator-run CLI reading a
protected file, and its namespace holds no workload, so reader 1 is an attended
operator-workstation OIDC lane rather than an ESO lane; its one missing input is
the operator group claim, which NetKingdom and KeyCape own. approval-engine is
not deployed and no owner source names who presents the operator client, so
reader 2 records the undetermined actor instead of guessing one for the widest
approval scope in the pair. Both declare openbao.auth missing rather than
carrying a placeholder binding.
T06 moves to wait on those two owner inputs.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WLUjpv3ssxNRAEPPgLFnEB
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 1275505@bnt-lap001
Assistant-Session: 97265baa-f08f-4032-b290-a1e2965a69c5
Answers KEY-WP-0013-T02. Both proposed KV paths are confirmed unchanged; the
field name is corrected to CLIENT_SECRET for the platform uppercase convention
and the CCR validator. Kubernetes delivery references are confirmed against the
live sso namespace. Attended authority is the governed openbao-platform-admin-login
lane, and the rollout is one attended window ordered after the Authelia issuer
precondition.
Adds CCR-2026-0017/0018, two exact-path read policies, two namespace-limited
ClusterSecretStores with Kubernetes auth, two ExternalSecrets, and RPF-WP-0035-T05.
Nothing is applied and no value exists: both CCRs remain proposed.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WLUjpv3ssxNRAEPPgLFnEB
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 1275505@bnt-lap001
Assistant-Session: 97265baa-f08f-4032-b290-a1e2965a69c5
