Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 469992@bnt-lap001
Assistant-Session: e4b8e420-df0a-441d-83ae-7f19130594d9
Updated by fix-consistency on 2026-10-10:
- update .custodian-brief.md for railiance-platform
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 469992@bnt-lap001
Assistant-Session: e4b8e420-df0a-441d-83ae-7f19130594d9
Founder run: entry (2 versions) deleted, operators/nextcloud/backup
unchanged, one-shot token revoked and policy deleted, no value read.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 469992@bnt-lap001
Assistant-Session: e4b8e420-df0a-441d-83ae-7f19130594d9
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 469992@bnt-lap001
Assistant-Session: e4b8e420-df0a-441d-83ae-7f19130594d9
Updated by fix-consistency on 2026-10-10:
- update .custodian-brief.md for railiance-platform
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 469992@bnt-lap001
Assistant-Session: e4b8e420-df0a-441d-83ae-7f19130594d9
The founder confirmed operators/nextcloud (not /backup) is deprecated. The
operators mount is deliberately delete-free for operator-custody and absent
from platform-admin, so a silent helper performs the deletion with a one-shot
policy and a 60s orphan token scoped to that entry. It verifies the backup
sibling is unchanged and removes the token and policy afterwards.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 469992@bnt-lap001
Assistant-Session: e4b8e420-df0a-441d-83ae-7f19130594d9
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 469992@bnt-lap001
Assistant-Session: e4b8e420-df0a-441d-83ae-7f19130594d9
Updated by fix-consistency on 2026-10-10:
- update .custodian-brief.md for railiance-platform
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 469992@bnt-lap001
Assistant-Session: e4b8e420-df0a-441d-83ae-7f19130594d9
- RPF-WP-0054-T06 done (ops-warden activated keycape-client-secret-generate);
the workplan is active with only the deferred rotation task left.
- RPF-WP-0035-T02: no-fallback check passed (secrets-engine 9ec4e0b); claim
refusals wait on the KEY-WP-0039 probe session.
- RPF-WP-0035-T10: key-cape agreed the amended platform steps.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 469992@bnt-lap001
Assistant-Session: e4b8e420-df0a-441d-83ae-7f19130594d9
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 469992@bnt-lap001
Assistant-Session: e4b8e420-df0a-441d-83ae-7f19130594d9
Updated by fix-consistency on 2026-10-10:
- update .custodian-brief.md for railiance-platform
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 469992@bnt-lap001
Assistant-Session: e4b8e420-df0a-441d-83ae-7f19130594d9
key-cape 7f2128fb proposes a joint disablement of CCR-2026-0018. Platform
amends its steps: retire the ClusterSecretStore, the OpenBao k8s role and
policy along with the ExternalSecret (pinned app, attended prune sync after
KeyCape's env removal, verify the owned Secret is gone), then metadata-delete
the custody path after the invalid_client receipt.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 469992@bnt-lap001
Assistant-Session: e4b8e420-df0a-441d-83ae-7f19130594d9
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 469992@bnt-lap001
Assistant-Session: e4b8e420-df0a-441d-83ae-7f19130594d9
Updated by fix-consistency on 2026-10-10:
- update .custodian-brief.md for railiance-platform
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 469992@bnt-lap001
Assistant-Session: e4b8e420-df0a-441d-83ae-7f19130594d9
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 469992@bnt-lap001
Assistant-Session: e4b8e420-df0a-441d-83ae-7f19130594d9
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 469992@bnt-lap001
Assistant-Session: e4b8e420-df0a-441d-83ae-7f19130594d9
Updated by fix-consistency on 2026-10-10:
- update .custodian-brief.md for railiance-platform
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 469992@bnt-lap001
Assistant-Session: e4b8e420-df0a-441d-83ae-7f19130594d9
- CCR-2026-0040/0043 re-applied 2026-10-10T09:15Z. Probe: generated v1, a
second run refused (already_present), tokens revoked, no value read,
probe entry deleted. Receipts in docs/evidence.
- CCR-2026-0038: login proof passed (secrets-engine a963a77); the consumer
contract is published at docs/contracts/secrets-engine-openbao-jwt-login.yaml.
RPF-WP-0035-T02 still waits on the negative claim checks.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 469992@bnt-lap001
Assistant-Session: e4b8e420-df0a-441d-83ae-7f19130594d9
CCR-2026-0043 applied cleanly, but generate could not mint the grant token
(OpenBao refuses child tokens from a limited-use token; the role had
token_num_uses 8) and revoke-self was denied (missing from the issuer
policy). The role now uses 0, which the validator requires, and the issuer
policy grants revoke-self. Nothing was written by the probe.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 469992@bnt-lap001
Assistant-Session: e4b8e420-df0a-441d-83ae-7f19130594d9
New CCR request type broker-issuer-binding: an OIDC role on netkingdom that
carries only the broker issuer policy (loopback callbacks, 15m, 8 uses, no
default policy); the apply refuses unless the live issuer policy matches
source. Founder chose net-kingdom-admins + aal2 on 2026-10-10.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 469992@bnt-lap001
Assistant-Session: e4b8e420-df0a-441d-83ae-7f19130594d9
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 469992@bnt-lap001
Assistant-Session: e4b8e420-df0a-441d-83ae-7f19130594d9
Updated by fix-consistency on 2026-10-09:
- update .custodian-brief.md for railiance-platform
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 469992@bnt-lap001
Assistant-Session: e4b8e420-df0a-441d-83ae-7f19130594d9
Silent generate-in-custody: verifies the SecurityCase file (digest, type,
materialized, confidential, client_id) per ops-warden 23985370, mints the 5m
create-only grant token from the caller's session, proves absence, writes once
with CAS 0, verifies by metadata only and revokes the token. Agents, root and
callers without the issuer policy are refused. Secret length awaits key-cape.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 469992@bnt-lap001
Assistant-Session: e4b8e420-df0a-441d-83ae-7f19130594d9
Policy workload-kv-read-keycape-forgejo-eso and Kubernetes role
external-secrets-keycape-forgejo applied 2026-10-09T18:09Z. Inert until
mint-secret creates platform/workloads/keycape/forgejo (RPF-WP-0054).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 469992@bnt-lap001
Assistant-Session: e4b8e420-df0a-441d-83ae-7f19130594d9
From ops-mason SecurityCase forgejo-netkingdom-oidc (MASON-WP-0010-T03, render
sha256:fb8b114d...). Policies regenerated from the CCRs: the case render
omitted the lookup-self/revoke-self stanzas that token_self_lifecycle
requires. CCR-0042 stays in_flight until railiance-apps binds forgejo's reader.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 469992@bnt-lap001
Assistant-Session: e4b8e420-df0a-441d-83ae-7f19130594d9
secrets-engine a9ecbd6b: the contract file was promised only after the proof,
which needs it. The founder may write a non-secret probe input from the
applied values; platform publishes or confirms the contract after the proof.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 469992@bnt-lap001
Assistant-Session: e4b8e420-df0a-441d-83ae-7f19130594d9
The founder apply wrote and read back both policies and the token role, then
record_evidence_state_hub raised KeyError on openbao.auth (custody-generate-grant
has kv_prefix, no auth), printing a traceback that made warden revoke the
session. The summary now falls back across kv_path, kv_prefix, campaign_path
and auth.mount. The missed hub event was posted afterwards.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 469992@bnt-lap001
Assistant-Session: e4b8e420-df0a-441d-83ae-7f19130594d9
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 469992@bnt-lap001
Assistant-Session: e4b8e420-df0a-441d-83ae-7f19130594d9
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 469992@bnt-lap001
Assistant-Session: e4b8e420-df0a-441d-83ae-7f19130594d9
- New CCR request type custody-generate-grant (scripts/broker_grant_lane.py):
grant policy (create on keycape/+ data, read on metadata, deny on reserved
entries, revoke-self; no update, data read, metadata write, list or
delete), broker issuer policy and a 5m orphan non-renewable token role,
with readback. Binds no identity, so the apply is inert until T01.
- CCR-2026-0040 (proposed), catalog grant (pilot, approval-required,
exec-env only), generated policies, tests.
- T03 drops custom_metadata: a metadata write would also allow changing
other entries' version settings.
- test_operator_matrix_lane follows CCR-2026-0039 now being applied.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 469992@bnt-lap001
Assistant-Session: e4b8e420-df0a-441d-83ae-7f19130594d9
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 469992@bnt-lap001
Assistant-Session: e4b8e420-df0a-441d-83ae-7f19130594d9
