2 commits

Author	SHA1	Message	Date
codex	69530053ab	auth-role-presence-watch: dry-run policy_write carries source and body; approve state-hub summary tolerates non-KV CCRs ... The founder's applier-dry-run of CCR-2026-0064 crashed (KeyError 'source') in render_applier_dry_run. New test renders the dry run and the apply plan through the CLI. The --record-state-hub summary of approve no longer assumes openbao.fields, which lane CCRs without a KV path do not have. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 943911@bnt-lap001 Assistant-Session: fc322940-1c8e-4bed-ab39-86cec99f23a0	2026-11-06 10:20:04 +01:00
codex	b1421317e7	CCR-2026-0064 (proposed): read-only window watch for the CCR-2026-0058 write role (net-kingdom NK-WP-0058-T06) ... New request type auth-role-presence-watch (scripts/auth_role_watch_lane.py, registered in LANE_MODULES): a Kubernetes-auth role for sso/nk-window-watch whose policy is generated from the CCR - read (mode flag) or read and delete (mode close) on exactly one watched role path, plus token self-lifecycle. Validator refuses any widening; apply writes policy and role and reads both back; tests with a fake bao. Drafted by net-kingdom on the founder's instruction for platform-owner review. Mode flag; not approved. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 943911@bnt-lap001 Assistant-Session: fc322940-1c8e-4bed-ab39-86cec99f23a0	2026-11-06 08:55:09 +01:00