coulomb/railiance-platform
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
1023 commits 2 branches 0 tags 19 MiB
Commit graph

19 commits

Author SHA1 Message Date
codex
720277bd39 Silence applier-apply under --quiet and drop the retired bao callback default
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details 
The warden attended wrapper refuses any output, so --quiet now captures bao's
own messages and skips the [OK] lines; a failure reports only the step and exit
code. New OIDC scaffolds default to the operator-tunnel UI callback rather than
bao.coulomb.social, which was retired on 2026-09-15. Existing CCRs keep their
lists until amended. The CCR-2026-0033 test pins move to its approved/applied state.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 132360@bnt-lap001
Assistant-Session: 769b1afd-4330-4c86-96b2-e510e26db42b
 2026-10-07 09:16:58 +02:00
codex
26dd803410 Place the ESO audience under serviceAccountRef (ESO v1 schema) 
The server dry run rejected spec.provider.vault.auth.kubernetes.audiences. The
same audience, openbao, now sits under serviceAccountRef, as in openbao-reuse.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 132360@bnt-lap001
Assistant-Session: 769b1afd-4330-4c86-96b2-e510e26db42b
 2026-10-07 02:05:53 +02:00
codex
71607d277c Record founder approval 2ab717e1 on CCR-2026-0033/0034 and the ESO admission
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 2s
Details 
The custody refusal test now checks proposed copies instead of the committed
CCRs, which are approved.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 132360@bnt-lap001
Assistant-Session: 769b1afd-4330-4c86-96b2-e510e26db42b
 2026-10-07 00:25:37 +02:00
codex
4a284f0a3b Revise KeyCape secrets-engine-openbao custody: OpenBao-only, operator reader CCR-2026-0034 (source only)
All checks were successful
CI Smoke / host-smoke (push) Successful in 1s
Details
CI Smoke / container-smoke (push) Successful in 2s
Details 
Founder direction 2026-10-06 and ops-mason plan keycape-secrets-engine-openbao-client-custody
(658cdbc, MASON-WP-0009): the client secret lives only in OpenBao.

- CCR-2026-0033: consumer file and secrets-engine D1-D4 removed; KV metadata declared
  (cas_required, max_versions=2, delete_version_after=0s, custom_metadata); target.domain
  infotech; live order and roll-forward rollback revised; status stays proposed.
- New sibling CCR-2026-0034 + policy: attended OIDC operator reader on auth/netkingdom,
  read data path + revoke-self only, 5m/4 uses, no default policy, bound
  groups=net-kingdom-admins and /assurance/level=aal2 (KeyCape 7d96ee4). Proposed,
  bound claims unconfirmed (founder item for both readers).
- credential-change.py: OIDC roles carry token_max_ttl/explicit_max_ttl/no_default_policy/
  num_uses/type and bound_claims_type (string only); token_revoke_self policy option;
  validated openbao.kv_metadata. Tests added.
- Custody child: consumer write and check-secret-file removed; cas=0 create / --rotate
  cas=<current>; compare-before-write metadata put; refusals unchanged.
- Founder runbook (keycape/founder-runbook.md), window docs, RPF-WP-0035-T09 (waits on A1/A2/A3).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 132360@bnt-lap001
Assistant-Session: 769b1afd-4330-4c86-96b2-e510e26db42b
 2026-10-06 14:26:42 +02:00
codex
df24a77482 Finalize proposed CCR-2026-0033 and its attended custody child (source only).
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details 
Correct the KV path into platform/workloads/, record secrets-engine consumer
coordinates (D1-D4 pending), rotation ownership, live order and rollback, and
add a decision-gated custody child with fake-only tests. Nothing executed.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 132360@bnt-lap001
Assistant-Session: 769b1afd-4330-4c86-96b2-e510e26db42b
 2026-10-06 13:46:12 +02:00
tegwick
4ed39d91d0 Accept native requester delivery proofs and preserve final cutover gate
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a10780-6d41-7952-9718-dfbc1f41236f
 2026-10-04 23:50:18 +02:00
tegwick
f3dbff6a77 Match native proof HTTPS egress to the service ingress peer
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 8s
Details 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a10780-6d41-7952-9718-dfbc1f41236f
 2026-10-04 23:44:47 +02:00
tegwick
6f4b87d44e Align native proof with KeyCape Basic authentication and corrected image
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a10780-6d41-7952-9718-dfbc1f41236f
 2026-10-04 23:42:15 +02:00
tegwick
4db8563eff Prepare bounded native requester and wrong-identity proofs
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 2s
Details 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a10780-6d41-7952-9718-dfbc1f41236f
 2026-10-04 23:32:00 +02:00
tegwick
bbb016f8b6 Record founder approval of exact ESO self-token amendment
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a10780-6d41-7952-9718-dfbc1f41236f
 2026-10-04 23:24:05 +02:00
tegwick
e84b68db01 Record native ESO result and prepare scoped self-token amendment
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a10780-6d41-7952-9718-dfbc1f41236f
 2026-10-04 23:21:55 +02:00
tegwick
4332c391ea Align requester audience projection with installed ESO schema 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a10780-6d41-7952-9718-dfbc1f41236f
 2026-10-04 23:18:33 +02:00
tegwick
f0c9a15235 Handle actual Bao absence response and retain safe attempt phases
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a10780-6d41-7952-9718-dfbc1f41236f
 2026-10-04 23:13:47 +02:00
tegwick
a7bc33b867 Record approved requester delivery and attended execution packet
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a10780-6d41-7952-9718-dfbc1f41236f
 2026-10-04 23:02:28 +02:00
codex
8c7c34e84b Implement issuer reader preparation and qualify blocked owner dependencies
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details 
Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a1046b-5629-7f52-badd-f718eadb6042
 2026-10-04 11:32:13 +02:00
codex
ecbe3b9dd5 Record authorized requester and service identity owner review requests
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 2s
Details 
Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a1046b-5629-7f52-badd-f718eadb6042
 2026-10-04 11:03:41 +02:00
codex
6b91d51039 Record founder requester design approval and retain execution gates
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details 
Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a1046b-5629-7f52-badd-f718eadb6042
 2026-10-04 10:59:26 +02:00
codex
7713a45923 Prepare informed-decision workload reader and contained metadata child 
Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a1046b-5629-7f52-badd-f718eadb6042
 2026-10-04 08:59:02 +02:00
codex
1da1c7760f Prepare October 4 attended window priorities and readiness evidence
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details 
Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a1046b-5629-7f52-badd-f718eadb6042
 2026-10-04 03:04:42 +02:00