key-cape 82b471f (founder decision 2026-11-01) adds approval:read to
informed-decision-sitting-requester. provision-sitting-requester.py contract()
now requires exactly [approval:create, approval:read] and still refuses
consume, approve and openid. The one-shot helper refuses to re-run once its
2026-09-15 receipt is applied, before it could overwrite that evidence, and
names keycape-client.py remove-then-add. Tests updated. CCR-2026-0026/0027:
text-only amendment_proposed; custody, policy, role and delivery unchanged,
so no new CCR and status stays applied.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 5502@bnt-lap001
Assistant-Session: 68b3b02f-5d0f-4e71-8421-796f62e50196
The reader login succeeded; the child died at preflight. Use bao for the
KV read, accept parent/sibling deny shapes, and record a failure class.
Assistant: grok
Assistant-Session: 01a0a23b-3bf0-7341-b4e5-9dc05f72573a
Reader lane login, sibling-path denial, and KeyCape exchange checks.
No sitting POST. Attended wrapper selects the exact OIDC reader role.
Assistant: grok
Assistant-Session: 01a0a23b-3bf0-7341-b4e5-9dc05f72573a
CCR-2026-0026/0027 are approved for the create-only informed-decision
client. Live KeyCape registration and CAS=0 custody stay in the
contained helper; no sitting POST.
Assistant: grok
Assistant-Session: 01a0a23b-3bf0-7341-b4e5-9dc05f72573a
