OpenBao 2.5.4 applies required_parameters to reads, so the executor could not
read the version it must name for CAS (net-kingdom NK-WP-0056-T12 synthetic
pilot). cas_required on the key still refuses writes without options.cas;
metadata, delete, sibling and new paths stay denied (tested). Renderer, test
and policy file corrected.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 994874@bnt-lap001
Assistant-Session: 6017c416-d619-47eb-bd1a-f670a02d7d87
Owner answer for the bounded executor (hub 9d08288d): one Kubernetes role per
lane for sso/nk-bind-executor; new contract-only request type for a CAS
next-version write (no create, metadata or delete, 15m, agents fenced);
CCR-2026-0058 drafted as proposed, not approved; audit sender in the
CCR-2026-0021/0022 shape once audit-core admits it.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 994874@bnt-lap001
Assistant-Session: 6017c416-d619-47eb-bd1a-f670a02d7d87
