credential-change.py generates sys/capabilities-self (update) when
openbao.token_capabilities_self is true. Proposed CCR-2026-0045 sets it
for workload-kv-read-reuse-surface-runtime so the ops-mason proof stops
calling sys/capabilities with a root token. The OpenBao login page keeps
its platform-admin button and adds an allow-listed workload role choice.
Repo only; nothing applied to OpenBao or the cluster.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 1041694@bnt-lap001
Assistant-Session: 7af0bb68-ac4a-4ce3-8639-24ddd84c0b52
The delegated applier wrote the caller policy and auth/netkingdom role. No secret value was read or written.
Assistant: grok
Assistant-Session: 01a13b2d-5f6d-7a32-b2c9-384625c55ca6
Founder approval covers platform-operator and reuse-surface-owner. The policy file gains lookup-self and revoke-self. No KV write.
Assistant: grok
Assistant-Session: 01a13b2d-5f6d-7a32-b2c9-384625c55ca6
Copied from ops-mason fd2c5a5 for MASON-WP-0011. Not approved or applied.
bound_claims_confirmed stays false, the caller policy file is unchanged,
and no KV write or platform-admin binding is authorized.
Assistant: grok
Assistant-Session: 01a13b3e-0402-7a83-a827-6b29197b7132
- CCR-2026-0040/0043 re-applied 2026-10-10T09:15Z. Probe: generated v1, a
second run refused (already_present), tokens revoked, no value read,
probe entry deleted. Receipts in docs/evidence.
- CCR-2026-0038: login proof passed (secrets-engine a963a77); the consumer
contract is published at docs/contracts/secrets-engine-openbao-jwt-login.yaml.
RPF-WP-0035-T02 still waits on the negative claim checks.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 469992@bnt-lap001
Assistant-Session: e4b8e420-df0a-441d-83ae-7f19130594d9
CCR-2026-0043 applied cleanly, but generate could not mint the grant token
(OpenBao refuses child tokens from a limited-use token; the role had
token_num_uses 8) and revoke-self was denied (missing from the issuer
policy). The role now uses 0, which the validator requires, and the issuer
policy grants revoke-self. Nothing was written by the probe.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 469992@bnt-lap001
Assistant-Session: e4b8e420-df0a-441d-83ae-7f19130594d9
New CCR request type broker-issuer-binding: an OIDC role on netkingdom that
carries only the broker issuer policy (loopback callbacks, 15m, 8 uses, no
default policy); the apply refuses unless the live issuer policy matches
source. Founder chose net-kingdom-admins + aal2 on 2026-10-10.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 469992@bnt-lap001
Assistant-Session: e4b8e420-df0a-441d-83ae-7f19130594d9
Policy workload-kv-read-keycape-forgejo-eso and Kubernetes role
external-secrets-keycape-forgejo applied 2026-10-09T18:09Z. Inert until
mint-secret creates platform/workloads/keycape/forgejo (RPF-WP-0054).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 469992@bnt-lap001
Assistant-Session: e4b8e420-df0a-441d-83ae-7f19130594d9
From ops-mason SecurityCase forgejo-netkingdom-oidc (MASON-WP-0010-T03, render
sha256:fb8b114d...). Policies regenerated from the CCRs: the case render
omitted the lookup-self/revoke-self stanzas that token_self_lifecycle
requires. CCR-0042 stays in_flight until railiance-apps binds forgejo's reader.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 469992@bnt-lap001
Assistant-Session: e4b8e420-df0a-441d-83ae-7f19130594d9
secrets-engine a9ecbd6b: the contract file was promised only after the proof,
which needs it. The founder may write a non-secret probe input from the
applied values; platform publishes or confirms the contract after the proof.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 469992@bnt-lap001
Assistant-Session: e4b8e420-df0a-441d-83ae-7f19130594d9
The founder apply wrote and read back both policies and the token role, then
record_evidence_state_hub raised KeyError on openbao.auth (custody-generate-grant
has kv_prefix, no auth), printing a traceback that made warden revoke the
session. The summary now falls back across kv_path, kv_prefix, campaign_path
and auth.mount. The missed hub event was posted afterwards.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 469992@bnt-lap001
Assistant-Session: e4b8e420-df0a-441d-83ae-7f19130594d9
- New CCR request type custody-generate-grant (scripts/broker_grant_lane.py):
grant policy (create on keycape/+ data, read on metadata, deny on reserved
entries, revoke-self; no update, data read, metadata write, list or
delete), broker issuer policy and a 5m orphan non-renewable token role,
with readback. Binds no identity, so the apply is inert until T01.
- CCR-2026-0040 (proposed), catalog grant (pilot, approval-required,
exec-env only), generated policies, tests.
- T03 drops custom_metadata: a metadata write would also allow changing
other entries' version settings.
- test_operator_matrix_lane follows CCR-2026-0039 now being applied.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 469992@bnt-lap001
Assistant-Session: e4b8e420-df0a-441d-83ae-7f19130594d9
CCR-2026-0039 applied 2026-10-09T10:30Z with matching readback. The four
hall-of-helix entries moved from infotech to coulomb (v1 each; infotech
deleted). activity-core/default/llm-connect-provider-secrets retired. T03 now
waits on ops-mason verification and the owner salt CAS probe.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 469992@bnt-lap001
Assistant-Session: e4b8e420-df0a-441d-83ae-7f19130594d9
- New CCR request type workload-kv-operator-matrix (scripts/operator_matrix_lane.py):
exact per-entry create/read/update, OIDC role on the existing netkingdom mount,
and exact agent denies appended to the live agent-high-risk-boundary (live
content preserved, partial presence refused). credential-change.py now
dispatches lane request types through one module table.
- CCR-2026-0039 (proposed): hall-of-helix four-entry matrix at tenant coulomb
per the founder ruling of 2026-10-09; policy, role and overlay sources.
- scripts/fluid_telegram_custody_move.py: silent CAS-0 move of the four
undocumented infotech entries, deleting sources only after all verify.
- scripts/kv_duplicate_retire.py: silent retirement of
activity-core/default/llm-connect-provider-secrets once no live non-admin
policy grants it.
- Founder session commands recorded in the T03 note.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 469992@bnt-lap001
Assistant-Session: e4b8e420-df0a-441d-83ae-7f19130594d9
Service-JWT login lane (mount keycape-services, role secrets-engine-openbao,
policy secrets-engine-login-self) applied 2026-10-08T22:42Z with matching
readback. T02 now waits only on the live login proof (SECRETS-WP-0012-T03).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 469992@bnt-lap001
Assistant-Session: e4b8e420-df0a-441d-83ae-7f19130594d9
Package the reviewed keycape-services JWT mount, secrets-engine-openbao role
and secrets-engine-login-self policy as CCR-2026-0038 and teach the delegated
applier a narrow service-jwt-login request type: fixed mount, generated
login-self policy, allow-listed role/config keys, bounded TTL/uses, refusal on
a foreign mount type and a value-free readback compare. The policy now denies
the client-secret data/metadata paths explicitly (MASON-WP-0009 invariant ii).
Proposed only; founder approval and delegated apply pending.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 327203@bnt-lap001
Assistant-Session: 55028ae3-4914-4bd1-8f5c-815f3527aef0
Record founder acceptance on CCR-2026-0036 and CCR-2026-0037, install the reader roles, and admit only the email-connect node delivery. Treat a missing OpenBao token period as non-periodic.
Assistant: grok
Assistant-Session: 01a11cdb-f9fe-7011-947c-936e72007e54
Both CCRs stay draft and contain field names only. No provider key is included.
Assistant: grok
Assistant-Session: 01a11cdb-f9fe-7011-947c-936e72007e54
bao.coulomb.social was retired on 2026-09-15. Each OIDC role keeps only the
loopback CLI callbacks. Needs founder approval before the re-apply.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 132360@bnt-lap001
Assistant-Session: 769b1afd-4330-4c86-96b2-e510e26db42b
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 132360@bnt-lap001
Assistant-Session: 769b1afd-4330-4c86-96b2-e510e26db42b
ESO validates a store with auth/token/lookup-self, and the role drops the
default policy, so the applied store failed with 403. Adds lookup-self and
revoke-self on the reader's own token, as in CCR-2026-0005 and the
keycape-factor-read lane. Needs founder approval before re-apply.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 132360@bnt-lap001
Assistant-Session: 769b1afd-4330-4c86-96b2-e510e26db42b
Founder-run applier, 2026-10-07T00:03Z, result passed. No secret value read or
written. The applier also reflowed the YAML.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 132360@bnt-lap001
Assistant-Session: 769b1afd-4330-4c86-96b2-e510e26db42b
The custody refusal test now checks proposed copies instead of the committed
CCRs, which are approved.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 132360@bnt-lap001
Assistant-Session: 769b1afd-4330-4c86-96b2-e510e26db42b
Correct the KV path into platform/workloads/, record secrets-engine consumer
coordinates (D1-D4 pending), rotation ownership, live order and rollback, and
add a decision-gated custody child with fake-only tests. Nothing executed.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 132360@bnt-lap001
Assistant-Session: 769b1afd-4330-4c86-96b2-e510e26db42b
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 3775@bnt-lap001
Assistant-Session: cfacb6a5-ad5b-4f79-ac67-053e3b0d34a3
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 3775@bnt-lap001
Assistant-Session: cfacb6a5-ad5b-4f79-ac67-053e3b0d34a3
