8 commits

Author	SHA1	Message	Date
codex	c921aa0aed	RPF-WP-0054-T03: credential.py generate for keycape-client-secret-generate ... Silent generate-in-custody: verifies the SecurityCase file (digest, type, materialized, confidential, client_id) per ops-warden 23985370, mints the 5m create-only grant token from the caller's session, proves absence, writes once with CAS 0, verifies by metadata only and revokes the token. Agents, root and callers without the issuer policy are refused. Secret length awaits key-cape. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 469992@bnt-lap001 Assistant-Session: e4b8e420-df0a-441d-83ae-7f19130594d9	2026-10-09 20:12:44 +02:00
codex	c9d02147d3	Adopt canonical flex-auth credential checks ... Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a02e56-e4ad-71a2-b3e2-b6193e0d8093	2026-08-23 14:03:40 +02:00
codex	9f6bdffec4	Broker audit-core dynamic database credentials	2026-08-10 19:36:30 +02:00
tegwick	b38b8c1f7f	Send workplan_id only on State Hub progress metadata posts	2026-07-09 00:32:54 +02:00
tegwick	9cbf64ebee	CUST-WP-0055 T05: add State Hub workplan_id scope to credential broker ... Accept --state-hub-workplan-id / STATE_HUB_WORKPLAN_ID and dual-write workplan_id plus legacy workstream_id on progress events.	2026-07-08 20:00:35 +02:00
tegwick	8321e14b46	Unblock credential broker warden-sign pilot	2026-07-01 23:10:38 +02:00
tegwick	673ec46e25	feat: complete credential broker source flow	2026-06-27 00:29:53 +02:00
tegwick	752cfd6f00	feat: add credential broker token helper	2026-06-27 00:06:03 +02:00