railiance-platform/credential-change-requests
codex f3cf832a35
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
CI Smoke / container-smoke (push) Successful in 1s
Declare the security layer, and repair the placement admission check
Layer declaration (gate-house). INTENT.md now carries the declaration in its own
voice with layer.yaml as the machine-readable form, adapted from ops-warden's
reference. railiance-platform is Staff: operating OpenBao is not a claim to the
Tooling layer, because §4 is explicit that no operator-of-third-party-Tooling
shape exists and that someone running it stays a declared gap. Six direct
Tooling contacts are mapped by capability rather than by file — one §5.2
conduit, one §5.1 diagnostic, four §5.3 gaps with intended owners and review
dates — and the uncatalogued contacts are listed so the check is total. We are
PEP-shaped and the unreachable-engine stance map is NOT published; that is
recorded as an open obligation to build against v0.8, not left silent.

Placement admission. canned-prompts was added as a PostgresConsumer on
platform-pg-2 in rapp-postgres 1b68b4c without a placement owner here, which is
exactly the cross-repo drift the assurance check exists to catch; the check had
been failing on it. Registered with its real boundary evidence, corrected the
stale test expectation that pinned the overflow cell at one consumer, and
updated the SCOPE occupancy line to 2/4.

Also records owner input received today: key-cape's issuer view on CCR-2026-0020's
presenting actor, and their confirmation that codex-railiance-platform correctly
stays tenant:coulomb, so the flagged T02 discrepancy is closed as not-a-defect.

The whynot-design npm field is NOT changed. Two dated live receipts here name
NPM_AUTH_TOKEN as the field, including an attended founder fetch; that is
recorded against the counterparty claim rather than either side being flipped
before the session settles it.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WLUjpv3ssxNRAEPPgLFnEB

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 1275505@bnt-lap001
Assistant-Session: 97265baa-f08f-4032-b290-a1e2965a69c5
2026-09-09 23:27:14 +02:00
..
CCR-2026-0001-whynot-design-npm-publish.yaml Close delegated prod applier pilot 2026-07-01 23:34:13 +02:00
CCR-2026-0002-issue-core-ingestion-api-key.yaml RAILIANCE-WP-0009/0010 finished: front doors active; WP-0005 T10 done 2026-07-02 20:54:29 +02:00
CCR-2026-0003-llm-connect-openrouter-api-key.yaml RAILIANCE-WP-0009/0010 finished: front doors active; WP-0005 T10 done 2026-07-02 20:54:29 +02:00
CCR-2026-0004-railiance-backup-offsite-lane.yaml Record verified Backup account activation and consumer refresh 2026-09-05 20:50:26 +02:00
CCR-2026-0005-reuse-surface-runtime-secrets-lane.yaml Close three-lane ESO recovery with live verification and cleanup evidence 2026-09-05 19:00:19 +02:00
CCR-2026-0006-forgejo-admin-api-token-lane.yaml Apply CCR-2026-0006 Forgejo admin PAT lane metadata 2026-07-12 16:07:32 +02:00
CCR-2026-0007-binky-company-email-imap.yaml CCR-2026-0007: activate binky IMAP lane after founder provision 2026-07-17 00:33:20 +02:00
CCR-2026-0008-binky-qonto-api.yaml CCR-2026-0008 active: tenants/binky/qonto-api lane live 2026-07-21 21:42:10 +02:00
CCR-2026-0009-qonto-assistant-workload-kv-read.yaml Close RAILIANCE-WP-0015-T06 rapp credential-lane binding 2026-08-14 00:47:28 +02:00
CCR-2026-0010-email-connect-transactional.yaml Close CCR drift and high-risk policy gaps 2026-08-21 01:29:28 +02:00
CCR-2026-0011-scaleway-object-storage-bootstrap.yaml Close CCR drift and high-risk policy gaps 2026-08-21 01:29:28 +02:00
CCR-2026-0012-backup-object-storage.yaml feat: vend platform-pg-backup-s3 via AppRole ESO 2026-08-14 20:00:15 +02:00
CCR-2026-0013-core-hub-runtime-api-token.yaml Finish Core Hub private shadow onboarding 2026-08-21 00:51:06 +02:00
CCR-2026-0014-policy-nexus-forgejo-source-read.yaml Activate Policy Nexus source credential lane 2026-09-01 01:35:48 +02:00
CCR-2026-0015-state-hub-preflight-signing.yaml Complete live State Hub signing activation and rotation acceptance 2026-09-05 18:12:37 +02:00
CCR-2026-0016-glas-claude-anthropic.yaml docs: link Anthropic custody to native delivery adoption 2026-09-06 00:25:06 +02:00
CCR-2026-0017-keycape-secrets-engine-approval-client.yaml feat: verify live KeyCape custody and preserve versions on resume 2026-09-09 02:18:12 +02:00
CCR-2026-0018-keycape-approval-engine-operator-client.yaml feat: verify live KeyCape custody and preserve versions on resume 2026-09-09 02:18:12 +02:00
CCR-2026-0019-secrets-engine-approval-client-read.yaml Prepare the two approval client-side reader admissions 2026-09-09 14:41:01 +02:00
CCR-2026-0020-approval-engine-operator-client-read.yaml Declare the security layer, and repair the placement admission check 2026-09-09 23:27:14 +02:00