codex 53e91ab2d2 Propose token self-lifecycle for the CCR-2026-0033 ESO reader ... ESO validates a store with auth/token/lookup-self, and the role drops the default policy, so the applied store failed with 403. Adds lookup-self and revoke-self on the reader's own token, as in CCR-2026-0005 and the keycape-factor-read lane. Needs founder approval before re-apply. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 132360@bnt-lap001 Assistant-Session: 769b1afd-4330-4c86-96b2-e510e26db42b		2026-10-07 02:08:40 +02:00
..
auth	Implement issuer reader preparation and qualify blocked owner dependencies	2026-10-04 11:32:13 +02:00
eso-auth-recovery	RPF-WP-0045: plan Kubernetes-auth migration for openbao-activity-core and openbao-email-connect	2026-09-21 19:18:59 +02:00
policies	Propose token self-lifecycle for the CCR-2026-0033 ESO reader	2026-10-07 02:08:40 +02:00
root-grant	docs(custody): close producer delivery with verified provider recovery	2026-10-03 21:59:29 +02:00
ssh	fix(openbao): complete SSH apply script for OpenBao 2.5.x issuers	2026-06-18 01:18:56 +02:00
state-hub-preflight	fix(security): prevent ESO copying source annotations (CUST-WP-0073)	2026-09-28 15:56:50 +02:00