railiance-platform/credential-change-requests/CCR-2026-0027-informed-decision-sitting-requester-reader.yaml

id: CCR-2026-0027
kind: credential-change-request
schema_version: 1
request_type: workload-kv-read
title: Informed Decision sitting-requester attended operator reader
status: applied
created: '2026-09-15'
updated: '2026-09-15'
requester:
  agent: grok
  reason: INFD-WP-0002-T03 requested a create-only sitting presenter whose binding.actor
    is informed-decision. Allocate a new CCR pair. Do not widen CCR-2026-0024, CCR-2026-0025
    or platform/workloads/secrets-engine/approval-requester.
review:
  required: true
  required_approvers:
  - platform-operator
  - key-cape-owner
  comments:
  - at: '2026-09-15'
    reviewer: operator instruction in Grok session
    decision: allocated
    comment: Operator selected allocation of the sitting-requester CCR pair. Source
      only. No OpenBao apply, no secret seed, and no sitting POST from this allocation.
  - at: '2026-09-15'
    reviewer: User (platform-operator; key-cape-owner)
    decision: approved
    comment: User instructed register sitting-requester. Apply remains the attended
      helper with CAS=0 custody, exact create-only client, and no sitting POST.
  - at: '2026-11-01'
    reviewer: railiance-platform
    decision: amendment_proposed
    comment: 'key-cape 82b471f (founder decision 2026-11-01) adds approval:read to client
      informed-decision-sitting-requester for informed-decision present_existing intake.
      Text-only amendment, see amendments: custody path, field, policy, role, bound identity,
      ESO delivery and env binding are unchanged, so no new CCR and no OpenBao change.
      Needs platform-owner and key-cape-owner approval, recorded by the founder''s scope
      decision, before the live keycape-client.py remove-then-add.'
  - at: '2026-11-01'
    reviewer: platform-owner
    decision: amendment_approved
    comment: 'Approved by the founder in session 2026-11-01 (net-kingdom coordinator relayed):
      approval:read for informed-decision-sitting-requester, text-only amendment as proposed.
      The live keycape-client.py remove-then-add remains a separate founder-run step.'
  - at: '2026-11-01'
    reviewer: key-cape-owner
    decision: amendment_approved
    comment: 'Approved by the founder in session 2026-11-01 (net-kingdom coordinator relayed),
      matching key-cape 82b471f.'
target:
  domain: financials
  tenant: platform
  workload: informed-decision
  environment: production
  purpose: create-only sitting requester attended operator reader; approval:create
    only; subject informed-decision; audience approval-engine.
openbao:
  mount: platform
  kv_path: platform/workloads/informed-decision/sitting-requester
  fields:
  - CLIENT_SECRET
  policy_name: workload-kv-read-informed-decision-sitting-requester-client
  policy_file: openbao/policies/workload-kv-read-informed-decision-sitting-requester-client.hcl
  auth:
    method: oidc
    mount: netkingdom
    role: informed-decision-sitting-requester-workload-kv-read
    allowed_redirect_uris:
    - https://bao.coulomb.social/ui/vault/auth/netkingdom/oidc/callback
    - http://localhost:8250/oidc/callback
    - http://127.0.0.1:8250/oidc/callback
    oidc_scopes:
    - openid
    - profile
    - email
    - groups
    user_claim: sub
    groups_claim: groups
    bound_claims:
      groups:
      - net-kingdom-admins
    bound_claims_confirmed: true
    policies:
    - workload-kv-read-informed-decision-sitting-requester-client
    ttl: 15m
access_frontdoor:
  type: ops-warden
  catalog_id: informed-decision-sitting-requester-login
  selector: Informed Decision create-only sitting requester
  command: warden access informed-decision-sitting-requester-login --exec -- <reviewed-requester-command>
  resolvable: false
  readiness: pending-review
delivery:
  surface: operator-workstation
  target: Contained attended reader session; secret stays in memory for native requester
    exchange; no retained file or raw output.
risk:
  classification: high
  notes:
  - Credential authenticates only the separate approval:create sitting requester.
    Human disposition remains on the public PKCE client informed-decision-approver.
  - Do not widen CCR-2026-0024/0025 or secrets-engine/approval-requester.
  - Bound group is net-kingdom-admins, matching CCR-2026-0019/0025 operator binding.
verification:
  positive:
  - Exact path read of CLIENT_SECRET for the attended operator identity only.
  - Sibling secrets-engine/approval-requester and parent listing denied.
  negative:
  - Approval and consume scopes refused at token exchange; wrong secret refused.
  - Sibling KV paths and parent listing denied.
  activation_conditions:
  - Attended platform authority, CAS=0 custody, exact policy/auth readback and synchronized
    verifier delivery.
  - Separate reader verification and no human entry synthesized.
  - No sitting POST until exchange proof exists.
  evidence:
  - at: '2026-09-15T18:28:28+00:00'
    actor: operator via attended sitting-requester custody session
    kind: delegated_metadata_apply
    result: passed
    details:
    - Delegated metadata applier ran as operator via attended sitting-requester custody
      session using local bao CLI ambient authority.
    - 'Policy metadata write: sys/policies/acl/workload-kv-read-informed-decision-sitting-requester-client'
    - 'Auth role metadata write: auth/netkingdom/role/informed-decision-sitting-requester-workload-kv-read'
    - No secret values were read, written, printed, or accepted in argv.
lifecycle:
  deactivate: Disable the informed-decision-sitting-requester KeyCape registration
    and detach only these two sitting-requester reader roles. Preserve CCR-2026-0024/0025
    and existing consumer/verifier lanes.
  rotate: Rotate through KeyCape and platform using a new version with predecessor
    refusal proof.
  compromised: Disable sitting-requester issuance first; revoke sessions and rotate
    under attended owner authority.
state_hub:
  workplan_id: RPF-WP-0042
  task_id: RPF-WP-0042-T01
  related_request: CCR-2026-0026
  related_workplan: INFD-WP-0002
amendments:
- at: '2026-11-01'
  by: railiance-platform
  status: approved
  change: 'Scope of the client this credential authenticates widens from approval:create
    to approval:create + approval:read (key-cape 82b471f, docs/sitting-requester-read-scope.md;
    founder decision 2026-11-01). Still never approval:consume, approval:approve or
    openid. Where this record says create-only, approval:create only or no read scope,
    read: create and read, never consume, approve or openid. Residual: an exchange without
    a scope parameter yields a create+read token (key-cape token.go). The 2026-09-15
    exchange proof (scripts/prove-sitting-requester-exchange.py) stays historical
    evidence of the create-only shape; after the live apply the new shape is verified
    as in the key-cape doc (read 200 with scope exactly approval:read; consume and approve
    400). No OpenBao object, custody value or delivery changes; status stays applied.'