bed91ceaf2
- New CCR request type workload-kv-operator-matrix (scripts/operator_matrix_lane.py): exact per-entry create/read/update, OIDC role on the existing netkingdom mount, and exact agent denies appended to the live agent-high-risk-boundary (live content preserved, partial presence refused). credential-change.py now dispatches lane request types through one module table. - CCR-2026-0039 (proposed): hall-of-helix four-entry matrix at tenant coulomb per the founder ruling of 2026-10-09; policy, role and overlay sources. - scripts/fluid_telegram_custody_move.py: silent CAS-0 move of the four undocumented infotech entries, deleting sources only after all verify. - scripts/kv_duplicate_retire.py: silent retirement of activity-core/default/llm-connect-provider-secrets once no live non-admin policy grants it. - Founder session commands recorded in the T03 note. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 469992@bnt-lap001 Assistant-Session: e4b8e420-df0a-441d-83ae-7f19130594d9
9 lines
1,012 B
HCL
9 lines
1,012 B
HCL
# CCR-2026-0039: coding-agent denies for platform/workloads/coulomb/fluid-telegram/hall-of-helix (data and metadata).
|
|
path "platform/data/workloads/coulomb/fluid-telegram/hall-of-helix/operator-app" { capabilities = ["deny"] }
|
|
path "platform/metadata/workloads/coulomb/fluid-telegram/hall-of-helix/operator-app" { capabilities = ["deny"] }
|
|
path "platform/data/workloads/coulomb/fluid-telegram/hall-of-helix/operator-session" { capabilities = ["deny"] }
|
|
path "platform/metadata/workloads/coulomb/fluid-telegram/hall-of-helix/operator-session" { capabilities = ["deny"] }
|
|
path "platform/data/workloads/coulomb/fluid-telegram/hall-of-helix/bot-token" { capabilities = ["deny"] }
|
|
path "platform/metadata/workloads/coulomb/fluid-telegram/hall-of-helix/bot-token" { capabilities = ["deny"] }
|
|
path "platform/data/workloads/coulomb/fluid-telegram/hall-of-helix/redaction-salt" { capabilities = ["deny"] }
|
|
path "platform/metadata/workloads/coulomb/fluid-telegram/hall-of-helix/redaction-salt" { capabilities = ["deny"] }
|