ba445d7aed
The founder acknowledged oidc-service-client 0.2 on 2026-11-01 (memo r2, hub decision f8044f81, net-kingdom 9ce0d60), meeting the RPF-WP-0060-T01 rule from review R1. keycape_client_secret_generate.py pins the 0.2 type bytes, keys parameter pins by exact type reference, and derives confidentiality per type: browser 1.1 keeps its client_type check, the service type is confidential by construction (no client_type, unconditional custody path); a service case carrying client_type is refused. Create-only is unchanged. Eleven new tests; the existing browser tests are unchanged apart from the re-keyed pin. CCR-2026-0060/0061 match the 0.2 materialization; references updated, still proposed. T09 (wait) tracks their approval and apply. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 5502@bnt-lap001 Assistant-Session: 68b3b02f-5d0f-4e71-8421-796f62e50196
15 lines
502 B
HCL
15 lines
502 B
HCL
# workload-kv-read-keycape-nk-bind-executor-approval-bounded-executor: CCR-2026-0061 (proposed),
|
|
# SecurityCase nk-bind-executor-approval (oidc-service-client@0.2, acknowledged), consumer reader for
|
|
# sso/nk-bind-executor. Platform-generated from the CCR. Source only; not applied.
|
|
|
|
path "platform/data/workloads/keycape/nk-bind-executor-approval" {
|
|
capabilities = ["read"]
|
|
}
|
|
|
|
path "auth/token/lookup-self" {
|
|
capabilities = ["read"]
|
|
}
|
|
|
|
path "auth/token/revoke-self" {
|
|
capabilities = ["update"]
|
|
}
|