codex b1421317e7 CCR-2026-0064 (proposed): read-only window watch for the CCR-2026-0058 write role (net-kingdom NK-WP-0058-T06) ... New request type auth-role-presence-watch (scripts/auth_role_watch_lane.py, registered in LANE_MODULES): a Kubernetes-auth role for sso/nk-window-watch whose policy is generated from the CCR - read (mode flag) or read and delete (mode close) on exactly one watched role path, plus token self-lifecycle. Validator refuses any widening; apply writes policy and role and reads both back; tests with a fake bao. Drafted by net-kingdom on the founder's instruction for platform-owner review. Mode flag; not approved. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 943911@bnt-lap001 Assistant-Session: fc322940-1c8e-4bed-ab39-86cec99f23a0		2026-11-06 08:55:09 +01:00
..
auth	RPF-WP-0065-T04: rebuild founder runbook for the silent warden lane	2026-10-27 22:46:31 +01:00
email-connect-platform-smtp	Refresh platform SMTP admission and preserve founder approval	2026-11-01 23:21:11 +01:00
eso-auth-recovery	RPF-WP-0045: plan Kubernetes-auth migration for openbao-activity-core and openbao-email-connect	2026-09-21 19:18:59 +02:00
fluid-telegram	RPF-WP-0035-T03: fluid-telegram operator matrix lane and custody helpers	2026-10-09 12:10:21 +02:00
policies	CCR-2026-0064 (proposed): read-only window watch for the CCR-2026-0058 write role (net-kingdom NK-WP-0058-T06)	2026-11-06 08:55:09 +01:00
root-grant	docs(custody): close producer delivery with verified provider recovery	2026-10-03 21:59:29 +02:00
ssh	OpenBao agt-role: allow permit-pty extension for agt-custodian (CUST-WP-0073-T02, WARDEN-WP-0045)	2026-10-20 20:34:47 +02:00
state-hub-preflight	fix(security): prevent ESO copying source annotations (CUST-WP-0073)	2026-09-28 15:56:50 +02:00
backup-primary-serviceaccounts.yaml	Prepare the draft MAS evidence publisher grant.	2026-11-02 02:28:28 +01:00