codex 0f0282a436 RPF-WP-0057: capabilities-self grant for the hub-writer caller and UI workload role choice (NK-WP-0051-T06) ... credential-change.py generates sys/capabilities-self (update) when openbao.token_capabilities_self is true. Proposed CCR-2026-0045 sets it for workload-kv-read-reuse-surface-runtime so the ops-mason proof stops calling sys/capabilities with a root token. The OpenBao login page keeps its platform-admin button and adds an allow-listed workload role choice. Repo only; nothing applied to OpenBao or the cluster. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 1041694@bnt-lap001 Assistant-Session: 7af0bb68-ac4a-4ce3-8639-24ddd84c0b52		2026-10-14 23:45:00 +02:00
..
auth	RPF-WP-0054-T05: fix issuer binding after the first probe	2026-10-10 11:12:19 +02:00
eso-auth-recovery	RPF-WP-0045: plan Kubernetes-auth migration for openbao-activity-core and openbao-email-connect	2026-09-21 19:18:59 +02:00
fluid-telegram	RPF-WP-0035-T03: fluid-telegram operator matrix lane and custody helpers	2026-10-09 12:10:21 +02:00
policies	RPF-WP-0057: capabilities-self grant for the hub-writer caller and UI workload role choice (NK-WP-0051-T06)	2026-10-14 23:45:00 +02:00
root-grant	docs(custody): close producer delivery with verified provider recovery	2026-10-03 21:59:29 +02:00
ssh	fix(openbao): complete SSH apply script for OpenBao 2.5.x issuers	2026-06-18 01:18:56 +02:00
state-hub-preflight	fix(security): prevent ESO copying source annotations (CUST-WP-0073)	2026-09-28 15:56:50 +02:00
backup-primary-serviceaccounts.yaml	Commit the prepared backup reader for both archive pairs.	2026-10-08 22:12:34 +02:00