75e5c1af65
Public Ingress is gone, so BAO_ADDR=https://bao.coulomb.social fails before command handoff. The wrapper now uses 127.0.0.1:18200. Assistant: grok Assistant-Session: 01a0a23b-3bf0-7341-b4e5-9dc05f72573a
54 lines
1.9 KiB
Markdown
54 lines
1.9 KiB
Markdown
---
|
|
id: RPF-WP-0042
|
|
type: workplan
|
|
title: "Allocate Informed Decision sitting-requester custody"
|
|
domain: financials
|
|
repo: railiance-platform
|
|
status: active
|
|
flavor: implementation
|
|
owner: grok
|
|
topic_slug: railiance
|
|
created: "2026-09-15"
|
|
updated: "2026-09-15"
|
|
related: [INFD-WP-0002]
|
|
state_hub_workstream_id: "8a9a4e03-3500-58bd-ac09-60927dadd6fa"
|
|
---
|
|
|
|
INFD-WP-0002 requested a create-only KeyCape sitting presenter. Platform
|
|
allocates a new CCR pair. Do not widen CCR-2026-0024, CCR-2026-0025, or
|
|
`platform/workloads/secrets-engine/approval-requester`. No apply, secret seed,
|
|
or sitting POST from allocation.
|
|
|
|
## Allocate the verifier and attended-reader CCR pair
|
|
|
|
```task
|
|
id: RPF-WP-0042-T01
|
|
status: done
|
|
priority: high
|
|
state_hub_task_id: "448af717-0604-56d7-a0fa-e10e1418b2d9"
|
|
```
|
|
|
|
CCR-2026-0026 (KeyCape ESO verifier) and CCR-2026-0027 (attended OIDC reader)
|
|
use KV `platform/workloads/informed-decision/sitting-requester`, field
|
|
`CLIENT_SECRET` only. Exact-path policies, Kubernetes ESO role, and
|
|
`net-kingdom-admins` reader binding are source-declared. Front door remains
|
|
non-resolvable. ESO projection is unapplied source.
|
|
|
|
## Attended first provision and exchange proof
|
|
|
|
```task
|
|
id: RPF-WP-0042-T02
|
|
status: progress
|
|
priority: high
|
|
state_hub_task_id: "c6fbf99c-de2b-55be-9f0c-58be9fe7c518"
|
|
```
|
|
|
|
Operator approved CCR-2026-0026/0027 on 2026-09-15. Source registration is in
|
|
`key-cape/config/service-clients.example.yaml`. Live apply is the silent helper
|
|
`scripts/provision-sitting-requester.sh` through `openbao-attended-exec.py`.
|
|
No sitting POST until exchange proof exists. Do not widen CCR-2026-0024/0025.
|
|
|
|
2026-09-15 attended attempt failed before command handoff:
|
|
`revocation could not be confirmed`. Public Ingress is already absent, and the
|
|
shell still had `BAO_ADDR=https://bao.coulomb.social`. The wrapper now pins the
|
|
operator tunnel. Retry that same helper; do not treat this attempt as custody.
|