coulomb/railiance-platform
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
railiance-platform/credential-change-requests
History
codex 857be4695f
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details
RPF-WP-0054-T04: create-only broker grant keycape/client-secret-generate 
- New CCR request type custody-generate-grant (scripts/broker_grant_lane.py):
  grant policy (create on keycape/+ data, read on metadata, deny on reserved
  entries, revoke-self; no update, data read, metadata write, list or
  delete), broker issuer policy and a 5m orphan non-renewable token role,
  with readback. Binds no identity, so the apply is inert until T01.
- CCR-2026-0040 (proposed), catalog grant (pilot, approval-required,
  exec-env only), generated policies, tests.
- T03 drops custom_metadata: a metadata write would also allow changing
  other entries' version settings.
- test_operator_matrix_lane follows CCR-2026-0039 now being applied.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 469992@bnt-lap001
Assistant-Session: e4b8e420-df0a-441d-83ae-7f19130594d9
2026-10-09 19:08:25 +02:00
..
CCR-2026-0001-whynot-design-npm-publish.yaml Settle the npm lane field, and record an ungoverned duplicate 2026-09-10 09:03:22 +02:00
CCR-2026-0002-issue-core-ingestion-api-key.yaml RAILIANCE-WP-0009/0010 finished: front doors active; WP-0005 T10 done 2026-07-02 20:54:29 +02:00
CCR-2026-0003-llm-connect-openrouter-api-key.yaml RAILIANCE-WP-0009/0010 finished: front doors active; WP-0005 T10 done 2026-07-02 20:54:29 +02:00
CCR-2026-0004-railiance-backup-offsite-lane.yaml Record the callback-amendment re-applies of CCR-2026-0004/0019/0034 (decision 73fff3d3) 2026-10-07 15:12:35 +02:00
CCR-2026-0005-reuse-surface-runtime-secrets-lane.yaml Close three-lane ESO recovery with live verification and cleanup evidence 2026-09-05 19:00:19 +02:00
CCR-2026-0006-forgejo-admin-api-token-lane.yaml Apply CCR-2026-0006 Forgejo admin PAT lane metadata 2026-07-12 16:07:32 +02:00
CCR-2026-0007-binky-company-email-imap.yaml CCR-2026-0007: activate binky IMAP lane after founder provision 2026-07-17 00:33:20 +02:00
CCR-2026-0008-binky-qonto-api.yaml CCR-2026-0008 active: tenants/binky/qonto-api lane live 2026-07-21 21:42:10 +02:00
CCR-2026-0009-qonto-assistant-workload-kv-read.yaml Close RAILIANCE-WP-0015-T06 rapp credential-lane binding 2026-08-14 00:47:28 +02:00
CCR-2026-0010-email-connect-transactional.yaml Close CCR drift and high-risk policy gaps 2026-08-21 01:29:28 +02:00
CCR-2026-0011-scaleway-object-storage-bootstrap.yaml Close CCR drift and high-risk policy gaps 2026-08-21 01:29:28 +02:00
CCR-2026-0012-backup-object-storage.yaml feat: vend platform-pg-backup-s3 via AppRole ESO 2026-08-14 20:00:15 +02:00
CCR-2026-0013-core-hub-runtime-api-token.yaml Finish Core Hub private shadow onboarding 2026-08-21 00:51:06 +02:00
CCR-2026-0014-policy-nexus-forgejo-source-read.yaml Activate Policy Nexus source credential lane 2026-09-01 01:35:48 +02:00
CCR-2026-0015-state-hub-preflight-signing.yaml Complete live State Hub signing activation and rotation acceptance 2026-09-05 18:12:37 +02:00
CCR-2026-0016-glas-claude-anthropic.yaml docs: link Anthropic custody to native delivery adoption 2026-09-06 00:25:06 +02:00
CCR-2026-0017-keycape-secrets-engine-approval-client.yaml feat: verify live KeyCape custody and preserve versions on resume 2026-09-09 02:18:12 +02:00
CCR-2026-0018-keycape-approval-engine-operator-client.yaml feat: verify live KeyCape custody and preserve versions on resume 2026-09-09 02:18:12 +02:00
CCR-2026-0019-secrets-engine-approval-client-read.yaml Record the callback-amendment re-applies of CCR-2026-0004/0019/0034 (decision 73fff3d3) 2026-10-07 15:12:35 +02:00
CCR-2026-0020-approval-engine-operator-client-read.yaml CCR-2026-0029/0030: record positive verification (ExternalSecret synced) 2026-09-23 22:36:41 +02:00
CCR-2026-0021-approval-engine-audit.yaml Record verified independent factory audit readback 2026-09-11 16:35:14 +02:00
CCR-2026-0022-informed-decision-audit.yaml Record verified independent factory audit readback 2026-09-11 16:35:14 +02:00
CCR-2026-0023-keycape-factor-read.yaml Establish scoped KeyCape factor custody and verified automatic renewal 2026-09-13 16:25:33 +02:00
CCR-2026-0024-t03-requester-verifier.yaml Provision scoped T03 requester custody and native requests 2026-09-14 02:47:32 +02:00
CCR-2026-0025-t03-requester-reader.yaml Record approved metered requester extension and six native creates 2026-09-27 21:08:43 +02:00
CCR-2026-0026-informed-decision-sitting-requester-verifier.yaml Record sitting-requester custody apply; keep exchange proof open. 2026-09-15 20:31:00 +02:00
CCR-2026-0027-informed-decision-sitting-requester-reader.yaml Record sitting-requester custody apply; keep exchange proof open. 2026-09-15 20:31:00 +02:00
CCR-2026-0028-railiance-clock-authority-signing.yaml Record verified production Clock custody and authority acceptance 2026-09-15 23:13:13 +02:00
CCR-2026-0029-activity-core-ops-run-worker-rein-aharness-railiance01.yaml CCR-2026-0029/0030: record positive verification (ExternalSecret synced) 2026-09-23 22:36:41 +02:00
CCR-2026-0030-activity-core-ops-run-worker-rein-aharness-metered-railiance01.yaml CCR-2026-0029/0030: record positive verification (ExternalSecret synced) 2026-09-23 22:36:41 +02:00
CCR-2026-0031-core-hub-forgejo-source-read.yaml CCR-2026-0031: positive verification via verify-publisher (errors 9 -> 2, private-source reads work) 2026-10-03 10:21:20 +02:00
CCR-2026-0032.yaml Accept native requester delivery proofs and preserve final cutover gate 2026-10-04 23:50:18 +02:00
CCR-2026-0033.yaml Record the CCR-2026-0033 re-apply under founder decision 1fdd993b 2026-10-07 02:11:03 +02:00
CCR-2026-0034.yaml Record the callback-amendment re-applies of CCR-2026-0004/0019/0034 (decision 73fff3d3) 2026-10-07 15:12:35 +02:00
CCR-2026-0035-authelia-platform-smtp.yaml Complete scoped Authelia SMTP admission and record rotation consumers 2026-10-06 20:38:28 +02:00
CCR-2026-0036-coulomb-social-backup-primary.yaml Accept both backup readers and deliver the email-connect pair. 2026-10-09 00:05:35 +02:00
CCR-2026-0037-email-connect-backup-primary.yaml Accept both backup readers and deliver the email-connect pair. 2026-10-09 00:05:35 +02:00
CCR-2026-0038-secrets-engine-service-jwt-login.yaml RPF-WP-0035-T02: record founder approval and delegated apply of CCR-2026-0038 2026-10-09 11:47:09 +02:00
CCR-2026-0039-fluid-telegram-hall-of-helix-operator-matrix.yaml RPF-WP-0035-T03: record founder apply, custody move and duplicate retirement 2026-10-09 12:31:13 +02:00
CCR-2026-0040-keycape-client-secret-generate-grant.yaml RPF-WP-0054-T04: create-only broker grant keycape/client-secret-generate 2026-10-09 19:08:25 +02:00