e1caa378cf
Assistant: codex Assistant-Model: gpt-6.1-sol Assistant-Session: 01a1046b-5629-7f52-badd-f718eadb6042
35 lines
3.5 KiB
Markdown
35 lines
3.5 KiB
Markdown
# Attended provisioning preparation contract
|
||
|
||
Owner: railiance-platform, RPF-WP-0050. Origin: CUST-WP-0075 P2/P3.
|
||
|
||
`python3 scripts/credential-change.py window-checklist --window-file <metadata.yaml> --workplan-root <owner/workplans>` joins open non-residual task blocks carrying the exact decision UUID to explicit CCR, lane and owner-receipt contracts. Repeat `--workplan-root` for each repo in scope. Roots are the authoritative file snapshot; Hub qualifiers are independently verified before any attended window. No implicit completeness claim exists for omitted roots.
|
||
|
||
The metadata manifest has `decision_id`, `date` (YYYY-MM-DD), and `entries`; each entry has `task_id`, `ccr`, `lane_doc`, `receipt_contract`. The three file references are relative to this platform repo and must exist; the receipt contract names the owner’s required positive/negative/revocation/cleanup evidence, never values. Empty manifests/decisions, missing joins or any non-approved CCR produce exit 2 and NOT READY. Duplicate IDs and stale task joins are refused. Applied CCRs are never replay candidates. Arbitrary CCR content is never printed.
|
||
|
||
Each item must additionally bind the exact reviewed revision/digest, expected result, native preflight, abort owner, verification and rollback in the existing CCR/supervision receipt. REVIEW PREPARED is a source-join result, not execution permission. Upstream owner gates and live readiness must be checked again in the approved dated window. The Custodian owns cadence; this renderer schedules nothing and executes nothing. A resolved packet calls for owner re-check, not unconditional task completion.
|
||
|
||
## P3 draft for founder ruling
|
||
|
||
The current rule remains attended value custody. Choose explicitly between (a) batched attended custody, (b) response-wrapped issuer delivery with one-time unwrap, and (c) a scoped MFA writer through a silent contained helper. Review exact actor/path/audience, TTL/single use, audit boundary, child-output suppression, crash cleanup, replay refusal and rollback before adopting b/c. Wrapped tokens are credentials and stay out of files, Hub, chat and logs. No option grants broad write or changes existing lanes. RPF-WP-0050-T02 is routed to D3; a generic D3 resolution still requires a specific value-path disposition, so lack of an explicit answer does not unblock it.
|
||
|
||
## Founder choice — 2026-10-04
|
||
|
||
Bernd selected **batched attended custody (existing approach)** in this session.
|
||
This completes the P3 choice for RPF-WP-0050-T02; it does not resolve the other
|
||
subjects in the shared D3 decision.
|
||
|
||
The existing boundary applies: the founder performs OIDC/MFA in their own
|
||
terminal through `warden access openbao-platform-admin-login --exec --
|
||
<reviewed-command>`. Every item retains its exact reviewed actor, path, audience,
|
||
CCR revision, upstream gates and receipt contract. Batching groups preparation
|
||
and attendance; it grants no additional paths, delegated writer or reusable
|
||
authority. Existing lane and session TTL/revocation requirements remain in force.
|
||
The reviewed child suppresses all output and errors, compares before writing,
|
||
refuses differing objects and returns only the reviewed non-secret receipt.
|
||
On failure or interruption, stop, establish the actual state and session cleanup,
|
||
and revalidate the remaining items before retrying. Applied custody is excluded
|
||
from replay; each item keeps its own abort, verification and rollback contract.
|
||
Values remain outside Git, Hub, chat and logs.
|
||
|
||
The dated scope and owner mappings remain RPF-WP-0050-T03. This custody choice
|
||
does not authorize a live command or activate a schedule.
|