codex b328d36a20 RPF-WP-0054-T05: issuer binding CCR-2026-0043 (net-kingdom-admins, aal2) and probe session ... New CCR request type broker-issuer-binding: an OIDC role on netkingdom that carries only the broker issuer policy (loopback callbacks, 15m, 8 uses, no default policy); the apply refuses unless the live issuer policy matches source. Founder chose net-kingdom-admins + aal2 on 2026-10-10. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 469992@bnt-lap001 Assistant-Session: e4b8e420-df0a-441d-83ae-7f19130594d9		2026-10-10 10:18:58 +02:00
..
auth	RPF-WP-0054-T05: issuer binding CCR-2026-0043 (net-kingdom-admins, aal2) and probe session	2026-10-10 10:18:58 +02:00
eso-auth-recovery	RPF-WP-0045: plan Kubernetes-auth migration for openbao-activity-core and openbao-email-connect	2026-09-21 19:18:59 +02:00
fluid-telegram	RPF-WP-0035-T03: fluid-telegram operator matrix lane and custody helpers	2026-10-09 12:10:21 +02:00
policies	File Forgejo OIDC case readers as CCR-2026-0041 (ESO) and CCR-2026-0042 (consumer)	2026-10-09 19:55:11 +02:00
root-grant	docs(custody): close producer delivery with verified provider recovery	2026-10-03 21:59:29 +02:00
ssh	fix(openbao): complete SSH apply script for OpenBao 2.5.x issuers	2026-06-18 01:18:56 +02:00
state-hub-preflight	fix(security): prevent ESO copying source annotations (CUST-WP-0073)	2026-09-28 15:56:50 +02:00
backup-primary-serviceaccounts.yaml	Commit the prepared backup reader for both archive pairs.	2026-10-08 22:12:34 +02:00