S3 Platform Services — PostgreSQL HA, Valkey, object storage
b7aef386d5
Five failures in full credential test discovery, none of them broker regressions: - CCR-2026-0009 referenced a policy file that was never added, and used a schema-invalid access_frontdoor.readiness value. Add the least-privilege workload-kv-read-qonto-assistant.hcl (read-only on tenants/binky/qonto-api) and set readiness to pending-review. The lane stays proposed and non-resolvable. - Three refusal tests used the live CCR-2026-0002 file as their "unapproved CCR" fixture. That lane is now approved, applied and active, so the gates correctly permitted it and the tests failed; applier-apply then walked into its interactive confirmation prompt and raised EOFError under a non-interactive runner. Add an unapproved_ccr() helper that materializes a normalized temp copy so approval state is no longer read off a mutable production artifact. - The approve/unconfirmed-claim test demoted an active CCR to approved while leaving resolvable=true, tripping a correct validation rule. Build it from the same helper. No gate, blocker, validation rule, or grant semantic was changed. Verified: credential discovery 52/52 and full discovery 61/61 pass non-interactively, make credential-change-validate passes all nine CCRs, the grant catalog validates, and both audit-core openbao-database-credential grants retain exec-env-only delivery and revoke-on-exec-exit. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> |
||
|---|---|---|
| .claude/rules | ||
| .forgejo/workflows | ||
| argocd | ||
| credential-change-requests | ||
| credential-grants | ||
| docs | ||
| helm | ||
| lib | ||
| openbao | ||
| registry | ||
| schemas | ||
| scripts | ||
| tests | ||
| tools | ||
| workplans | ||
| .custodian-brief.md | ||
| .gitignore | ||
| .repo-classification.yaml | ||
| .sops.yaml | ||
| AGENTS.md | ||
| CLAUDE.md | ||
| INTENT.md | ||
| LICENSE | ||
| Makefile | ||
| SCOPE.md | ||
| WORK-RECORDS.md | ||