coulomb/secrets-engine
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

chore(workplans): WP15 T04 owns attempt-host admission anchor; confirm NK49 pins
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 809600@bnt-lap001
Assistant-Session: 40ba228f-c8a0-4ec9-bb29-3129951afdc4
This commit is contained in:
tegwick 2026-10-21 01:26:40 +02:00
parent 0f44fbeea1
commit 0aeb5a29a9
1 changed files with 8 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

8
workplans/SECRETS-WP-0015-original-keycape-recovery-selector.md
View file

@ -144,6 +144,14 @@ Before any key prompt, the selector preflight must pass with `--admission` on th
founder-signed attempt document for this exact case (T05).
2026-10-21: decision d1ab097d resolved by the founder as approved in principle.
The remaining gate is the actual signed attempt approval once NK-WP-0049-T33 is ready.
T04 also owns the admission anchor on the attempt host. Install root-owned
`/etc/secrets-engine/admission/allowed_signers` there, with the founder approver
key, per `docs/founder-admission.md`. If the attempt host is the secrets-engine
runtime host, one anchor serves both this task and SECRETS-WP-0014-T04. NK-WP-0049
pinned secrets-engine 0f44fbe and the selector and service_auth.py hashes from that
commit, recorded in net-kingdom
`docs/evidence/2026-10-21-nk49-t33-readiness/readiness-observation.json`. Those pins
were confirmed 2026-10-21. T04 consumes the NK49 T33 packet unchanged.
Only a separately admitted owner action can establish actual archived registration,
issuer trust, native negative checks and consumer continuity. Source selector and
historical provider proof do not fill this gate. No production consumer redirect,