coulomb/secrets-engine
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

chore(workplans): record founder decisions 18731e84 (approve) and 9f9d0d88 (A); 4fab263d deferred
All checks were successful
CI Smoke / host-smoke (push) Successful in 1s
Details
CI Smoke / container-smoke (push) Successful in 4s
Details

Browse source 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 17890@bnt-lap001
Assistant-Session: 7d96d43c-0154-4a22-af71-71c349ac6dc3
This commit is contained in:
tegwick 2026-10-21 21:10:22 +02:00
parent 745ad146b5
commit 39314c18b6
2 changed files with 14 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

7
workplans/SECRETS-WP-0014-pdp-transport-and-responder-authentication.md
View file

@ -148,6 +148,13 @@ Access's trust-file projection matches `decision_signature.load_trust`: the same
keys, 32-byte base64url keys, and the same namespace. Its pin is keys, 32-byte base64url keys, and the same namespace. Its pin is
access-engine `docs/native-signer-public-pin.json`. No format work remains here. access-engine `docs/native-signer-public-pin.json`. No format work remains here.
2026-10-21 founder decisions:
- Step 1 is done. The founder resolved 18731e84 as APPROVE for the CCR-2026-0050 scope;
execution also requires railiance-cluster's cluster-runtime-storage-owner review.
- The founder deferred step 3 (4fab263d) until Platform reports verified custody.
- Owners notified: railiance-platform, access-engine and railiance-cluster.
- Next gate: that storage review, then Platform's attended CAS0 creation.
## Verify the admitted native consumer and rotation path ## Verify the admitted native consumer and rotation path
```task ```task

7
workplans/SECRETS-WP-0015-original-keycape-recovery-selector.md
View file

@ -168,3 +168,10 @@ secrets15-nk49-readiness in the packet; do not strand the wait or invent a drive
NK49-T40 carries the founder signature after T33. There is no pin drift: 0f44fbe..0aeb5a2 NK49-T40 carries the founder signature after T33. There is no pin drift: 0f44fbe..0aeb5a2
changed only this workplan, and the selector, service_auth.py and check tool hashes are changed only this workplan, and the selector, service_auth.py and check tool hashes are
unchanged. Do not edit those files before the attempt, because any edit forces an NK49 re-pin. unchanged. Do not edit those files before the attempt, because any edit forces an NK49 re-pin.
2026-10-21: the founder resolved 9f9d0d88 as A. kc-tls is recovered by ACME
letsencrypt-prod reissue, chained to ISRG Root X1, with no self-signed substitute.
NK49 should rehearse on LE staging first. T33 no longer needs original kc-tls key
custody. net-kingdom and railiance-cluster were notified; railiance-cluster was asked
to re-scope RCLUSTER-WP-0018-T02 to the outage prerequisites. Remaining for T33:
the T35 metadata and the NK49 attempt assembly (deadline, receipt location, verifier).