From 6c637d1853b20f478ea54fb7e2b04d503ae34dc1 Mon Sep 17 00:00:00 2001 From: tegwick Date: Mon, 21 Sep 2026 16:02:27 +0200 Subject: [PATCH] Record SECRETS-WP-0009-T03 activation preparation after shared chain proof Co-Authored-By: Claude Opus 5 Assistant: claude-code Assistant-Model: opus Assistant-Process: 272244@bnt-lap001 Assistant-Session: c8962fa7-b290-47df-865f-403ddb6c77e9 --- ...ETS-WP-0009-glas-claude-native-delivery.md | 33 +++++++++++++++++-- 1 file changed, 31 insertions(+), 2 deletions(-) diff --git a/workplans/SECRETS-WP-0009-glas-claude-native-delivery.md b/workplans/SECRETS-WP-0009-glas-claude-native-delivery.md index ad750c1..de45c15 100644 --- a/workplans/SECRETS-WP-0009-glas-claude-native-delivery.md +++ b/workplans/SECRETS-WP-0009-glas-claude-native-delivery.md @@ -8,7 +8,7 @@ status: blocked flavor: implementation owner: codex created: "2026-09-05" -updated: "2026-09-10" +updated: "2026-09-21" state_hub_workstream_id: "40ccc3b4-d046-5a58-8649-e7935f45c974" --- @@ -50,7 +50,7 @@ synthetic exec-env transport proof passed; no real secret was read. id: SECRETS-WP-0009-T03 status: wait priority: high -blocking_reason: "Recipient binding and declared human-control request/PEP enforcement implemented and proved with the real local approval/PDP chain. Complete exact private owner configuration and native MessagesOwner holder admission, CCR-2026-0019 operator reader, human/audit/service path and scoped live delivery. CCR-2026-0020 was cancelled by its owner." +blocking_reason: "Shared native chain proved by SECRETS-WP-0010-T03 (2026-09-16): Approval Engine, CCR-2026-0019 reader, requester client, Informed Decision human review, current PDP. Lane-specific residue: operator inputs (placement, spend envelope/model bounds, unrelated negative identity), private SpendPolicy/ledger and owner config (HFACT-WP-0001-T01/T04), configured exec_owner, three human approvals, attended apply/verify/exec/revoke." state_hub_task_id: "f8069c8a-ad6b-5d0b-9a36-c2326699437d" ``` @@ -266,3 +266,32 @@ requester, INFD T07/T08 functional browser and human approval, audit custody, CCR-2026-0019 operator binding/attended read, current deployed service/PDP and configured MessagesOwner/native delivery. HFACT T01/T04/T05 retains factory config/G0 and natural queue/model proof. No native secret read or paid attempt. + +### 2026-09-21 activation preparation + +SECRETS-WP-0010-T03 completed native OpenRouter delivery on 2026-09-16 over the +same shared chain: Approval Engine deployed, CCR-2026-0019 reader bound to +`net-kingdom-admins`, `secrets-engine-requester` admitted, Informed Decision +human review live with a real human approval, current PDP. Those items are no +longer T03 blockers. The operator offered the attended session. + +Lane-specific residue, in order: + +1. Operator inputs: placement (workstation or Railiance runtime copy from + `prj-helixforge-factory/evidence/2026-09-10-runtime-placement.json`), spend + envelope for one bounded run (`rein-aharness/docs/spend-admission.md` fields: + per-run/daily/total EUR, max budget/liability USD, FX, expiry), MessagesOwner + model and token bounds, and a real unrelated identity for negative verification. +2. Private SpendPolicy + ledger `spend init` and mode-0600 owner config + (`rein-aharness/docs/owner-bootstrap.md`) at the chosen placement + (HFACT-WP-0001-T01/T04). Their digests become `exec_owner.files` pins. +3. Configure `exec_owner` (argv `/bin/python3 -I -B -m rein_aharness.cli + metered-once --owner-config `), render final + apply/verify/exec requests with evaluator-origin digests. +4. Attended: three human approvals, scoped Warden session, claim/Check/consume + then apply, positive/negative verify, one bounded exec, session revoke, + evidence returned to GLAS-WP-0012 / SAND-WP-0015. + +Circular wait noted: HFACT-WP-0001-T04 waits on this task's admission while this +task waits on the owner config; the operator inputs in step 1 break it. +No credential read, no approval created, no policy or role changed.