From caca122b4996e675179c2a66a6be935d16377dbd Mon Sep 17 00:00:00 2001 From: tegwick Date: Mon, 14 Sep 2026 01:46:47 +0200 Subject: [PATCH] Record native approval client delivery acceptance for T03 Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a09cbb-87c6-7900-a145-4ce53ba9f1a6 --- docs/approval-service-auth.md | 26 +++++++++++++++++++ ...ECRETS-WP-0010-openrouter-native-access.md | 26 +++++++++++++++++++ 2 files changed, 52 insertions(+) diff --git a/docs/approval-service-auth.md b/docs/approval-service-auth.md index afeb25f..60f417b 100644 --- a/docs/approval-service-auth.md +++ b/docs/approval-service-auth.md @@ -147,3 +147,29 @@ signed issuer/claim/consume, registry precedence, changed submission replay, wrong action, same/different consume digest and actual dual-control policy. See `docs/evidence/2026-09-09-replay-contract-exercise.json`. Earlier nine-check PDP-double evidence remains historical. Live custody/deployment gates still apply. + + +### Native reader acceptance — 2026-09-14 + +The scoped Warden login lane `secrets-engine-approval-client-login` now routes +to the applied OIDC reader and the platform's silent preflight. The installed +Warden package still carries an older catalog; use the explicit source catalog +`WARDEN_ROUTING_CATALOG=/home/worsch/ops-warden/registry/routing/catalog.yaml` +until its next normal installation refresh. This lane authenticates the reader; +it is not a raw secret fetch or retained-file delivery interface. + +Live effective-policy and capability checks passed: only exact data/metadata +read, no sibling secret, parent listing, write or control-plane authority. +A second contained session read existing version 1 into an operator-owned 0600 +file in a private 0700 runtime tmpfs directory. The native consumer exchanged +separate read and consume scopes; Approval Engine verified the read token before +returning 404 for a fresh nonexistent approval, and refused the consume-only +token's read request with 403. No approval was created, bound or consumed. +Both Warden sessions exited 0 after self-revocation/helper cleanup; temporary +credential file and directory were removed. Four refusal/path/redirect tests +pass. Receipts are in platform `docs/evidence/2026-09-14-ccr0019-{reader-preflight,delivery-check}.json`. + +Remaining: an actual nonmember login refusal, real approval claim/consume, +separate narrow requester admission and deployed Informed Decision review with +an explicitly admitted human mandate. The reader group alone grants no review +mandate. T03 and CCR delivery activation remain open; no OpenRouter key was read. diff --git a/workplans/SECRETS-WP-0010-openrouter-native-access.md b/workplans/SECRETS-WP-0010-openrouter-native-access.md index c321e88..d7dd148 100644 --- a/workplans/SECRETS-WP-0010-openrouter-native-access.md +++ b/workplans/SECRETS-WP-0010-openrouter-native-access.md @@ -103,3 +103,29 @@ Decision's native review flow and requester admission are dependencies, not replaced by a service token or a seeded live approval. T03 remains open until real approval/consume, attended OpenBao apply, key check, positive/negative native delivery and revocation are evidenced. + + +### Native reader acceptance — 2026-09-14 + +The scoped Warden login lane `secrets-engine-approval-client-login` now routes +to the applied OIDC reader and the platform's silent preflight. The installed +Warden package still carries an older catalog; use the explicit source catalog +`WARDEN_ROUTING_CATALOG=/home/worsch/ops-warden/registry/routing/catalog.yaml` +until its next normal installation refresh. This lane authenticates the reader; +it is not a raw secret fetch or retained-file delivery interface. + +Live effective-policy and capability checks passed: only exact data/metadata +read, no sibling secret, parent listing, write or control-plane authority. +A second contained session read existing version 1 into an operator-owned 0600 +file in a private 0700 runtime tmpfs directory. The native consumer exchanged +separate read and consume scopes; Approval Engine verified the read token before +returning 404 for a fresh nonexistent approval, and refused the consume-only +token's read request with 403. No approval was created, bound or consumed. +Both Warden sessions exited 0 after self-revocation/helper cleanup; temporary +credential file and directory were removed. Four refusal/path/redirect tests +pass. Receipts are in platform `docs/evidence/2026-09-14-ccr0019-{reader-preflight,delivery-check}.json`. + +Remaining: an actual nonmember login refusal, real approval claim/consume, +separate narrow requester admission and deployed Informed Decision review with +an explicitly admitted human mandate. The reader group alone grants no review +mandate. T03 and CCR delivery activation remain open; no OpenRouter key was read.