diff --git a/docs/evidence/2026-09-16-t03-renewed-review-handoff.json b/docs/evidence/2026-09-16-t03-renewed-review-handoff.json new file mode 100644 index 0000000..efe0836 --- /dev/null +++ b/docs/evidence/2026-09-16-t03-renewed-review-handoff.json @@ -0,0 +1,42 @@ +{ + "status": "installed", + "memos": [ + { + "memo_id": "SECRETS-WP-0010-T03-apply", + "version": 2, + "approval_id": "9935335c-8e9a-566e-a48e-6a5b5f4882eb", + "principal": "uid=platform-root,ou=people,dc=netkingdom,dc=local", + "packet_hashes": [ + "sha256:9cfe61753f025b3ab476afb16a877caa57081fec94e34313452b2f057be208cf" + ] + }, + { + "memo_id": "SECRETS-WP-0010-T03-verify", + "version": 2, + "approval_id": "273d6882-6253-5dc9-ac54-544f92ef5e56", + "principal": "uid=platform-root,ou=people,dc=netkingdom,dc=local", + "packet_hashes": [ + "sha256:1238cb6fd2dd3c07990b3aa4a30352bea7cf387e82e27cf655235c8c1baacaba" + ] + }, + { + "memo_id": "SECRETS-WP-0010-T03-exec", + "version": 2, + "approval_id": "7ba0c13b-68cd-5b3e-9481-42ba9e385e68", + "principal": "uid=platform-root,ou=people,dc=netkingdom,dc=local", + "packet_hashes": [ + "sha256:105f5f2d589a8ce35b0cae1d429e013789f2b5bb07a177b58c1d4f0f0e2a1cc9" + ] + } + ], + "approval_entries_created": 0, + "human_dispositions_created": 0, + "review_origin": "https://decisions.coulomb.social", + "policy_version": "v2", + "policy_package_digest": "sha256:c47899cb3044fe705a34bb93147c060cc3885967983ade5a52a3c93cda7aa400", + "policy_image": "sha256:e9ade12f1ee3130b4e8d9796d993b2c7234ef51d4fa38981c949802c1422f824", + "readiness": "ready", + "requester_contained_session_exit_code": 0, + "original_approvals_expired": true, + "old_human_entries_reused": false +} diff --git a/workplans/SECRETS-WP-0010-openrouter-native-access.md b/workplans/SECRETS-WP-0010-openrouter-native-access.md index 4651a1a..9c161a0 100644 --- a/workplans/SECRETS-WP-0010-openrouter-native-access.md +++ b/workplans/SECRETS-WP-0010-openrouter-native-access.md @@ -9,7 +9,7 @@ flavor: implementation owner: codex topic_slug: netkingdom created: "2026-09-14" -updated: "2026-09-14" +updated: "2026-09-16" related_workplans: - IR-WP-0004 - FLEX-WP-0026 @@ -233,3 +233,30 @@ those prerequisites pass. The bounded decision-start wait preserves actual validity boundaries; the complete regression suite passed 420 tests. Receipt: docs/evidence/2026-09-14-t03-login-recovery.json; platform attempt: docs/evidence/2026-09-14-t03-attended-delivery-attempt-02.json. + + +### Renewal after Clock deployment — 2026-09-16 + +Original native claims report expired (2026-09-15 00:33 UTC); the earlier advice +not to repeat reviews is superseded by this expiry. No old approval was extended +or copied. The admitted requester created three new 24-hour requests, using +Railiance Clock for token validity and request times; Warden completed with +self-revocation. Exact action/binding digests and installed recipient are unchanged. +New approval IDs: apply 9935335c-8e9a-566e-a48e-6a5b5f4882eb, +verify 273d6882-6253-5dc9-ac54-544f92ef5e56, +exec 7ba0c13b-68cd-5b3e-9481-42ba9e385e68. + +All three existing memo identifiers now have immutable version 2, addressed to +uid=platform-root,ou=people,dc=netkingdom,dc=local. They are published with zero +human dispositions/approval entries. The shared site's seven existing sitting +reviews retain their exact bindings and version-1 mandate in the active policy. +57 local and 20 native caller-policy checks passed; unrelated groups are refused. +The exact frozen execution request/recipient preflight also passed. + +Execution helper now requires an admitted Clock trust file and uses the private +OpenBao relay; its Python environment contains the Clock dependencies. Refresh +its 15-minute boot-bound admission immediately before the attended operation. +T03 remains wait for the real human acknowledgements/acceptance and then native +apply, verify, consume, key check and revocation. No OpenRouter key was read or +inference performed. Review expiry is 2026-09-16 22:28 UTC (September 17 00:28 +Europe/Berlin). Evidence: docs/evidence/2026-09-16-t03-renewed-review-handoff.json.