coulomb/the-custodian
5
0
Fork 0
Code Issues 1 Pull requests Projects Releases Packages Wiki Activity Actions

docs: verify first original review snapshot

Browse source
This commit is contained in:
codex 2026-10-14 10:58:12 +02:00
parent 55f2090ff9
commit 0d47c32567
2 changed files with 1 additions and 24 deletions
Download patch file Download diff file Expand all files Collapse all files

23
docs/assessments/netkingdom-2026-10-14/scoped-access-handoff.json
View file

@ -1,23 +0,0 @@
{
"workplan": "CUST-WP-0081",
"user_disposition": "Arrange scoped owner access",
"status": "Awaiting owner provisioning; user preference is not evidence of provisioned access",
"owner_repo": "railiance-platform",
"write_access": {
"route": "reuse-surface-hub-write-token",
"kv_path": "platform/workloads/reuse/reuse-surface/runtime-secrets",
"field": "REUSE_SURFACE_TOKEN",
"existing_read_policy": "workload-kv-read-reuse-surface-runtime",
"request": "Owner to admit the caller through the existing scoped route and verify its metadata lookup and selected-field read. Retain existing denial evidence; do not grant administrative or unrelated workload access.",
"delivery": "warden access --exec, without exporting or recording the value"
},
"private_source_access": {
"repositories": ["rapp-openbao", "rapp-policy-nexus", "rapp-postgres", "rapp-sbom-nexus", "rapp-telemetry", "rapp-tenant-engine", "rapp-user-engine"],
"request": "Owner to provision a repository-read credential at the federation hub, confirm source-owner consent to public capability metadata, and verify hub-side index and entry fetches.",
"return_only": ["configured auth_env name", "auth_header name if nondefault", "scope and verification receipts"],
"visibility_change_authorized": false
},
"resume": "Update and retain the exact registration proposal revision with admitted auth_env references, verify source parity, execute bounded registrations, then require all 70 reviewed IDs exactly once in a fresh hosted federation.",
"secret_values_requested_in_chat": false,
"owner_message_sent": false
}

2
workplans/CUST-WP-0081-netkingdom-architecture-review-and-reuse.md
View file

@ -52,7 +52,7 @@ registries and compose a deterministic federation with no missing reviewed IDs.
Verify publication and hosted discovery separately; local establishment alone
does not prove hosted federation. Preserve unrelated worktree changes.
2026-10-14: 70 owner capability entries established across 60 repositories. All source registry commits published and exact remote heads verified. Native local federation and normal plan-check discover all 70; existing unrelated sources retained. Hosted federation exposes 32/70. Thirty-eight registrations remain (31 public, seven private sources). Warden routed the write lane, but OpenBao denied caller access with 403; no helper/hub writes occurred. Private-source credentials/metadata disclosure require owner admission. User selected "Arrange scoped owner access"; provisioning remains unverified. The scoped-access-handoff.json records the exact owner requirements without secret values. Exact plan, denial and verification evidence are in the assessment directory.
2026-10-14: 70 owner capability entries established across 60 repositories. All source registry commits published and exact remote heads verified. Native local federation and normal plan-check discover all 70; existing unrelated sources retained. Hosted federation exposes 32/70. Thirty-eight registrations remain (31 public, seven private sources). Warden routed the write lane, but OpenBao denied caller access with 403; no helper/hub writes occurred. Private-source credentials/metadata disclosure require owner admission. User asked to arrange scoped access or leave hosted establishment pending; no answer recorded. Exact plan, denial and verification evidence are in the assessment directory.
## Audit coverage and record the result