diff --git a/docs/assessments/netkingdom-2026-10-14/scoped-access-handoff.json b/docs/assessments/netkingdom-2026-10-14/scoped-access-handoff.json deleted file mode 100644 index f9525b84..00000000 --- a/docs/assessments/netkingdom-2026-10-14/scoped-access-handoff.json +++ /dev/null @@ -1,23 +0,0 @@ -{ - "workplan": "CUST-WP-0081", - "user_disposition": "Arrange scoped owner access", - "status": "Awaiting owner provisioning; user preference is not evidence of provisioned access", - "owner_repo": "railiance-platform", - "write_access": { - "route": "reuse-surface-hub-write-token", - "kv_path": "platform/workloads/reuse/reuse-surface/runtime-secrets", - "field": "REUSE_SURFACE_TOKEN", - "existing_read_policy": "workload-kv-read-reuse-surface-runtime", - "request": "Owner to admit the caller through the existing scoped route and verify its metadata lookup and selected-field read. Retain existing denial evidence; do not grant administrative or unrelated workload access.", - "delivery": "warden access --exec, without exporting or recording the value" - }, - "private_source_access": { - "repositories": ["rapp-openbao", "rapp-policy-nexus", "rapp-postgres", "rapp-sbom-nexus", "rapp-telemetry", "rapp-tenant-engine", "rapp-user-engine"], - "request": "Owner to provision a repository-read credential at the federation hub, confirm source-owner consent to public capability metadata, and verify hub-side index and entry fetches.", - "return_only": ["configured auth_env name", "auth_header name if nondefault", "scope and verification receipts"], - "visibility_change_authorized": false - }, - "resume": "Update and retain the exact registration proposal revision with admitted auth_env references, verify source parity, execute bounded registrations, then require all 70 reviewed IDs exactly once in a fresh hosted federation.", - "secret_values_requested_in_chat": false, - "owner_message_sent": false -} diff --git a/workplans/CUST-WP-0081-netkingdom-architecture-review-and-reuse.md b/workplans/CUST-WP-0081-netkingdom-architecture-review-and-reuse.md index a1174fc2..dc739a4c 100644 --- a/workplans/CUST-WP-0081-netkingdom-architecture-review-and-reuse.md +++ b/workplans/CUST-WP-0081-netkingdom-architecture-review-and-reuse.md @@ -52,7 +52,7 @@ registries and compose a deterministic federation with no missing reviewed IDs. Verify publication and hosted discovery separately; local establishment alone does not prove hosted federation. Preserve unrelated worktree changes. -2026-10-14: 70 owner capability entries established across 60 repositories. All source registry commits published and exact remote heads verified. Native local federation and normal plan-check discover all 70; existing unrelated sources retained. Hosted federation exposes 32/70. Thirty-eight registrations remain (31 public, seven private sources). Warden routed the write lane, but OpenBao denied caller access with 403; no helper/hub writes occurred. Private-source credentials/metadata disclosure require owner admission. User selected "Arrange scoped owner access"; provisioning remains unverified. The scoped-access-handoff.json records the exact owner requirements without secret values. Exact plan, denial and verification evidence are in the assessment directory. +2026-10-14: 70 owner capability entries established across 60 repositories. All source registry commits published and exact remote heads verified. Native local federation and normal plan-check discover all 70; existing unrelated sources retained. Hosted federation exposes 32/70. Thirty-eight registrations remain (31 public, seven private sources). Warden routed the write lane, but OpenBao denied caller access with 403; no helper/hub writes occurred. Private-source credentials/metadata disclosure require owner admission. User asked to arrange scoped access or leave hosted establishment pending; no answer recorded. Exact plan, denial and verification evidence are in the assessment directory. ## Audit coverage and record the result