36 lines
1.9 KiB
Diff
36 lines
1.9 KiB
Diff
diff --git a/workplans/FLEX-WP-0024-decision-envelope-authenticity.md b/workplans/FLEX-WP-0024-decision-envelope-authenticity.md
|
|
--- a/workplans/FLEX-WP-0024-decision-envelope-authenticity.md
|
|
+++ b/workplans/FLEX-WP-0024-decision-envelope-authenticity.md
|
|
@@ -184,7 +184,7 @@
|
|
|
|
```task
|
|
id: FLEX-WP-0024-T06
|
|
-status: wait
|
|
+status: progress
|
|
priority: high
|
|
```
|
|
|
|
@@ -197,3 +197,23 @@
|
|
source review. This task owns the producer-side native gate; SECRETS-WP-0014 owns
|
|
consumer admission/enforcement. The old fixture completion never established this
|
|
gate, so the workplan is reopened rather than claiming it already passed.
|
|
+
|
|
+
|
|
+2026-10-16 owner native preparation: T06 is `progress` because Access still owns
|
|
+signer workload declaration, artifact/provenance and source/provider-join preparation;
|
|
+no unqualified cross-owner wait is claimed. Read-only actual release metadata and
|
|
+bounded proposal are in the Custodian
|
|
+`docs/changes/netkingdom-target-2026-10-16/access-native-preparation/`.
|
|
+The real Platform custody route `flex-auth-decision-envelope-signing-key` exists but
|
|
+is draft/nonresolvable; no production kid/public fingerprint, Secret projection or
|
|
+custody receipt is admitted. Coordinate that named commitment through CUST-WP-0080
|
|
+instead of inventing a Platform task/approval. SECRETS-WP-0014-T03 owns installed
|
|
+consumer native verification and must not form a circular blocking dependency.
|
|
+
|
|
+The first proposed native trial only signs the unchanged lifecycle package on the
|
|
+existing retained release; `execute-ccr` remains denied. Current service-pilot
|
|
+`runtime_admission := false` remains mandatory: the source ServicePilotInputs is
|
|
+not yet wired into HTTP, and public service_actor_binding never authenticates the
|
|
+caller. Later activation needs a complete reviewed provider join, exact policy and
|
|
+operation admission, artifact digests, owner execution/rollback proposal and native
|
|
+receipts. Preparation/local synthetic success grants none of those permissions.
|