44 lines
3.4 KiB
Diff
44 lines
3.4 KiB
Diff
diff --git a/docs/native-signer-workload.json b/docs/native-signer-workload.json
|
|
--- a/docs/native-signer-workload.json
|
|
+++ b/docs/native-signer-workload.json
|
|
@@ -42,8 +42,15 @@
|
|
},
|
|
"managed_package_limit": {
|
|
"rapp_declaration_ref": null,
|
|
- "status": "Existing managed-deployable migration debt remains unknown under security-zones_v0.1 \u00a76; no matching authoritative rapp declaration was established. Existing source tenancy declaration supplies owner identity binding but cannot substitute for managed-package admission.",
|
|
- "no_fiction": "Do not invent a rapp tuple or describe this Helm-managed Deployment as an independent operational unit to bypass the rule."
|
|
+ "status": "Access selected a minimal package for the independently rolled-back retained Secrets lifecycle PDP under FLEX-WP-0024-T06. Draft source package and exact-source renderer validate locally. Managed-workload identity remains unknown until the reviewed authoritative package declaration is committed and available to the exact Repo Manager resolver; source preparation grants no custody, placement, native rollout or trust.",
|
|
+ "no_fiction": "Do not invent a rapp tuple or describe this Helm-managed Deployment as an independent operational unit to bypass the rule.",
|
|
+ "proposed_owner_selected_reference": {
|
|
+ "rapp_id": "rapp-flex-auth-secrets-engine",
|
|
+ "name": "flex-auth-secrets-engine",
|
|
+ "deployable": "flex-auth-secrets-engine",
|
|
+ "declaration_ref": "rapp-flex-auth-secrets-engine/declarations/rapp.yaml",
|
|
+ "state": "Owner-selected draft extraction; not yet committed/published or independently admitted. Current authoritative resolution stays unknown until reviewed declaration exists."
|
|
+ }
|
|
},
|
|
"unchanged_limits": [
|
|
"tenancy and zones grades are unchanged",
|
|
diff --git a/workplans/FLEX-WP-0024-decision-envelope-authenticity.md b/workplans/FLEX-WP-0024-decision-envelope-authenticity.md
|
|
--- a/workplans/FLEX-WP-0024-decision-envelope-authenticity.md
|
|
+++ b/workplans/FLEX-WP-0024-decision-envelope-authenticity.md
|
|
@@ -272,3 +272,19 @@
|
|
Retained-registry HTTP and production serve proofs and negative joins pass.
|
|
R3 preserves precise notbefore pending separate Approval-owner timestamp fidelity
|
|
repair; no rounding waiver, copied registry algorithm or empty-registry workaround.
|
|
+
|
|
+2026-10-16 owner package extraction preparation: Access selects
|
|
+`rapp-flex-auth-secrets-engine` / workload `flex-auth-secrets-engine` / deployable
|
|
+`flex-auth-secrets-engine`, owned by `access-engine`, for the independently
|
|
+rolled-back retained Secrets lifecycle PDP only. The draft thin package pins
|
|
+current chart/values source and retained image separately; release, namespace,
|
|
+ServiceAccount, policy, registry, audience and caller binding are preserved.
|
|
+Tenant/user/canary deployments and retired `rapp-secrets-engine` are excluded.
|
|
+Normative Railiance Master schema/family validation and exact Repo Manager
|
|
+resolution pass locally; global target ownership is unique. Existing unrelated
|
|
+fleet declaration findings remain visible. Draft readiness and empty reef
|
|
+bindings claim no placement. Package owner review, authoritative declaration
|
|
+commit/availability and exact source-to-runtime join precede managed-workload
|
|
+custody admission. No unmanaged bypass, remote repo/publication, native change
|
|
+or future signer image activation is authorized by this extraction. T06 remains
|
|
+`progress`; no second work item duplicates this bounded dependency.
|