19 lines
1.5 KiB
Diff
19 lines
1.5 KiB
Diff
diff --git a/workplans/KEY-WP-0039-openbao-negative-probe-tokens.md b/workplans/KEY-WP-0039-openbao-negative-probe-tokens.md
|
|
index fd0fc46..b22aa6a 100644
|
|
--- a/workplans/KEY-WP-0039-openbao-negative-probe-tokens.md
|
|
+++ b/workplans/KEY-WP-0039-openbao-negative-probe-tokens.md
|
|
@@ -143,8 +143,12 @@ operator/ESO capability and nonmember checks remain independent acceptance.
|
|
acknowledgment): the [infrastructure assessment](../../the-custodian/docs/changes/netkingdom-target-2026-10-17/key39-infra-finalization-r1/ASSESSMENT.md)
|
|
confirms all 14 executable/test/producer-decision pins and three Platform source
|
|
pins still match. Source reviews remain complete: T01/T03 done, T02 wait. Existing
|
|
-source acceptance, resolved registration go caafe4be and the standing attended
|
|
-rule remain valid; no new protocol or blanket approval request is needed. The
|
|
+source acceptance remains valid. Resolved registration go caafe4be covers only
|
|
+the original secrets-engine-openbao client (KEY-WP-0037-T03, deployed 6f79a2af,
|
|
+NK-WP-0046 exact-match helper); it does not authorize new probe clients or
|
|
+coding-client custody, and no renewed original-client approval is requested.
|
|
+The standing attended rule remains separate, for reviewed commands within
|
|
+existing scope; no new protocol or blanket approval request is introduced. The
|
|
remaining sequence is KEY-WP-0038-T02/T03 first-case registration/claims proof,
|
|
admission of the existing coding-client proposal with sanitized owner readiness
|
|
returns, then one attended negative/revoke/cleanup receipt committed with probe
|