Repository navigation

Scoped just-in-time operator token grant: extend WorkflowApprovalState so a credential grant names scope, resource, expiry and consuming attempt - #10010

Merged

gunbai-bot[bot] merged 8 commits into

mainfrom

session/cool-fox-125

Sep 2, 2026

Merged

Scoped just-in-time operator token grant: extend WorkflowApprovalState so a credential grant names scope, resource, expiry and consuming attempt#10010
gunbai-bot[bot] merged 8 commits into
mainfrom
session/cool-fox-125

Commits on Sep 2, 2026
- Scoped just-in-time operator token grant: one authorization carrier naming scope, resource, expiry and consuming attempt
  
  gunbc-ci-auto-heal
  and
  claude
  committed
  e550054
- Parameterize the authorization subject, fold the third carrier, and make single-use a CAS transition rather than a check
  
  gunbc-ci-auto-heal
  and
  claude
  committed
  2520dec
- Derive the srv3 intent hash from its subject, and make the witness that guards it discriminate
  
  gunbc-ci-auto-heal
  and
  claude
  committed
  78051a5
- Merge remote-tracking branch 'origin/main' into session/cool-fox-125
  gunbc-ci-auto-heal
  committed
  b0ca2e6
- Adjudicate the four boot-override constant relocations; retire the consumed DCH-1 cohort
  
  gunbc-ci-auto-heal
  and
  claude
  committed
  4a29890
- Merge remote-tracking branch 'origin/main' into session/cool-fox-125
  gunbc-ci-auto-heal
  committed
  8555fe0
- Render every field the scope comparison judges, and the resource's tree with it
  
  gunbc-ci-auto-heal
  and
  claude
  committed
  644db28
- Authorize both capabilities the step exercises, and take the claim before mutating
  
  gunbc-ci-auto-heal
  and
  claude
  committed
  8425d5e