Repository navigation

R2 mint custody cells granted by iam-converge (grant sets); bootstrap creates bare custody containers (B') - #13298

Merged

gunbai-bot[bot] merged 32 commits into

mainfrom

r2-custody-iam-reach

Oct 5, 2026

Merged

R2 mint custody cells granted by iam-converge (grant sets); bootstrap creates bare custody containers (B')#13298
gunbai-bot[bot] merged 32 commits into
mainfrom
r2-custody-iam-reach

Commits on Sep 28, 2026
Commits on Sep 29, 2026
Commits on Oct 4, 2026
- r2_mint_secret_access: custody cells for the two fabric-workspace token secrets
  
  gunbc-ci-auto-heal
  and
  claude
  committed
  8c625a2
- Merge main into the #12565 IAM bootstrap; its new GCP operations declare requires Network like main's
  
  Brian Searls
  and
  claude
  committed
  4358bae
- Merge remote-tracking branch 'origin/workspace-secret-cells' into r2-custody-iam-reach
  gunbc-ci-auto-heal
  committed
  bc3803d
- B': R2 custody cells granted by iam-converge as a gcp_iam_converge grant set; bootstrap creates bare custody containers
  gunbc-ci-auto-heal
  committed
  d653bce
- gcp_iam_bootstrap: enumerate closed-coproduct match arms (main's non-fold-residue gate refused 16 wildcard sites)
  
  Brian Searls
  and
  claude
  committed
  c88dfdc
- gcp_iam_converge witness: qualify attempt_identity_of (ambiguous with approval_run_identity)
  gunbc-ci-auto-heal
  committed
  cc341f6
- gcp_iam_converge witness: qualify attempt_identity_of (ambiguous with gunbc.auth.approval_run_identity's; same fix quick-moth-82 verified 24/24)
  
  Brian Searls
  and
  claude
  committed
  f407722
- Merge gcp-iam-bootstrap-land (snappy-wolf-887 head) into r2-custody-iam-reach
  gunbc-ci-auto-heal
  committed
  a0ff5cd
- Discriminating claims: custody container decision (created only when absent, never retried), grant member is the convergence principal, census realizes R2 cells federated
  gunbc-ci-auto-heal
  committed
  3ce00cb
- Custody create journal: an ambiguous CreateSecret blocks every later automatic create until observed present or operator-disposed (reuses #13291's election journal)
  gunbc-ci-auto-heal
  committed
  d601416
- Custody create journal: marks are read and must carry the exact wire; the listing only discovers candidate operations
  gunbc-ci-auto-heal
  committed
  c3967a8
- Merge origin/main (#13291 landed squashed as 5a41955d8b) into r2-custody-iam-reach
  gunbc-ci-auto-heal
  committed
  47d226f
- Drop tools/tests/dag_validation_closure.py: #13291's squash on main removed it; this branch never changed it
  gunbc-ci-auto-heal
  committed
  4260bf8
- One declaration of the grant-set payload permissions (review 75839 / 75902): gcp_iam_converge grant_set_payload_permissions, read by the readback, the bootstrap probe and the witness
  gunbc-ci-auto-heal
  committed
  73b206e
- Remove stray local run scripts .mb.sh and .mc.sh committed by accident
  gunbc-ci-auto-heal
  committed
  5773807

Navigation Menu

Repository navigation

R2 mint custody cells granted by iam-converge (grant sets); bootstrap creates bare custody containers (B') - #13298

R2 mint custody cells granted by iam-converge (grant sets); bootstrap creates bare custody containers (B')#13298
gunbai-bot[bot] merged 32 commits into
mainfrom
r2-custody-iam-reach

Commits on Sep 28, 2026

Bootstrap the approval-gated GCP IAM workflow from declared authorities

Anchor the IAM deny API model to its external authority

Record native bootstrap qualification and deny-policy permission refusal

Record fresh-token retry at the IAM deny-policy permission boundary

Converge temporary deny authority as a recoverable bootstrap dependency

Bind deny authority to verified organization ancestry and bounded convergence

Keep temporary-authority retirement independent of deny installation success

Bind bootstrap authority to the verified Google subject and IAM email

Record live bootstrap authority convergence and remaining pool policy boundary

Commits on Sep 29, 2026

Model exclusive empty pool IAM initialization with single-publication recovery

Record exclusive pool initialization controls and credential dependency

Converge temporary exact-account token authority for bootstrap readback

Allow bounded IAM propagation and retain verified probe cleanup receipt

Converge required GCP APIs before bootstrap identity and privilege checks

Record successful IAM bootstrap and start independent approval-workflow acceptance

Record successful workflow observer authentication after bootstrap

Record successful approval-gated GCP workflow recovery and readback

Commits on Oct 4, 2026

r2_mint_secret_access: custody cells for the two fabric-workspace token secrets

Merge main into the #12565 IAM bootstrap; its new GCP operations declare requires Network like main's

Merge remote-tracking branch 'origin/workspace-secret-cells' into r2-custody-iam-reach

B': R2 custody cells granted by iam-converge as a gcp_iam_converge grant set; bootstrap creates bare custody containers

gcp_iam_bootstrap: enumerate closed-coproduct match arms (main's non-fold-residue gate refused 16 wildcard sites)

gcp_iam_converge witness: qualify attempt_identity_of (ambiguous with approval_run_identity)

gcp_iam_converge witness: qualify attempt_identity_of (ambiguous with gunbc.auth.approval_run_identity's; same fix quick-moth-82 verified 24/24)

Merge gcp-iam-bootstrap-land (snappy-wolf-887 head) into r2-custody-iam-reach

Discriminating claims: custody container decision (created only when absent, never retried), grant member is the convergence principal, census realizes R2 cells federated

Custody create journal: an ambiguous CreateSecret blocks every later automatic create until observed present or operator-disposed (reuses #13291's election journal)

Custody create journal: marks are read and must carry the exact wire; the listing only discovers candidate operations

Merge origin/main (#13291 landed squashed as 5a41955d8b) into r2-custody-iam-reach

Drop tools/tests/dag_validation_closure.py: #13291's squash on main removed it; this branch never changed it

One declaration of the grant-set payload permissions (review 75839 / 75902): gcp_iam_converge grant_set_payload_permissions, read by the readback, the bootstrap probe and the witness

Remove stray local run scripts .mb.sh and .mc.sh committed by accident