aaronrene / knowtation public
BREAKING feat/sec-kn-5-delegation-ttl-viewer-mint #1 / 1
aaronrene · 44 days ago · Jul 27, 2026 · Diff

SEC-KN-5 DONE: clamp policy TTL + admin-only grant mint.

P12: readVaultDelegationPolicy clamps max_ttl_seconds to MAX_TTL_SECONDS (86400) so a vault policy cannot widen SD-10. P13: self-hosted POST /api/v1/delegation/grants requires admin only.

Seven-tier tests with security regressions vs unclamped legacy and viewer-inclusive mint. Build verification round 1 = pass. Governance sync (SD-17): ROADMAP + OVERSEER-HANDOVER. NEXT = SEC-KN-6. T1-T4 not executed. No merge, no deploy.

sha256:e2d9ce01ed1ec04982dac8503908c2bf2042c3924fde0a4bd759b22e8dabccbb sha
sha256:94bb4056f7a1ed291ff0bfc8c0f3a306df9b5c773e87275195062ce072bd259e parent
+9 ~18 symbols
sha256:a5d6548cd6a2dc73c4aa4fb852e033985e1cfae5e682a279d4dcdbec4f64864c snapshot
+9
symbols added
~18
symbols modified
0
dead code introduced
Semantic Changes 27 symbols
~ test/sec-kn-5-delegation-ttl-viewer-mint.test.mjs .mjs 6 symbols added
+ grantMintRoleAllowedFixed function function grantMintRoleAllowedFixed L82–84
+ grantMintRoleAllowedLegacy function function grantMintRoleAllowedLegacy L73–75
+ mkDataDir function function mkDataDir L104–106
+ readVaultDelegationPolicyLegacyUnclamped function function readVaultDelegationPolicyLegacyUnclamped L48–66
+ seedAndMint function function seedAndMint L112–129
+ writePolicy function function writePolicy L90–102
~ docs/OVERSEER-HANDOVER.md .md 3 symbols added, 12 symbols modified
~ NEXT SESSION — SEC-KN-5 (PRIMARY)
~ Prior session — SEC-KN-3a BV round 1 = pass
~ code[text]
+ NEXT SESSION — SEC-KN-6 (PRIMARY) section NEXT SESSION — SEC-KN-6 (PRIMARY) L20–52
+ Prior session — SEC-KN-5 BV round 1 = pass section Prior session — SEC-KN-5 BV round 1 = pass L41–52
+ code[text] variable variable code[text] L30–40
~ Overseer Handover — Knowtation
~ Change log
~ table
~ NEXT SESSION — archived SEC-KN-4b build prompt
~ Governance gates checklist
~ Knowtation-owned findings (from Pass 2)
~ table
~ Verified snapshot (what exists now)
~ table
~ docs/ROADMAP.md .md 5 symbols modified
~ Roadmap — knowtation
~ Build queue
~ table
~ Current status (2026-07-26)
~ table
~ hub/server.mjs .mjs
~ lib/agent/delegation.mjs .mjs 1 symbol modified
~ readVaultDelegationPolicy
~ test/hub-delegation-self-hosted-route.test.mjs .mjs
← Older Oldest on feat/sec-kn-5-delegation-ttl-viewer-mint
All commits
Newer → Latest on feat/sec-kn-5-delegation-ttl-viewer-mint

0 comments

No comments yet. Be the first to start the discussion.

To add a comment, use the Muse CLI: muse hub commit comment sha256:e2d9ce01ed1ec04982dac8503908c2bf2042c3924fde0a4bd759b22e8dabccbb --body "your comment"