honker: REQ-CRED-4 title keeps "only" (sage-1648, duckworth-0076 N1), Duckworth's wording

2026-10-20 20:33:00 -05:00
parent c03d660e74
commit 2884ee496c
1 changed files with 1 additions and 1 deletions
@@ -19,7 +19,7 @@
    { "id": "REQ-CRED-1", "title": "Each role instance has its own Gitea and Vikunja token, held by the broker" },
    { "id": "REQ-CRED-2", "title": "A session that finds only founder credentials stops" },
    { "id": "REQ-CRED-3", "title": "An agent with a grant runs sudo commands on another host through the credential store and never sees the secret" },
-    { "id": "REQ-CRED-4", "title": "Within-role grant actions need no decision with the kind declared, a grant, a live key or token, any command allowlisted" },
+    { "id": "REQ-CRED-4", "title": "A within-role grant action needs no decision only if kind declared, grant, live key or token, any command allowlisted" },
    { "id": "REQ-GRANT-1", "title": "No agent creates a grant; only the chief of staff raises a grant request, as a credential.mint hard wait" },
    { "id": "REQ-GRANT-2", "title": "Only the user's Approve creates a grant; protected stack code does every step, bound to the exact rights" },
    { "id": "REQ-GRANT-3", "title": "The user enters their own tokens in the WebUI or the CLI; only the grant code reads them and no agent sees a value" },