honker: REQ-CRED-4 title matches its text (sage-1644, duckworth-0075 N1): a live key or token, and an allowlisted command only when there is one

2026-10-20 20:31:47 -05:00
parent 46c8adaebf
commit c03d660e74
1 changed files with 1 additions and 1 deletions
@@ -19,7 +19,7 @@
    { "id": "REQ-CRED-1", "title": "Each role instance has its own Gitea and Vikunja token, held by the broker" },
    { "id": "REQ-CRED-2", "title": "A session that finds only founder credentials stops" },
    { "id": "REQ-CRED-3", "title": "An agent with a grant runs sudo commands on another host through the credential store and never sees the secret" },
-    { "id": "REQ-CRED-4", "title": "A within-role grant action needs no decision only with its kind declared, a grant, an allowlisted command and a live key" },
+    { "id": "REQ-CRED-4", "title": "Within-role grant actions need no decision with the kind declared, a grant, a live key or token, any command allowlisted" },
    { "id": "REQ-GRANT-1", "title": "No agent creates a grant; only the chief of staff raises a grant request, as a credential.mint hard wait" },
    { "id": "REQ-GRANT-2", "title": "Only the user's Approve creates a grant; protected stack code does every step, bound to the exact rights" },
    { "id": "REQ-GRANT-3", "title": "The user enters their own tokens in the WebUI or the CLI; only the grant code reads them and no agent sees a value" },