Per Mos ruling: do not silently freeze the inferred Vault subpaths for the two
new rung DSN secrets. Annotate the §5 secret-matrix rows for
`.../database/runtime-user` and `.../database/runtime-orchestrator` as
PROVISIONAL-CONVENTION — exact subpaths TO-CONFIRM against the live Vault
layout at KBN-101-03/-05 implementation. The secret NAMES remain envelope-fixed;
only the subpath is provisional. Annotation-only; no other edits.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0158NZqN2n2ymKFeJAZ4GUCb
Form A apply-in-place amendment of the frozen native-kanban SSOT, ratifying
the converged KBN-101 Envelope A v6 (rc.20): declarative sink-RBAC + per-role
connection-selection + RLS WITH CHECK/USING write-source + FORCE ROW LEVEL
SECURITY + sink-resident task_status_write_override table on `tasks`.
Contract-doc only — no code, no CI fixture, no KBN-100 file/row invention.
Files:
- KBN-101-DB-ROLE-SPLIT.md: §4 role table (+4 rung rows), role-table F2 note,
§4 L176 CONNECT allowlist (+2 logins; "either"->"any of the three" + NB-5
inline grants), §4 closing rc.20 block + frozen-invariant note, §5 secret
matrix (+2 rung DSN rows), §7 manifest (+KBN-101-10 row, +,10 dep edges on
-02/-03/-05/-06/-08, closing-sentence clause).
- SHARED-CONTRACT.md: rc.6 + rc.5 "Non-effect" pointer clauses; new
### 1.0.0-rc.20 changelog entry.
- MISSION-MANIFEST.md: §10 change-control audit-trail note.
- INDEX.md: index row for the ratified envelope doc.
- KBN-101-ENVELOPE-A.md (new): converged v6 envelope text, verbatim, marked
RATIFIED / part of the frozen SSOT as of this PR.
Ratification lineage: Jason B1 ruling (2026-07-20T23:08Z) + Mos OPTION A +
Mos Q1 (TIER-LEVEL) + Mos Q2 (RLS WITH CHECK, two mandatory conditions) +
Gate A (a11a1e2c) + Gate B (a6aac2cd). HALT-clear per envelope §0-§1.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0158NZqN2n2ymKFeJAZ4GUCb
