Admit the two authenticated independent object-store POST routes

sean commented

2026-09-10 21:45:13 +00:00

Owner

The new credential report reached Oathkeeper but returned 404 because its POST route was absent from the explicit allowlist. Add the exact agent credential-report and operator reconcile routes with the existing JWT/session and signed identity chains. Binjovi continues to enforce the lane, image, release authority, empty payload and idempotency key. General API methods remain GET/HEAD.

Validation: the new route contract fails before the change and passes after it; the complete Ory check suite and clean diff checks pass. After deployment, verify live agent reporting, reconciliation proofs and ordinary catalog cutover.

The new credential report reached Oathkeeper but returned 404 because its POST route was absent from the explicit allowlist. Add the exact agent credential-report and operator reconcile routes with the existing JWT/session and signed identity chains. Binjovi continues to enforce the lane, image, release authority, empty payload and idempotency key. General API methods remain GET/HEAD. Validation: the new route contract fails before the change and passes after it; the complete Ory check suite and clean diff checks pass. After deployment, verify live agent reporting, reconciliation proofs and ordinary catalog cutover.

sean added 1 commit

2026-09-10 21:45:13 +00:00