fix(binjovi): permit exact Bytey legacy ownership reads #327

Merged

binjovi-bot merged 1 commit from fix/binjovi-service-observation-access into trunk

2026-09-06 02:11:25 +00:00

sean commented

2026-09-06 02:02:06 +00:00

Owner

Validation: live authorization check returned no before the fix; new source regression contract fails before and passes after; the complete Binjovi source guard and Kustomize render pass. The pending adoption keeps the remote policy retained until this read grant is active.

The Bytey handoff worker cannot prove that a legacy rule is absent: Kubernetes returns403 because the existing provider-authority grant does not include Bytey. Add a separate get-only Role for bytey-main, bytey-trunk and retained bytey-tags, bound only to binjovi/binjovi. Keep the grant after adoption so a recreated legacy owner stops writes. Validation: live authorization check returned no before the fix; new source regression contract fails before and passes after; the complete Binjovi source guard and Kustomize render pass. The pending adoption keeps the remote policy retained until this read grant is active.

sean added 1 commit

2026-09-06 02:02:06 +00:00