2 Commits

Include renames

Author	SHA1	Message	Date
genichin	03bc3dcd8f	docs: add rel-005 production operator runbook and credential matrix (REQ-020~022) ... Release: REL-005_20260512 — Production Operator Runbook and Credential Matrix Requirements Approved (REQ-020~022): - REQ-020: production admin bootstrap and steady-state operator access runbook (Deployment) - REQ-021: release credential matrix and token provenance procedures (Documentation) - REQ-022: operator log access and release evidence recording procedures (Documentation) Batch: BAT-009 - Enhance README.md Production Operator Runbook section with: - Deployment secret custodian role labels - Release approver and production operator role definitions - Credential matrix table (public/read/trade-write/admin permission levels) - Canonical smoke environment specifications - HTTP status code interpretation (401/403/404) - Release evidence recording fields Documentation Updates: - Add README.md Section 2: deployment roles and responsibilities - Add README.md Section 3: 4-tier credential matrix with token usage patterns - Enhance README.md Section 6: smoke test procedures and evidence capture - Add bootstrap/steady-state/break-glass 3-tier access pathway clarification - Create REQ-020 Deployment runbook document - Create REQ-021 credential matrix procedures document - Create REQ-022 operator log access procedures document Discovery & Release: - Update dcy-005 with operator access requirements analysis - Create rel-005 with docs-only profile and deployment notes - Update docs/batches/index.md with BAT-009 entry - Update docs/srs/index.md with REQ-020~022 entries and change log	2026-05-12 23:19:48 +00:00
genichin	2e1298a978	fix: enforce trade-write permission check on v1 ledger trade endpoint ... Security Fix: - Update v1_ledger.py to require trade_write permission instead of read - Fix authentication dependency from require_read to require_trade_write - Ensure trade operations cannot be performed with read-only service tokens Test Coverage: - Add test_v1_ledger_trade_requires_trade_write_permission() to verify permission boundary - Confirm read-only tokens are rejected with 403 Forbidden status - Validate repository methods are not called on permission failure Documentation: - Add new Discovery dcy-005 for production admin bootstrap and operator access - Update docs/discovery/index.md with dcy-005 entry - Update release rel-001 with additional verification notes and issue references	2026-05-11 14:17:27 +00:00