tegwick
919ce25a37
Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a140c4-354a-7823-8f0d-8f717397f786
68 lines
4.7 KiB
JSON
68 lines
4.7 KiB
JSON
{
|
|
"schema": "access-engine.signer-workload-reference.v1",
|
|
"owner_repo": "access-engine",
|
|
"existing_workload": "flex-auth",
|
|
"authoritative_owner_declaration": "tenancy.yaml#/workload_identity",
|
|
"exact_signer_identity_binding": "system:serviceaccount:flex-auth:flex-auth-secrets-engine",
|
|
"declaration_scope": "Existing retained Secrets lifecycle PDP pin; declaration of identity source only. Not a new managed workload, credential grant, zone promotion or live admission.",
|
|
"observed_runtime": {
|
|
"cluster": "railiance01",
|
|
"node_internal_ip": "92.205.62.239",
|
|
"namespace": "flex-auth",
|
|
"release": "flex-auth-secrets-engine",
|
|
"deployment": "flex-auth-secrets-engine",
|
|
"reviewer_service_account": "flex-auth-secrets-engine",
|
|
"source_evidence": "the-custodian/docs/changes/netkingdom-target-2026-10-16/access-native-preparation/live-metadata-r1.json",
|
|
"evidence_sha256": "bafce991e02083ac30c8d6ce15f037dc22087bbb5dc8185c472149b46bca47c2"
|
|
},
|
|
"identity_roles": {
|
|
"signer_workload": "system:serviceaccount:flex-auth:flex-auth-secrets-engine",
|
|
"requesting_consumer": "system:serviceaccount:secrets-engine:secrets-engine",
|
|
"retained_caller_audience": "flex-auth",
|
|
"rule": "Signer custody binds the PDP workload, not the consumer or a human approver. Existing TokenReview reviewer projection does not grant signing-key custody."
|
|
},
|
|
"custody_reference": {
|
|
"catalog_id": "flex-auth-decision-envelope-signing-key",
|
|
"owner_repo": "railiance-platform",
|
|
"current_state": "draft/nonresolvable",
|
|
"proposed_source_path": "platform/workloads/flex-auth/envelope-signing",
|
|
"proposed_private_field": "ED25519_PRIVATE_KEY",
|
|
"required_encoding": "unpadded base64url 32-byte Ed25519 seed; mount0440 allowed, group-write and world permissions refused",
|
|
"public_fields": [
|
|
"ED25519_PUBLIC_KEY",
|
|
"kid"
|
|
],
|
|
"proposed_catalog_workload_reference": {
|
|
"name": "flex-auth",
|
|
"declaration_ref": "access-engine/tenancy.yaml#/workload_identity",
|
|
"exact_binding": "system:serviceaccount:flex-auth:flex-auth-secrets-engine",
|
|
"resolution": "unknown until owner custody and managed-package admission; do not mark resolvable merely from source binding"
|
|
},
|
|
"key_created_or_admitted": false
|
|
},
|
|
"managed_package_limit": {
|
|
"rapp_declaration_ref": null,
|
|
"status": "Existing managed-deployable migration debt remains unknown under security-zones_v0.1 \u00a76; no matching authoritative rapp declaration was established. Existing source tenancy declaration supplies owner identity binding but cannot substitute for managed-package admission.",
|
|
"no_fiction": "Do not invent a rapp tuple or describe this Helm-managed Deployment as an independent operational unit to bypass the rule."
|
|
},
|
|
"unchanged_limits": [
|
|
"tenancy and zones grades are unchanged",
|
|
"service-pilot literal false gate unchanged",
|
|
"human variant unchanged",
|
|
"legacy twelve lifecycle actions remain the selected policy package",
|
|
"no signer Secret name, kid, public fingerprint, custody receipt or rollout permission is supplied"
|
|
],
|
|
"consumer_admission": "Secrets owner independently admits public keys/pins and exact installed verifier; this file never bootstraps trust from PDP discovery.",
|
|
"native_tool": {
|
|
"path": "tools/verify_native_signer_receipt.py",
|
|
"requires": "Installed reviewed Secrets Engine package/helper and independent public admission; source request, authenticated response and original source record for one allow and one deny.",
|
|
"operation": "Offline captured receipt checks only, no network/token input/key build or protected effect. Current clock validation; no CLI backdating option.",
|
|
"result_limits": "Does not prove record durability, real rejected HTTP caller, audit receiver custody, rotation, or authorization to run effect."
|
|
},
|
|
"ci": {
|
|
"trigger": "Existing ordinary push to main when .forgejo/workflows/image.yaml, Containerfile, cmd/**, internal/**, pkg/**, examples/**, go.mod/go.sum or tools/publish-runtime-images.sh changes; workflow_dispatch also exists. This patch changes the workflow, so an authorized push would trigger it.",
|
|
"scope": "Existing container-build runner and already admitted forgejo.coulomb.social/coulomb/flex-auth package only in legacy mode; paired access-engine package publication requires separate existing dispatch authority and is excluded.",
|
|
"provenance_preparation": "Download archive/${REF}.tar.gz using full validated GITHUB_SHA; existing publisher labels org.opencontainers.image.revision and reads back registry manifest digest.",
|
|
"not_invoked": "No push, workflow dispatch, Docker build, image publication or paid resource allocation in this source preparation."
|
|
}
|
|
}
|