access-engine/docs/native-signer-workload.json

{
  "schema": "access-engine.signer-workload-reference.v1",
  "owner_repo": "access-engine",
  "existing_workload": "flex-auth",
  "authoritative_owner_declaration": "tenancy.yaml#/workload_identity",
  "exact_signer_identity_binding": "system:serviceaccount:flex-auth:flex-auth-secrets-engine",
  "declaration_scope": "Existing retained Secrets lifecycle PDP pin; declaration of identity source only. Not a new managed workload, credential grant, zone promotion or live admission.",
  "observed_runtime": {
    "cluster": "railiance01",
    "node_internal_ip": "92.205.62.239",
    "namespace": "flex-auth",
    "release": "flex-auth-secrets-engine",
    "deployment": "flex-auth-secrets-engine",
    "reviewer_service_account": "flex-auth-secrets-engine",
    "source_evidence": "the-custodian/docs/changes/netkingdom-target-2026-10-16/access-native-preparation/live-metadata-r1.json",
    "evidence_sha256": "bafce991e02083ac30c8d6ce15f037dc22087bbb5dc8185c472149b46bca47c2"
  },
  "identity_roles": {
    "signer_workload": "system:serviceaccount:flex-auth:flex-auth-secrets-engine",
    "requesting_consumer": "system:serviceaccount:secrets-engine:secrets-engine",
    "retained_caller_audience": "flex-auth",
    "rule": "Signer custody binds the PDP workload, not the consumer or a human approver. Existing TokenReview reviewer projection does not grant signing-key custody."
  },
  "custody_reference": {
    "catalog_id": "flex-auth-decision-envelope-signing-key",
    "owner_repo": "railiance-platform",
    "current_state": "draft/nonresolvable",
    "proposed_source_path": "platform/workloads/flex-auth/envelope-signing",
    "proposed_private_field": "ED25519_PRIVATE_KEY",
    "required_encoding": "unpadded base64url 32-byte Ed25519 seed; mount0440 allowed, group-write and world permissions refused",
    "public_fields": [
      "ED25519_PUBLIC_KEY",
      "kid"
    ],
    "proposed_catalog_workload_reference": {
      "rapp_id": "rapp-flex-auth-secrets-engine",
      "name": "flex-auth-secrets-engine",
      "deployable": "flex-auth-secrets-engine",
      "declaration_ref": "rapp-flex-auth-secrets-engine/declarations/rapp.yaml",
      "declaration_commit": "d52f811ed5ec0be27c9c367e71d476125b3228be",
      "exact_binding": "system:serviceaccount:flex-auth:flex-auth-secrets-engine",
      "resolution": "Local source tuple resolves draft. This is an owner-proposed catalog pointer only; actual Platform catalog/custody is unchanged and remains pending admission."
    },
    "key_created_or_admitted": false
  },
  "managed_package_limit": {
    "rapp_declaration_ref": "rapp-flex-auth-secrets-engine/declarations/rapp.yaml",
    "status": "Canonical local package declaration now exists at exact recorded commit/hash. Repo Manager resolves the exact tuple/deployable under /home/worsch with ownership_repo access-engine and readiness draft. Existing unrelated rapp-forgejo declaration_missing remains visible. This source resolution does not claim central registration, private source access/placement, reef admission, signer custody, native deployment or independent consumer trust.",
    "no_fiction": "Do not invent a rapp tuple or describe this Helm-managed Deployment as an independent operational unit to bypass the rule.",
    "owner_selected_reference": {
      "rapp_id": "rapp-flex-auth-secrets-engine",
      "name": "flex-auth-secrets-engine",
      "deployable": "flex-auth-secrets-engine",
      "declaration_ref": "rapp-flex-auth-secrets-engine/declarations/rapp.yaml",
      "declaration_commit": "d52f811ed5ec0be27c9c367e71d476125b3228be",
      "declaration_tree": "d4fbad71bdc8ef870603526ccd1f53195d0322af",
      "declaration_sha256": "0b722431bc5162dd86f72b15f12424e149aca8f2a8790adf2c57e8511ea73b4c",
      "local_resolver_root": "/home/worsch",
      "local_resolution": "resolved",
      "readiness_state": "draft",
      "scope": "Committed canonical local declaration and exact local source resolution only; no central/private read-placement, reef binding, custody, live deployment or consumer trust admission."
    }
  },
  "unchanged_limits": [
    "tenancy and zones grades are unchanged",
    "service-pilot literal false gate unchanged",
    "human variant unchanged",
    "legacy twelve lifecycle actions remain the selected policy package",
    "no signer Secret name, kid, public fingerprint, custody receipt or rollout permission is supplied"
  ],
  "consumer_admission": "Secrets owner independently admits public keys/pins and exact installed verifier; this file never bootstraps trust from PDP discovery.",
  "native_tool": {
    "path": "tools/verify_native_signer_receipt.py",
    "requires": "Installed reviewed Secrets Engine package/helper and independent public admission; source request, authenticated response and original source record for one allow and one deny.",
    "operation": "Offline captured receipt checks only, no network/token input/key build or protected effect. Current clock validation; no CLI backdating option.",
    "result_limits": "Does not prove record durability, real rejected HTTP caller, audit receiver custody, rotation, or authorization to run effect."
  },
  "ci": {
    "trigger": "Existing ordinary push to main when .forgejo/workflows/image.yaml, Containerfile, cmd/**, internal/**, pkg/**, examples/**, go.mod/go.sum or tools/publish-runtime-images.sh changes; workflow_dispatch also exists. This patch changes the workflow, so an authorized push would trigger it.",
    "scope": "Existing container-build runner and already admitted forgejo.coulomb.social/coulomb/flex-auth package only in legacy mode; paired access-engine package publication requires separate existing dispatch authority and is excluded.",
    "provenance_preparation": "Download archive/${REF}.tar.gz using full validated GITHUB_SHA; existing publisher labels org.opencontainers.image.revision and reads back registry manifest digest.",
    "not_invoked": "No push, workflow dispatch, Docker build, image publication or paid resource allocation in this source preparation."
  }
}