coulomb/audit-core
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(AUDIT-WP-0008): enforce temporary sender expiry
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a025c2-407a-7a32-b40a-f37a52f03f62
This commit is contained in:
tegwick 2026-08-22 11:59:26 +02:00
parent e916c957ea
commit abd22fa0a6
6 changed files with 136 additions and 7 deletions
Download patch file Download diff file Expand all files Collapse all files

12
docs/operator-runbook.md
View file

@ -127,11 +127,13 @@ still apply to every request. The policy is connectivity, not authorization.
A dated `live-e2` engagement may request exactly two temporary identities. Each
identity is bound to `source=whitehat-security`, one named synthetic tenant,
`may_write=true`, and `may_read=true`. Provision token values only through the
sanctioned sender-registry custody lane and the plane's mount-only credential
projection. Never reuse the production `user-engine` identity. Revoke both
identities and remove their registry entries when the plane lease ends; an
engagement is incomplete until that cleanup is evidenced.
`may_write=true`, `may_read=true`, and an RFC3339 `expires_at` no later than the
engagement end. Audit-core evaluates expiry on every authentication, so a stale
registry copy cannot extend the bearer lifetime. Provision token values only
through the sanctioned sender-registry custody lane and the plane's mount-only
credential projection. Never reuse the production `user-engine` identity.
Revoke both identities and remove their registry entries when the plane lease
ends; application expiry is a backstop, not a substitute for evidenced cleanup.
OpenBao path `platform/workloads/audit-core/senders` is the authority for
ExternalSecret `audit-core-senders`. The initial in-cluster registry was