Record approved v7 rollout and prepare p01 for loading
Assistant: codex Assistant-Model: gpt-6.1-sol Assistant-Session: 01a1029c-c003-7283-acc9-930b434e6cae
This commit is contained in:
parent
027423610c
commit
cf708ed95f
9 changed files with 192 additions and 5 deletions
|
|
@ -3,8 +3,8 @@
|
|||
"policy": {
|
||||
"origin": "http://flex-auth-informed-decision-sitting.flex-auth.svc.cluster.local:8080",
|
||||
"package": "informed-decision.compact-sitting",
|
||||
"version": "v6",
|
||||
"package_digest": "sha256:28702426ca0049500549a8acc576e70fa82e892f169e74e49cf838802447e429",
|
||||
"version": "v7",
|
||||
"package_digest": "sha256:2490955f175c52574543e210be06f468a01e56c778d38d4fdcad731875e37cc7",
|
||||
"pod_name": "flex-auth-informed-decision-sitting"
|
||||
},
|
||||
"keycape_egress_ips": [
|
||||
|
|
|
|||
|
|
@ -1,7 +1,9 @@
|
|||
# p01 admission rollout candidate — awaiting founder approval
|
||||
# p01 admission rollout — deployed 2026-10-03
|
||||
|
||||
Authority required: ADMINISTER @ realm:kubernetes/railiance01,
|
||||
activation=APPROVED, for the two changes below. No live rollout has run.
|
||||
activation=APPROVED, for the two changes below. Founder approved with
|
||||
"deploy v7" on 2026-10-03. Both changes completed; Helm revision 8 and
|
||||
review readiness verified. Previous policy Helm revision: 7.
|
||||
|
||||
1. Helm release `flex-auth-informed-decision-sitting`, namespace `flex-auth`:
|
||||
update only its image to the CI build of access-engine commit `f946c7b`:
|
||||
|
|
|
|||
15
docs/batches/2026-10-03-provisioning-window/bound/index.json
Normal file
15
docs/batches/2026-10-03-provisioning-window/bound/index.json
Normal file
|
|
@ -0,0 +1,15 @@
|
|||
{
|
||||
"kind": "informed-decision-bound-sitting",
|
||||
"sitting_id": "infd-sitting-2026-10-03-provisioning-window",
|
||||
"principal": "uid=platform-root,ou=people,dc=netkingdom,dc=local",
|
||||
"submitted": false,
|
||||
"agent_disposition_forbidden": true,
|
||||
"memos": [
|
||||
{
|
||||
"memo_id": "infd-20261003-p01",
|
||||
"approval_id": "706f4205-aaa7-44f6-be30-d0f57664d69c",
|
||||
"memo": "infd-20261003-p01.memo.json",
|
||||
"packet": "infd-20261003-p01.packet.md"
|
||||
}
|
||||
]
|
||||
}
|
||||
|
|
@ -0,0 +1 @@
|
|||
{"approval_binding_digest":"sha256:c8a1a9c8fb22616e3aacfb877ba7974feb5eedaed491f856a6c90719c502ebe4","approval_id":"706f4205-aaa7-44f6-be30-d0f57664d69c","binding":{"justification":null,"principal":{"display_name":"uid=platform-root,ou=people,dc=netkingdom,dc=local","id":"uid=platform-root,ou=people,dc=netkingdom,dc=local","identifiers":[],"kind":"person","role":"reviewer"},"target":{"environment":"prod","id":"ccr:CCR-2026-0019-delivery-proof","kind":"credential-lane","label":"secrets-engine approval-client reader, scoped delivery proof","requires_new_bind":false},"terms":null},"binding_level":"organizational","brief":"Reader 1 (CCR-2026-0019, applied 2026-09-14) already ran its scoped delivery proof under the attended reader lane and the receipts say passed. RPF-WP-0035-T06 waits only on a human accepting that proof. Accepting runs nothing, delivers no credential and changes no OpenBao object. It does not close T06 by itself.","highlights":[{"id":"infd-20261003-p01-h1","item_id":"infd-20261003-p01-packet","locator":{"kind":"work_record","task":"RPF-WP-0035-T06","workplan":"RPF-WP-0035"},"note":"Known gaps you accept: the wrong-group human login is untested, and the read check used a nonexistent approval id (HTTP 404 proves authenticated routing, not a usable claim). The proof is from 2026-09-13 and is not re-run. Accepting does not close RPF-WP-0035-T06: the CCR-2026-0018 coordinated disablement still needs KeyCape and Approval Engine confirmation, and the file-delivered secret's removal depends on operator hygiene.","required_ack":true,"severity":"critical"}],"id":"infd-20261003-p01","locale":"en","packet":[{"hash":"sha256:ee53cae14ae86dbdec2936d72f99e1285b6c714d5bd322ef30df8ffbf0939ff2","item_id":"infd-20261003-p01-packet","label":"infd-20261003-p01-packet"}],"question":"Accept the passed 2026-09-13 scoped delivery proof for the CCR-2026-0019 secrets-engine approval-client reader as that reader's native delivery acceptance?","requested_act":"approve","sealed":false,"step_kind":"approve","ui_release":"informed-decision@0.2.0","version":1}
|
||||
|
|
@ -0,0 +1,64 @@
|
|||
# RPF-WP-0035-T06 — accept the CCR-2026-0019 scoped delivery proof
|
||||
|
||||
Blocking workplan: RPF-WP-0035 (railiance-platform)
|
||||
Blocking task: RPF-WP-0035-T06 (hub prefix 68bff751)
|
||||
Hub decision: 62aa95e4-3ccc-4867-8806-5e3db005b483 (D1, attended provisioning window)
|
||||
Design: railiance-platform `docs/credential-lane-designs/keycape-approval-client-side-readers.md`
|
||||
Request: railiance-platform `credential-change-requests/CCR-2026-0019-secrets-engine-approval-client-read.yaml` (status `applied`)
|
||||
|
||||
## Question
|
||||
Accept the passed 2026-09-13 scoped delivery proof for the CCR-2026-0019
|
||||
secrets-engine approval-client reader as that reader's native delivery acceptance?
|
||||
|
||||
## One act
|
||||
Record a human acceptance of a proof that has already run. Nothing executes
|
||||
because of this memo. No OpenBao, KeyCape or cluster object changes.
|
||||
|
||||
## What already ran (reference only)
|
||||
Both under the attended reader lane, never the platform-admin lane:
|
||||
|
||||
```sh
|
||||
warden access secrets-engine-approval-client-login --exec -- \
|
||||
python3 /home/worsch/railiance-platform/scripts/approval-client-reader-preflight.py
|
||||
warden access secrets-engine-approval-client-login --exec -- \
|
||||
/home/worsch/secrets-engine/.venv/bin/python -B \
|
||||
/home/worsch/railiance-platform/scripts/approval-client-delivery-check.py
|
||||
```
|
||||
|
||||
## Non-secret receipts (railiance-platform `docs/evidence/`)
|
||||
- `2026-09-14-ccr0019-operator-binding.json` — role/policy apply and readback
|
||||
- `2026-09-14-ccr0019-reader-preflight.json` — `status: passed`, `secret_values_read: false`
|
||||
- `2026-09-14-ccr0019-delivery-check.json` — `status: passed`, `approval_mutations: false`, `cleanup: true`
|
||||
|
||||
## Positive evidence the owner expects
|
||||
- Exact read of `platform/data|metadata/workloads/secrets-engine/approval-client`
|
||||
- Private delivery of the existing version-1 value; private runtime file removed
|
||||
- `approval:read` token reaches Approval Engine authenticated (HTTP 404 on a fresh id)
|
||||
- Warden session exited 0 after self-revocation and helper cleanup
|
||||
|
||||
## Negative evidence the owner expects
|
||||
- Denied: sibling `approval-engine/operator-client`, parent metadata/listing,
|
||||
an unrelated workload path, policy read, role read
|
||||
- `approval:consume` token refused on the read route (HTTP 403); no real approval consumed
|
||||
|
||||
## Known gaps (required acknowledgement)
|
||||
- Wrong-group human login untested.
|
||||
- The 404 read proves routing, not a usable claim on a real approval.
|
||||
- File delivery outlives the reading process; removal is operator hygiene.
|
||||
|
||||
## Rollback / revocation (CCR-2026-0019 lifecycle)
|
||||
- Deactivate: detach policy `workload-kv-read-secrets-engine-approval-client` from
|
||||
role `secrets-engine-approval-client-workload-kv-read`; disable the ops-warden
|
||||
catalog entry. The KeyCape verifier lane is unaffected.
|
||||
- Compromise: KeyCape disables the `secrets-engine-approval` registration first,
|
||||
then the value is rotated (shared with CCR-2026-0017) and the policy detached.
|
||||
|
||||
## Not decided here
|
||||
- CCR-2026-0018 retention or coordinated disablement (KeyCape + Approval Engine
|
||||
+ Platform). T06 stays open until both owners confirm that sequence.
|
||||
- Any rotation, reseed, `approval:consume` grant, or CCR-2026-0020 (cancelled).
|
||||
|
||||
## Must not
|
||||
- Display or paste the client secret
|
||||
- Re-run the proof as a substitute for this acceptance
|
||||
- Treat acceptance as authority for any other lane in the D1 window
|
||||
|
|
@ -0,0 +1 @@
|
|||
{"scope": "live review workload caller, synthetic reviewer; no presentations or dispositions", "policy_version": "v7", "package_digest": "sha256:2490955f175c52574543e210be06f468a01e56c778d38d4fdcad731875e37cc7", "checks": [{"check": "exact-p01", "outcome": "allow"}, {"check": "wrong-group", "outcome": "policy_denied"}, {"check": "unknown-memo", "outcome": "policy_denied"}, {"check": "changed-digest", "outcome": "policy_denied"}, {"check": "no-caller-token", "http": 401}], "decision_attributable": false}
|
||||
|
|
@ -0,0 +1,15 @@
|
|||
{
|
||||
"origin": "https://decisions.coulomb.social",
|
||||
"healthz": {
|
||||
"http": 200,
|
||||
"status": "ok"
|
||||
},
|
||||
"readyz": {
|
||||
"http": 200,
|
||||
"status": "ready"
|
||||
},
|
||||
"auth_start": {
|
||||
"http": 303,
|
||||
"location_host": "kc.coulomb.social"
|
||||
}
|
||||
}
|
||||
68
docs/evidence/2026-10-03-provisioning-window-v7-rollout.json
Normal file
68
docs/evidence/2026-10-03-provisioning-window-v7-rollout.json
Normal file
|
|
@ -0,0 +1,68 @@
|
|||
{
|
||||
"observed_at": "2026-10-03T18:02:15.288390+00:00",
|
||||
"authority": {
|
||||
"mode": "ADMINISTER",
|
||||
"scope": "realm:kubernetes/railiance01",
|
||||
"activation": "APPROVED",
|
||||
"source": "founder instruction: deploy v7"
|
||||
},
|
||||
"policy": {
|
||||
"helm_revision": 8,
|
||||
"previous_revision": 7,
|
||||
"image": "forgejo.coulomb.social/coulomb/flex-auth@sha256:f6fa2062f7095e66c7a91f20cd130914b5481d46d9d909339e028f7ecdf0065d",
|
||||
"generation": 8,
|
||||
"available_replicas": 1
|
||||
},
|
||||
"review": {
|
||||
"configmap": "informed-decision-runtime-b800648bd80b",
|
||||
"previous_configmap": "informed-decision-runtime-5c11925287fa",
|
||||
"image": "forgejo.coulomb.social/coulomb/informed-decision@sha256:0557edffb0efccc2e283cb878bc3f85deacd8165b45eefde830c21f6f02710c8",
|
||||
"generation": 16,
|
||||
"available_replicas": 1
|
||||
},
|
||||
"checks": {
|
||||
"scope": "live review workload caller, synthetic reviewer; no presentations or dispositions",
|
||||
"policy_version": "v7",
|
||||
"package_digest": "sha256:2490955f175c52574543e210be06f468a01e56c778d38d4fdcad731875e37cc7",
|
||||
"checks": [
|
||||
{
|
||||
"check": "exact-p01",
|
||||
"outcome": "allow"
|
||||
},
|
||||
{
|
||||
"check": "wrong-group",
|
||||
"outcome": "policy_denied"
|
||||
},
|
||||
{
|
||||
"check": "unknown-memo",
|
||||
"outcome": "policy_denied"
|
||||
},
|
||||
{
|
||||
"check": "changed-digest",
|
||||
"outcome": "policy_denied"
|
||||
},
|
||||
{
|
||||
"check": "no-caller-token",
|
||||
"http": 401
|
||||
}
|
||||
],
|
||||
"decision_attributable": false
|
||||
},
|
||||
"origin": {
|
||||
"origin": "https://decisions.coulomb.social",
|
||||
"healthz": {
|
||||
"http": 200,
|
||||
"status": "ok"
|
||||
},
|
||||
"readyz": {
|
||||
"http": 200,
|
||||
"status": "ready"
|
||||
},
|
||||
"auth_start": {
|
||||
"http": 303,
|
||||
"location_host": "kc.coulomb.social"
|
||||
}
|
||||
},
|
||||
"memo_loaded": false,
|
||||
"human_disposition_created": false
|
||||
}
|
||||
|
|
@ -40,7 +40,7 @@ id: INFD-WP-ADHOC-2026-10-03-T02
|
|||
status: wait
|
||||
needs_human: true
|
||||
decision_id: 62aa95e4-3ccc-4867-8806-5e3db005b483
|
||||
blocking_reason: "Attended approval creation complete; remaining: publish and deploy exact-record policy v7, load pinned memo, and founder human disposition at decisions.coulomb.social."
|
||||
blocking_reason: "Approval creation and v7 policy/review rollout complete; remaining: load p01 for the verified human recipient, then founder disposition at decisions.coulomb.social."
|
||||
priority: high
|
||||
state_hub_task_id: "ffbc2e30-7a6a-5fb4-86c9-3db1e4a0bacf"
|
||||
```
|
||||
|
|
@ -80,3 +80,24 @@ Deployment values are pinned in access-engine commit `20ea612`.
|
|||
`docs/batches/2026-10-03-provisioning-window/DEPLOY-v7.md` records the concrete
|
||||
policy/review rollout candidate, namespace-scoped preflight and rollback.
|
||||
Live rollout awaits founder approval. Load and human disposition remain open.
|
||||
|
||||
|
||||
A4 live rollout completed on founder instruction "deploy v7":
|
||||
ADMINISTER @ realm:kubernetes/railiance01, activation=APPROVED.
|
||||
Helm revision 8 is deployed; authenticated workload live checks permit exact
|
||||
p01 and refuse wrong group, unknown memo, changed digest and absent caller
|
||||
token. Review Deployment references `informed-decision-runtime-b800648bd80b`;
|
||||
public health/readiness return 200 and sign-in redirects to KeyCape (303).
|
||||
`deploy/sitting-admission.json` now declares the deployed v7 pin.
|
||||
Evidence: `docs/evidence/2026-10-03-provisioning-window-live-policy-checks.json`
|
||||
and `docs/evidence/2026-10-03-provisioning-window-review-readiness.json`.
|
||||
A5 load and A6 human disposition remain outstanding; no presentation or
|
||||
human act was performed by the rollout or probes.
|
||||
|
||||
A5 preparation: the existing live presentation records identify one historical
|
||||
KeyCape reviewer subject, `uid=platform-root,ou=people,dc=netkingdom,dc=local`.
|
||||
Pinned memo/packet copies for this recipient are prepared under the sitting's
|
||||
`bound/` directory. A temporary offline-store load passed with no presentations
|
||||
or dispositions. Live store inspection confirms p01 is not yet loaded. The
|
||||
approved rollout covered policy and review configuration; live memo loading
|
||||
remains a separate pending step.
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue