coulomb/informed-decision
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Add rotating create-only requester provider and owner review

Browse source 
Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a1046b-5629-7f52-badd-f718eadb6042
This commit is contained in:
tegwick 2026-10-04 11:21:04 +02:00
parent b65363527e
commit eb9614c267
4 changed files with 283 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

88
docs/requester-workload-owner-review.md Normal file
View file

@ -0,0 +1,88 @@
# Requester workload owner source review — 2026-10-04
Owning task: INFD-WP-0005-T05. Platform request:
2c1507b2-b361-4ef9-b5d4-3245014c7c52, thread
f84637fa-2355-4971-a2dc-7f1fd01710a8. Reviewed platform source:
6b91d510395215d178d60ee8884e7fc00930a0cf, proposed CCR-2026-0032.
## Source binding acceptance
The founder-approved namespace trust boundary matches the existing create-only
requester registration. Accept the dedicated ESO auth identity
informed-decision/informed-decision-eso, audience openbao, exact-path policy,
900-second reader limits and namespace-restricted store for owner integration.
The receiving review pod keeps ServiceAccount review and UID/GID/fsGroup 10001.
Accept the required read-only 0440 projected key client-secret at
/var/run/secrets/informed-decision/requester/client-secret, without subPath.
No new issuer registration, custody seed, scope, browser route or human act is
introduced. This is source acceptance; it does not confirm live auth claims.
## Implemented composition seam
informed_decision/requester.py implements RequesterTokenProvider and
compose_intake. The provider reopens bounded projected custody per exchange,
never strips/caches the secret or caches access tokens, and requests exactly
approval:create through fixed HTTPS /token. TLS validation, five-second timeouts,
response bounds, proxy suppression and redirect refusal use JSONTransport.
RS256 signature verification against the fixed /jwks pins issuer, sole audience
approval-engine, sub informed-decision, tenant tenant:platform, service principal,
exact requester role and exact create scope. JWT lifetime must be positive and
at most 900 seconds. Failure exposes only a fixed refusal string.
The existing issuer is https://kc.coulomb.social; owner configuration must use
that exact origin (no discovery or caller-selected URL).
compose_intake binds this callback to IntakeApprovalClient and joins the existing
IntakeService ledger with a supplied TokenReview transport and reviewed registries.
It starts no listener and supplies no transport implementation for TokenReview.
No runtime JSON setting or deployment entrypoint consumes this factory yet.
Focused offline verification: 37 tests pass across requester, intake service and
bounded transport. Synthetic projected-file replacement changes the next exchange;
missing custody sends no exchange. Wrong identity, tenant, service profile,
scopes, issuer, audience, signature, expiry and excessive lifetime refuse.
This proves local behavior, not deployed projection or issuer rotation.
## Remaining technical deliveries
1. Compose the separate private intake listener in the process lifecycle and
explicit runtime config. Implement bounded, authenticated TokenReview using
API-server CA validation. Review API RBAC and submitter token audience.
2. Verify ESO's actual TokenRequest permission for the dedicated auth account;
retain boolean/identity receipt. Review exact private Service, NetworkPolicy,
projected registries and submitter grants. Keep it absent from public ingress.
3. Build and publish the final owner image only after composition is complete;
retain immutable registry manifest digest, rendered configuration digest and
owner source revision. None exists for this new provider yet. Existing deployed
image/config references cannot be claimed to contain it.
4. Owner acceptance of receiving verification/abort attendance remains required.
This worker owns source review only, and cannot assign a human attendance role.
## Bounded native proof and abort plan
Before promotion, record exact ESO auth role, effective policy and all TTL bounds;
prove SecretSynced, exact file projection and safe annotation metadata with the
platform maintained helper. Refuse sibling data GET, parent metadata LIST, wrong
namespace/account/audience. Obtain one create-only service exchange and native
approve/read/consume refusal. Keep proof to non-secret identities, counts,
digests, timestamps and capability booleans.
Coordinated issuer rotation must prove the actual mounted-file refresh reaches
this callback and the predecessor ceases working. File replacement in an offline
test is not issuer rotation/revocation evidence. Check reader expiry/revocation,
materialized credential persistence and attended admin cleanup separately.
The runtime verifier/abort operator must retain these receipts; do not print a
Secret, bearer token, accessor, annotations, upstream body or raw child error.
On partial failure, stop, retain non-secret actual state and reconcile; never
repost an unresolved approval create. Platform abort withdraws the new projection
and disables/revokes only the new ESO reader via reviewed admin custody. Target
Secret removal is separate because Retain preserves it. The owner rollback uses
the prior admitted image/config and closes the new private listener. Existing
issuer, browser and attended requester lanes remain independent.
## Human decisions
No repeated design decision is needed for this accepted boundary. The remaining
human action is separate founder approval of the final concrete live packet and
named verification/abort attendance, after these technical gaps are closed.
No live apply, credential read, rotation, issuer mutation or deployment occurred.