tegwick
2d2161bc64
Assistant: codex Assistant-Model: gpt-6.1-sol Assistant-Session: 01a1029c-c003-7283-acc9-930b434e6cae
132 lines
7 KiB
Markdown
132 lines
7 KiB
Markdown
---
|
|
id: INFD-WP-ADHOC-2026-10-03
|
|
type: workplan
|
|
title: "Provisioning-window sitting draft for hub decision D1"
|
|
domain: infotech
|
|
repo: informed-decision
|
|
status: blocked
|
|
owner: claude
|
|
created: "2026-10-03"
|
|
updated: "2026-10-03"
|
|
related:
|
|
- CUST-WP-0075
|
|
state_hub_workstream_id: "e7923574-d226-53db-befb-dd7dcba817bb"
|
|
---
|
|
|
|
## Draft the provisioning-window sitting
|
|
|
|
```task
|
|
id: INFD-WP-ADHOC-2026-10-03-T01
|
|
status: done
|
|
priority: high
|
|
state_hub_task_id: "8aa74d26-6a65-5881-8572-c5bde1069b96"
|
|
```
|
|
|
|
Dispatched by the-custodian under CUST-WP-0075. The founder wants hub decision
|
|
`62aa95e4-3ccc-4867-8806-5e3db005b483` (D1, attended OpenBao provisioning
|
|
window) approved through informed-decision. Batch:
|
|
`docs/batches/2026-10-03-provisioning-window/` (generator
|
|
`tools/prepare_provisioning_window_batch.py`, operator steps in its
|
|
`OPERATOR.md`). Five candidate lanes were read against owner source. One memo,
|
|
`infd-20261003-p01` (RPF-WP-0035-T06, acceptance of the CCR-2026-0019 scoped
|
|
delivery proof), was drafted. MASON-WP-0007-T05, RPF-WP-0035-T02,
|
|
RPF-WP-0035-T08 and RAPPCOREHUB-WP-0003-T04 were excluded with reasons in the
|
|
batch index. Unsigned; no approval created, nothing submitted.
|
|
|
|
## Circulate and bind the sitting
|
|
|
|
```task
|
|
id: INFD-WP-ADHOC-2026-10-03-T02
|
|
status: wait
|
|
needs_human: true
|
|
decision_id: 62aa95e4-3ccc-4867-8806-5e3db005b483
|
|
blocking_reason: "p01 is loaded, but repeated browser read attempts retain KeyCape MFA time 17:08:08 UTC and fail the 900-second policy limit. Obtain genuinely fresh password/OTP authentication; if fresh OTP still emits the old time, KeyCape owns the correction (INFD-IN-0005). Then founder reviews, acknowledges and chooses a disposition."
|
|
priority: high
|
|
state_hub_task_id: "ffbc2e30-7a6a-5fb4-86c9-3db1e4a0bacf"
|
|
```
|
|
|
|
Agents do not create the approval, admit the record, or bind. After the human
|
|
disposition, record the receipt under `docs/evidence/` and update `sitting.json`.
|
|
|
|
## Coaching progress — 2026-10-03
|
|
|
|
A1 dry run passed. Founder completed A3 at 17:08 UTC. Receipt
|
|
`docs/evidence/2026-10-03-provisioning-window-approval-create.json` records one
|
|
requested human-control approval with no entries:
|
|
`706f4205-aaa7-44f6-be30-d0f57664d69c`, carrying the native digest
|
|
`sha256:c8a1a9c8fb22616e3aacfb877ba7974feb5eedaed491f856a6c90719c502ebe4`.
|
|
Binding fields match the reviewed intent. Validity ends 2026-10-04 17:08 UTC.
|
|
|
|
A4 preparation: `docs/batches/2026-10-03-provisioning-window/access-engine-v7.patch`
|
|
adds only p01 to the policy and record manifest, advances v6 to v7, and preserves
|
|
all 16 existing act records. It is a candidate for access-engine; no owner files
|
|
or live policy were changed. Policy publication/deployment, load and human
|
|
answer remain outstanding. This memo alone does not resolve hub decision D1.
|
|
|
|
Offline candidate validation: 795 actual-evaluator checks passed, including
|
|
p01 and all existing records. The harness's 12-hour-boundary timestamp was
|
|
refreshed per list record in the temporary validation copy to avoid wall-clock
|
|
aging during the run; the policy MFA limits were unchanged. Embedded policy
|
|
validation/tests also passed. Candidate package digest:
|
|
`sha256:2490955f175c52574543e210be06f468a01e56c778d38d4fdcad731875e37cc7`.
|
|
Evidence: `docs/evidence/2026-10-03-provisioning-window-policy-candidate-checks.json`
|
|
and `docs/evidence/2026-10-03-provisioning-window-admission-candidate.json`.
|
|
|
|
A4 publication: founder applied the tested patch. Access-engine committed and
|
|
synced it as `f946c7b`; CI published image
|
|
`sha256:f6fa2062f7095e66c7a91f20cd130914b5481d46d9d909339e028f7ecdf0065d`.
|
|
Published-image evaluation confirms v7 and the expected package digest.
|
|
Deployment values are pinned in access-engine commit `20ea612`.
|
|
`docs/batches/2026-10-03-provisioning-window/DEPLOY-v7.md` records the concrete
|
|
policy/review rollout candidate, namespace-scoped preflight and rollback.
|
|
Live rollout awaits founder approval. Load and human disposition remain open.
|
|
|
|
|
|
A4 live rollout completed on founder instruction "deploy v7":
|
|
ADMINISTER @ realm:kubernetes/railiance01, activation=APPROVED.
|
|
Helm revision 8 is deployed; authenticated workload live checks permit exact
|
|
p01 and refuse wrong group, unknown memo, changed digest and absent caller
|
|
token. Review Deployment references `informed-decision-runtime-b800648bd80b`;
|
|
public health/readiness return 200 and sign-in redirects to KeyCape (303).
|
|
`deploy/sitting-admission.json` now declares the deployed v7 pin.
|
|
Evidence: `docs/evidence/2026-10-03-provisioning-window-live-policy-checks.json`
|
|
and `docs/evidence/2026-10-03-provisioning-window-review-readiness.json`.
|
|
A5 load and A6 human disposition remain outstanding; no presentation or
|
|
human act was performed by the rollout or probes.
|
|
|
|
A5 preparation: the existing live presentation records identify one historical
|
|
KeyCape reviewer subject, `uid=platform-root,ou=people,dc=netkingdom,dc=local`.
|
|
Pinned memo/packet copies for this recipient are prepared under the sitting's
|
|
`bound/` directory. A temporary offline-store load passed with no presentations
|
|
or dispositions. Live store inspection confirms p01 is not yet loaded. The
|
|
approved rollout covered policy and review configuration; live memo loading
|
|
remains a separate pending step.
|
|
|
|
|
|
A5 live load completed on founder instruction "load p01":
|
|
ADMINISTER @ realm:kubernetes/railiance01, activation=APPROVED.
|
|
The loaded memo and packet match the prepared copies, including native approval
|
|
pin and packet digest. It is addressed to the verified historical KeyCape
|
|
subject. Load verification found zero p01 presentations/dispositions; the
|
|
loader performed no human act. Public health/readiness remain 200.
|
|
Evidence: `docs/evidence/2026-10-03-provisioning-window-p01-load.json`.
|
|
Only A6 remains: founder signs in with fresh MFA, reads the full packet,
|
|
acknowledges the required highlight, and chooses a disposition. Plan remains
|
|
blocked on that human act; hub decision D1 remains unresolved.
|
|
|
|
A6 refusal diagnosis: read at 18:27:49 UTC still carried exactly the same
|
|
KeyCape `assurance.at=1791047288` (17:08:08 UTC), age 4,781 seconds. Exact
|
|
identity, group, memo and native approval pins match v7; the 900-second MFA
|
|
limit refuses this request. The latest attempt has not supplied fresh evidence;
|
|
the founder confirms account-portal logout followed by password and OTP login
|
|
in the same browser. That did not propagate fresh assurance into this review
|
|
request. Do not infer a new review authentication from portal login.
|
|
KeyCape's `/account/logout` confirmation clears its session and routes through
|
|
upstream Authelia sign-out; informed-decision sign-out alone is local. Complete
|
|
that browser flow, then start a new review login with password and OTP.
|
|
If the verified timestamp remains old after that, KeyCape must correct the
|
|
authentication-time contract under existing intake `INFD-IN-0005` and prove
|
|
it with a completed browser journey. Retain all policy freshness limits.
|
|
Evidence: `docs/evidence/2026-10-03-provisioning-window-review-refusal.json`.
|
|
`INFD-WP-0006` implements an explicit fresh-authentication request from review
|
|
sign-in; its narrow image rollout and native browser proof remain blocked.
|