tegwick
ee02a15795
Assistant: codex Assistant-Model: gpt-6.1-sol Assistant-Session: 01a1029c-c003-7283-acc9-930b434e6cae
143 lines
7.2 KiB
Markdown
143 lines
7.2 KiB
Markdown
# Provisioning-window sitting — operator packet (hub decision D1)
|
|
|
|
Current follow-up, 2026-10-03: p01 is accepted; receipt is
|
|
`docs/evidence/2026-10-03-provisioning-window-p01-acceptance.json`.
|
|
The exclusion analysis below describes the original draft, not current gates.
|
|
MASON-WP-0007-T05 subsequently completed its attended seed run. Core Hub's
|
|
credential provisioning and private publisher admission are also complete:
|
|
RAPPCOREHUB-WP-0003 finished after Helm revision 31, 123/123 repositories with
|
|
zero errors and `repo_manager_projection: ok`; owner receipt is
|
|
`rapp-core-hub/docs/evidence/2026-10-03-private-publisher-admission.json`.
|
|
Do not repeat those provisioning steps. Secrets-engine service login still
|
|
requires KeyCape live registration/protected client custody; CCR-2026-0018
|
|
coordinated disablement and the broader D1 remain separate owner records.
|
|
|
|
Hub decision: `62aa95e4-3ccc-4867-8806-5e3db005b483` (D1, attended OpenBao
|
|
provisioning window), routed by CUST-WP-0075. The founder approves through
|
|
informed-decision, not with a raw hub resolve.
|
|
Review group: `net-kingdom-admins`. Surface: https://decisions.coulomb.social/
|
|
Contract: `docs/specs/CompactSignoffBatches.md`.
|
|
Generator: `tools/prepare_provisioning_window_batch.py` (re-running rewrites the same bytes).
|
|
|
|
An agent drafted this. It may not `accept` / `decline` / `seal`. Only the human binds.
|
|
|
|
## One unsigned memo, four lanes excluded
|
|
|
|
| n | memo_id | Blocking record | Question |
|
|
| --: | --- | --- | --- |
|
|
| 1 | `infd-20261003-p01` | RPF-WP-0035-T06 (railiance-platform) | Accept the passed 2026-09-13 CCR-2026-0019 scoped delivery proof? |
|
|
|
|
Packet hash: `sha256:ee53cae14ae86dbdec2936d72f99e1285b6c714d5bd322ef30df8ffbf0939ff2`.
|
|
Required acknowledgement: the wrong-group login is untested, the 404 proves
|
|
routing only, and acceptance does not close T06 (the CCR-2026-0018
|
|
disablement is still open).
|
|
|
|
Excluded (no memo; the reasons are in `provisioning/index.json` → `excluded`):
|
|
|
|
| Task | Why not ready now |
|
|
| --- | --- |
|
|
| MASON-WP-0007-T05 | The policy/role script exists, but the row-7 seed copy has no reviewed script; the T01 survey is still todo; ESO's right to create SA tokens in `tenant-engine` is unverified |
|
|
| RPF-WP-0035-T02 | The design is still `proposed`; no reviewed child command exists; KeyCape registration/custody is unverified; gated on SECRETS-WP-0007-T04 |
|
|
| RPF-WP-0035-T08 | Already provisioned and delivered 2026-09-11; what remains is owner acceptance, not an attended act (stale gate) |
|
|
| RAPPCOREHUB-WP-0003-T04 | No CCR, design or script exists for the dedicated `read:repository` identity; the identity-canon fix is also outstanding |
|
|
|
|
Resolving hub decision D1 is a separate act, after the window has run. The
|
|
owners of the excluded lanes re-qualify their tasks.
|
|
|
|
## Part A — circulate and bind the memo
|
|
|
|
**A1. Dry run (shell, no credentials).** From `/home/worsch/informed-decision`:
|
|
|
|
```bash
|
|
.venv/bin/python -B tools/create_sitting_approvals.py --dry-run \
|
|
--sitting 2026-10-03-provisioning-window \
|
|
--receipt 2026-10-03-provisioning-window-approval-create.json --expect 1
|
|
```
|
|
|
|
Expect `memo_ids: ["infd-20261003-p01"]` and `posted: false`.
|
|
|
|
**A2. Approval Engine tunnel (shell, separate terminal).**
|
|
|
|
```bash
|
|
kubectl -n approval-engine port-forward svc/approval-engine 18281:8080
|
|
```
|
|
|
|
**A3. Create the native approval (shell, attended, in the founder's own terminal: `! …`).**
|
|
KeyCape OIDC/MFA opens in the browser. The installed warden bundle does not
|
|
know this lane yet, so name the source catalog. Note the `--` before the child.
|
|
|
|
```bash
|
|
WARDEN_ROUTING_CATALOG=/home/worsch/ops-warden/registry/routing/catalog.yaml \
|
|
BAO_ADDR=http://127.0.0.1:18200 VAULT_ADDR=http://127.0.0.1:18200 \
|
|
warden access informed-decision-sitting-requester-login --exec -- \
|
|
/home/worsch/informed-decision/tools/create_sitting_approvals.sh \
|
|
--sitting 2026-10-03-provisioning-window \
|
|
--receipt 2026-10-03-provisioning-window-approval-create.json --expect 1
|
|
```
|
|
|
|
The child is silent. The outcome is the receipt
|
|
`docs/evidence/2026-10-03-provisioning-window-approval-create.json`, which holds
|
|
the `approval_id` and the engine-computed binding digest and no secret. Read
|
|
warden's printed line, not its exit code. The fallback wrapper takes the same
|
|
child and the same arguments:
|
|
`python3 /home/worsch/railiance-platform/scripts/openbao-attended-exec.py --lane informed-decision-sitting-requester-login -- <child>`.
|
|
|
|
**A4. Flex Auth exact-record admission (repo change + deploy).** In
|
|
`access-engine/examples/informed-decision-sitting/policy.md` (formerly
|
|
flex-auth): change `version: v6` to `v7` and add `"memo:infd-20261003-p01"` with
|
|
the receipt's `approval_id`, `binding_digest`, `label: "p01"`, the binding from
|
|
`approval-create-intents.json` and `memo_version: 1`. Mirror it in
|
|
`records.json` and keep every existing record. Never add the record before A3:
|
|
an empty approval id must not become a policy value. Build in CI, bump
|
|
`access-engine/values/informed-decision-sitting.yaml` and deploy. Then, in this
|
|
repo, set `deploy/sitting-admission.json` to `policy.version: v7` with the new
|
|
`package_digest`, and roll out the review service.
|
|
|
|
**A5. Attach and load (shell).**
|
|
|
|
```bash
|
|
.venv/bin/python -B tools/attach_compact_bindings.py \
|
|
--principal <exact-keycape-sub> \
|
|
--receipt docs/evidence/2026-10-03-provisioning-window-approval-create.json \
|
|
--sitting 2026-10-03-provisioning-window --batches provisioning
|
|
.venv/bin/python -B tools/load_sitting_memos.py --db <live review store> \
|
|
--bound docs/batches/2026-10-03-provisioning-window/bound
|
|
```
|
|
|
|
The attach step writes `bound/`; the unsigned drafts stay unsigned. Load into
|
|
the live store the same way as for the 2026-09-21 sitting.
|
|
|
|
**A6. Review and bind (browser).** Sign in at https://decisions.coulomb.social/
|
|
with fresh MFA. Open `infd-20261003-p01`, read the packet and acknowledge the
|
|
required highlight. Then accept, return or decline. One memo, one bind. There
|
|
is no approve-all.
|
|
|
|
## Part B — attended execution after acceptance
|
|
|
|
This is the pattern for any lane whose memo was accepted. It is a shell step,
|
|
run in the founder's own terminal:
|
|
|
|
```bash
|
|
BAO_ADDR=http://127.0.0.1:18200 VAULT_ADDR=http://127.0.0.1:18200 \
|
|
warden access openbao-platform-admin-login --exec -- <the lane's reviewed command>
|
|
```
|
|
|
|
The child must be silent and idempotent. Read warden's printed line:
|
|
`attended command completed but session revocation could not be confirmed`
|
|
means the child ran; `attended login failed closed before command handoff`
|
|
means it never ran.
|
|
|
|
| memo | Command after acceptance | Owner records |
|
|
| --- | --- | --- |
|
|
| `p01` (RPF-WP-0035-T06) | **None.** The proof already ran; do not re-run it as a substitute. No platform-admin session is needed. | railiance-platform records the accepted approval id against T06 and keeps T06 open for the CCR-2026-0018 disablement. |
|
|
|
|
When an excluded lane becomes ready, it gets its own memo in a later sitting
|
|
before anything runs. For MASON-WP-0007-T05 the policy/role half would be
|
|
`... --exec -- sh scripts/openbao-tenant-engine-audit-core-sender-eso-attended.sh`,
|
|
run from a railiance-platform checkout (exit 3 means an existing object
|
|
differs). This sitting does not authorize it.
|
|
|
|
## Must not
|
|
- Paste or display any credential value
|
|
- Resolve hub decision D1 from this sitting alone
|
|
- Let an agent accept, decline or seal
|