From e0b5faea527788e88a2312c6e7560a40e5a105cd Mon Sep 17 00:00:00 2001 From: tegwick Date: Wed, 7 Oct 2026 02:26:03 +0200 Subject: [PATCH] KEY-WP-0037-T04 done: live issuance verified for secrets-engine-openbao Co-Authored-By: Claude Opus 5.5 Assistant: claude-code Assistant-Model: opus Assistant-Process: 132360@bnt-lap001 Assistant-Session: 769b1afd-4330-4c86-96b2-e510e26db42b --- ...10-07-secrets-engine-openbao-issuance.json | 61 +++++++++++++++++++ ...ets-engine-openbao-registration-custody.md | 18 +++++- 2 files changed, 76 insertions(+), 3 deletions(-) create mode 100644 docs/evidence/2026-10-07-secrets-engine-openbao-issuance.json diff --git a/docs/evidence/2026-10-07-secrets-engine-openbao-issuance.json b/docs/evidence/2026-10-07-secrets-engine-openbao-issuance.json new file mode 100644 index 0000000..e50de47 --- /dev/null +++ b/docs/evidence/2026-10-07-secrets-engine-openbao-issuance.json @@ -0,0 +1,61 @@ +{ + "schema": "keycape.live-issuance-receipt.v1", + "task": "KEY-WP-0037-T04", + "date": "2026-10-07", + "client_id": "secrets-engine-openbao", + "issuer": "https://kc.coulomb.social", + "deployed_image": "forgejo.coulomb.social/coulomb/key-cape@sha256:6f79a2af1c695d39480173fad013facd84d21e7732860366af519302a2c496b8", + "deployed_source": "1164f65", + "verifier_binary_source": "key-cape main b2e1efc (workstation build)", + "decisions": { + "custody": "2ab717e1-7881-491e-aed4-28946550c289", + "eso_amendment": "1fdd993b-8899-4f87-8a8e-636346bb9692", + "live_registration_go": "caafe4be-4f68-47b4-9567-316d47b94992" + }, + "custody": { + "kv_path": "platform/workloads/keycape/secrets-engine-openbao", + "kv_version": 1, + "kv_cas": 0, + "kv_request_id": "a79f53e5-4c79-88bf-3e64-493134253497", + "ccrs": ["CCR-2026-0033", "CCR-2026-0034"], + "issuer_delivery": "ESO sso/keycape-secrets-engine-openbao-client, Ready=True SecretSynced" + }, + "registration": { + "target": "sso/keycape-config", + "uid": "2e94519d-1550-41c7-9701-2efe47fe1fd3", + "resource_version_before": "71471711", + "resource_version_after": "71655453", + "unrelated_config_bytes_preserved": true, + "env_binding": "KEYCAPE_SECRETS_ENGINE_OPENBAO_CLIENT_SECRET", + "net_kingdom_commit": "1fbb8db" + }, + "verify_client": { + "runner": "founder workstation; secret read through the CCR-2026-0034 operator OIDC reader into the verify-client process env only; operator token revoked before verification", + "checks_passed": 10, + "checks_failed": 0, + "discovery_and_endpoint_origin": true, + "rs256_jwks_signature": true, + "claim_bindings_issuer_audience_validity": true, + "principal_type_service": true, + "sub_service_secrets_engine": true, + "tenant_platform": true, + "roles_secrets_engine": true, + "no_excess_scope": true, + "excess_scope_refused": "openbao:admin", + "wrong_secret_refused": true, + "wrong_secret_kind": "random value via -previous-secret-env (not a rotation)" + }, + "operator_reader_positive_path": { + "role": "keycape-secrets-engine-openbao-operator-workload-kv-read", + "login": "netkingdom OIDC via openbao-admin with bound groups net-kingdom-admins and /assurance/level aal2", + "revoke_self": true + }, + "human_login_after_restart": "founder OIDC login through KeyCape succeeded (the operator reader login above)", + "not_established": [ + "the 900s token lifetime was not measured; it rests on the registration's tokenLifetime 15m", + "no in-pod verification: the deployed 1164f65 cannot fetch its own discovery document from inside the cluster (fixed in 8be8065)", + "the OpenBao JWT role and login proof remain RPF-WP-0035-T02", + "the secrets-engine probe-openbao end-to-end run remains SECRETS-WP-0012-T03" + ], + "values_emitted": false +} diff --git a/workplans/KEY-WP-0037-secrets-engine-openbao-registration-custody.md b/workplans/KEY-WP-0037-secrets-engine-openbao-registration-custody.md index 4d47fb9..ad7fed7 100644 --- a/workplans/KEY-WP-0037-secrets-engine-openbao-registration-custody.md +++ b/workplans/KEY-WP-0037-secrets-engine-openbao-registration-custody.md @@ -4,11 +4,11 @@ type: workplan title: "Secrets Engine OpenBao live registration and protected custody" domain: infotech repo: key-cape -status: active +status: finished owner: codex topic_slug: netkingdom created: "2026-10-04" -updated: "2026-10-05" +updated: "2026-10-07" state_hub_workstream_id: "62800ecf-064b-5546-a1e4-4521b5932973" --- @@ -106,7 +106,7 @@ and has no consumer file. The custody approvals A1-A3 are decision ```task id: KEY-WP-0037-T04 -status: wait +status: done priority: high depends_on: - KEY-WP-0037-T03 @@ -121,3 +121,15 @@ booleans and identities, immutable image/source coordinates and custody binding metadata. Hand off to RPF-WP-0035-T02 for isolated OpenBao metadata provisioning, claim/expiry/use-limit denial and self-revocation proof. Never report an example registration, discovery metadata or source test as live acceptance. + +**Done 2026-10-07.** `keycape verify-client` passed all 10 checks: +- issuer, JWKS signature and claims (`service:secrets-engine`, tenant:platform, + role secrets-engine); +- no excess scope; +- `openbao:admin` and a wrong secret refused. + +The founder's KeyCape login after the restart also proved the CCR-2026-0034 +operator reader (net-kingdom-admins, aal2). Receipt: +`docs/evidence/2026-10-07-secrets-engine-openbao-issuance.json`. The 900s lifetime +was not measured. Handed to RPF-WP-0035-T02 for the OpenBao JWT role and login +proof.