tegwick
7a6666d1f9
All checks were successful
Build and Publish Container Image / build-and-push (push) Successful in 33s
Operator decision 5ed3fb35-eca9-413a-82b9-95171ba85bf6 accepts tenant:platform as the platform management tenant for the Glas approval chain, requiring exact spelling across the approval store, the service-client JWT claim and the lifecycle CheckRequest. Changes the tenant field on secrets-engine-approval and approval-engine-operator only, in the registration fixture and the provisioning packet. Unrelated clients and the human directory default keep tenant:coulomb, and no audience, scope, subject, role, lifetime or MFA grant changes. Adds issuance evidence that the approval shape emits tenant:platform exactly and never an alias the caller requests, that the OpenBao client gains no cross-tenant reach, and a fixture guard pinning every reviewed client's tenant. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01NV9oijZukGyGbRQGGKnK4P Assistant: claude-code Assistant-Model: opus Assistant-Process: 713576@bnt-lap001 Assistant-Session: 384c511d-9bce-4cb8-a676-2aef6c0c8df6
53 lines
2.4 KiB
YAML
53 lines
2.4 KiB
YAML
# Non-secret static registration fragments for KeyCape's bounded JWT consumers. Merge these entries into the deployment-owned KeyCape config.
|
|
# The named environment variables must be materialized by an approved
|
|
# out-of-repository custody path; this file never contains their values.
|
|
clients:
|
|
- clientId: "codex-railiance-platform"
|
|
displayName: "Railiance platform coding agent"
|
|
allowedScopes: ["openbao:login"]
|
|
grantTypes: ["client_credentials"]
|
|
clientType: "confidential"
|
|
secretRef: "env:KEYCAPE_CODEX_RAILIANCE_PLATFORM_CLIENT_SECRET"
|
|
serviceSubject: "service:codex:railiance-platform"
|
|
tenant: "tenant:coulomb"
|
|
roles: ["coding-agent"]
|
|
tokenLifetime: "15m"
|
|
|
|
- clientId: "secrets-engine-openbao"
|
|
displayName: "secrets-engine OpenBao login"
|
|
allowedScopes: ["openbao:login"]
|
|
grantTypes: ["client_credentials"]
|
|
clientType: "confidential"
|
|
secretRef: "env:KEYCAPE_SECRETS_ENGINE_OPENBAO_CLIENT_SECRET"
|
|
serviceSubject: "service:secrets-engine"
|
|
tenant: "tenant:coulomb"
|
|
roles: ["secrets-engine"]
|
|
tokenLifetime: "15m"
|
|
|
|
- clientId: "secrets-engine-approval"
|
|
displayName: "secrets-engine approval consume client"
|
|
audience: "approval-engine"
|
|
allowedScopes: ["approval:read", "approval:consume"]
|
|
grantTypes: ["client_credentials"]
|
|
clientType: "confidential"
|
|
secretRef: "env:KEYCAPE_SECRETS_ENGINE_APPROVAL_CLIENT_SECRET"
|
|
serviceSubject: "service:secrets-engine"
|
|
# Landlord-zone platform tenant, decision 5ed3fb35-eca9-413a-82b9-95171ba85bf6.
|
|
# Exact spelling; no alias to tenant:coulomb. See docs/tenant-claim-contract.md.
|
|
tenant: "tenant:platform"
|
|
roles: ["secrets-engine"]
|
|
tokenLifetime: "15m"
|
|
|
|
- clientId: "approval-engine-operator"
|
|
displayName: "approval-engine lifecycle operator"
|
|
audience: "approval-engine"
|
|
allowedScopes: ["approval:create", "approval:read", "approval:approve", "approval:revoke", "approval:supersede", "approval:observe", "approval:emit"]
|
|
grantTypes: ["client_credentials"]
|
|
clientType: "confidential"
|
|
secretRef: "env:KEYCAPE_APPROVAL_ENGINE_OPERATOR_CLIENT_SECRET"
|
|
serviceSubject: "service:approval-engine-operator"
|
|
# Landlord-zone platform tenant, decision 5ed3fb35-eca9-413a-82b9-95171ba85bf6.
|
|
# Exact spelling; no alias to tenant:coulomb. See docs/tenant-claim-contract.md.
|
|
tenant: "tenant:platform"
|
|
roles: ["approval-operator"]
|
|
tokenLifetime: "15m"
|