From 15c487313ecbb4616def4666a328bbb2c285f470 Mon Sep 17 00:00:00 2001 From: tegwick Date: Sat, 7 Nov 2026 15:16:27 +0100 Subject: [PATCH] NK-WP-0054-T04: auth/keycape alias disabled by the founder (receipt disabled_verified) Co-Authored-By: Claude Opus 5.5 Assistant: claude-code Assistant-Model: opus Assistant-Process: 149903@bnt-lap001 Assistant-Session: 4c20a536-1452-4a85-bc09-e1987d9817d6 --- .../README.md | 17 +++++++++ .../keycape-alias-disable-receipt.json | 38 +++++++++++++++++++ .../keycape-alias-dry-run-2-receipt.json | 9 +++++ .../NK-WP-0054-service-identity-policy.md | 6 ++- 4 files changed, 69 insertions(+), 1 deletion(-) create mode 100644 docs/evidence/2026-11-07-nk-wp-0054-t04-conformance/keycape-alias-disable-receipt.json create mode 100644 docs/evidence/2026-11-07-nk-wp-0054-t04-conformance/keycape-alias-dry-run-2-receipt.json diff --git a/docs/evidence/2026-11-07-nk-wp-0054-t04-conformance/README.md b/docs/evidence/2026-11-07-nk-wp-0054-t04-conformance/README.md index ed77cfa..067f708 100644 --- a/docs/evidence/2026-11-07-nk-wp-0054-t04-conformance/README.md +++ b/docs/evidence/2026-11-07-nk-wp-0054-t04-conformance/README.md @@ -41,3 +41,20 @@ Undeclared observed roles: 1 non-conformant, 14 unknown. Not covered: KeyCape (its live view is KEY-WP-0045-T02, founder-run), LLDAP, Authelia and privacyIDEA. Posture feedback does not consume these findings yet. + +## Remediation: `auth/keycape` disabled, 2026-11-07 14:15:47Z + +By founder decision, the founder ran `tools/service-identity/keycape-alias-disable.sh --apply` through +railiance-platform `scripts/openbao-attended-exec.py`, from a session on `auth/netkingdom/oidc/callback` (aal2, +KeyCape OTP). Receipt `keycape-alias-disable-receipt.json` (sha256 `97a96dff…`): status `disabled_verified`. +Before the change the alias had roles `[platform-admin]` and client `openbao-admin`. After it, `keycape/` is absent +and `netkingdom/` is present, and the founder's own session was unaffected. Every token the alias had issued was +revoked with the mount. + +Two earlier dry runs failed inside the helper, before any change: one left no receipt, and one failed with a +`TypeError` on `bao list` output (`keycape-alias-dry-run-2-receipt.json`). Both are fixed in `9db7f5f` and +`4d70743`. On the first attempt WSL interop timeouts kept Edge from opening. On another, Authelia once dropped the +OIDC flow to its default URL, `users.coulomb.social`. + +Still open: railiance-platform removes the alias from its declarations (message `051b7391`), and a fresh export +confirms the change with `make service-identity-observe`. diff --git a/docs/evidence/2026-11-07-nk-wp-0054-t04-conformance/keycape-alias-disable-receipt.json b/docs/evidence/2026-11-07-nk-wp-0054-t04-conformance/keycape-alias-disable-receipt.json new file mode 100644 index 0000000..c2eb61a --- /dev/null +++ b/docs/evidence/2026-11-07-nk-wp-0054-t04-conformance/keycape-alias-disable-receipt.json @@ -0,0 +1,38 @@ +{ + "alias": { + "default_role": "platform-admin", + "oidc_client_id": "openbao-admin", + "roles": [ + "platform-admin" + ] + }, + "applied": true, + "credential_values_emitted": false, + "mounts_after": [ + "approle/", + "keycape-services/", + "kubernetes/", + "netkingdom/", + "token/" + ], + "mounts_before": [ + "approle/", + "keycape-services/", + "keycape/", + "kubernetes/", + "netkingdom/", + "token/" + ], + "observed_at": "2026-11-07T14:15:47.100701+00:00", + "schema": "net-kingdom.openbao-keycape-alias-disable.v1", + "session": { + "path": "auth/netkingdom/oidc/callback", + "policies": [ + "default", + "operator-custody", + "platform-admin" + ] + }, + "session_after_ok": true, + "status": "disabled_verified" +} diff --git a/docs/evidence/2026-11-07-nk-wp-0054-t04-conformance/keycape-alias-dry-run-2-receipt.json b/docs/evidence/2026-11-07-nk-wp-0054-t04-conformance/keycape-alias-dry-run-2-receipt.json new file mode 100644 index 0000000..d549c2f --- /dev/null +++ b/docs/evidence/2026-11-07-nk-wp-0054-t04-conformance/keycape-alias-dry-run-2-receipt.json @@ -0,0 +1,9 @@ +{ + "applied": false, + "credential_values_emitted": false, + "error": "TypeError", + "observed_at": "2026-11-07T14:11:13.546965+00:00", + "schema": "net-kingdom.openbao-keycape-alias-disable.v1", + "status": "helper_failed", + "step": "list auth/keycape/role" +} diff --git a/workplans/NK-WP-0054-service-identity-policy.md b/workplans/NK-WP-0054-service-identity-policy.md index fa9d195..23fac30 100644 --- a/workplans/NK-WP-0054-service-identity-policy.md +++ b/workplans/NK-WP-0054-service-identity-policy.md @@ -195,7 +195,7 @@ status: wait priority: medium assignee: claude-code depends_on: [NK-WP-0054-T03] -blocking_reason: "First run 2026-11-07 (OpenBao, PostgreSQL): keycape/platform-admin alias is an undeclared admin login without aal2, routed to railiance-platform. Remaining: owner answers on that and the 14 undeclared roles, a fresh OpenBao export after the 2026-11-04 go-live, the founder's KeyCape live view (KEY-WP-0045-T02), then the posture-feedback feed." +blocking_reason: "First run 2026-11-07 (OpenBao, PostgreSQL); the keycape/platform-admin alias (admin login without aal2) was disabled by the founder the same day (receipt disabled_verified). Remaining: owner answers on that and the 14 undeclared roles, a fresh OpenBao export after the 2026-11-04 go-live, the founder's KeyCape live view (KEY-WP-0045-T02), then the posture-feedback feed." state_hub_task_id: "c8db4607-9306-572b-a3cb-c35ca5989ec7" ``` @@ -248,6 +248,10 @@ Founder-run helper: `tools/service-identity/keycape-alias-disable.sh` (5 tests), did not come from `auth/netkingdom`. railiance-platform removes the alias from its declarations (`openbao/auth/keycape-oidc-config.json`, `docs/openbao.md`) so that a restore cannot bring it back. +**2026-11-07 14:15Z: disabled.** Founder-run, receipt `disabled_verified` +([evidence](../docs/evidence/2026-11-07-nk-wp-0054-t04-conformance/README.md)): `keycape/` is gone, `netkingdom/` +remains, and the session survived. A fresh export will confirm it. + ## Split the directory bind from the human admin ```task