coulomb/net-kingdom
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

NK-WP-0056-T10: one OpenBao login per lane; renew before the 15m lease ends

Browse source 
The executor logs in separately for the bind write (CCR-2026-0058) and the
journey read (CCR-2026-0059) and refuses one role for both; every login is
revoked at exit, also when setup fails. Clients log in again (re-reading the
rotating projected JWT) before the lease ends, since a run's budget (20m)
outlasts a 15m token. Synthetic pilot with per-lane tokens: completed and
reverted, all_met.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 5502@bnt-lap001
Assistant-Session: 68b3b02f-5d0f-4e71-8421-796f62e50196
This commit is contained in:
tegwick 2026-10-31 19:01:44 +01:00
parent 74599a583d
commit 1cdc18f75f
6 changed files with 409 additions and 25 deletions
Download patch file Download diff file Expand all files Collapse all files

24
docs/evidence/2026-10-31-nk56-t10-openbao-lanes/README.md Normal file
View file

@ -0,0 +1,24 @@
# NK-WP-0056-T10: one OpenBao login per lane (2026-10-31)
The executor now holds two OpenBao clients:
- the bind write lane, CCR-2026-0058, role `net-kingdom-bind-executor-svc-authelia-write`;
- the journey read lane, CCR-2026-0059, role `net-kingdom-bind-executor-syn-journey-read`.
Both log in with the audience-`openbao` projected token, log in again before their 15m lease ends, and are revoked at
exit, including when setup fails.
`pilot-report.json`: `uv run bounded-executor/synthetic_pilot.py` on the T08 stack plus a dev OpenBao, with one token
per policy, as the live roles will issue. Results:
- the rotation `completed`;
- the deliberately wrong delivery was `reverted`;
- `all_met: true`;
- `no_values_in_report: true`.
Unit tests are in `bounded-executor/tests/test_openbao_lanes.py`:
- two roles, two logins, both revoked;
- a shared role is refused before any login;
- renewal revokes the old token;
- the journey check reads only through the journey client.

162
docs/evidence/2026-10-31-nk56-t10-openbao-lanes/pilot-report.json Normal file
View file

@ -0,0 +1,162 @@
{
"schema": "netkingdom.bounded-executor.synthetic-pilot/v1",
"started_at": "2026-10-31T17:58:59+00:00",
"images": {
"openbao": "quay.io/openbao/openbao@sha256:436eaf9778cad75507ff70ea26ace30dcbe15606e619ac3823495663d7f7c115"
},
"policy_file_sha256": "f14f0e0b885302b5931c1e84e258b5ee32a596fafab5b961d88becf7825eeeb0",
"runs": [
{
"admission": "BEA-2026-9001",
"outcome": "completed",
"reason": null,
"kv_version": [
1,
2
],
"kv_value_changed": true,
"previous_value_refused_by_lldap": true,
"current_kv_value_signs_in": true,
"steps": [
[
"generate",
"step",
"done",
[
"pass"
],
null
],
[
"set-directory",
"step",
"done",
[
"pass"
],
null
],
[
"deliver",
"step",
"done",
[
"pass"
],
null
],
[
"restart",
"step",
"done",
[
"pass"
],
null
]
],
"reverted": false,
"pdp": "not-evaluated",
"events": [
"execution.run.started",
"execution.attribution.receipt"
],
"met": true
},
{
"admission": "BEA-2026-9002",
"outcome": "reverted",
"reason": null,
"kv_version": [
2,
4
],
"kv_value_changed": false,
"previous_value_refused_by_lldap": false,
"current_kv_value_signs_in": true,
"steps": [
[
"generate",
"step",
"done",
[
"pass"
],
null
],
[
"set-directory",
"step",
"done",
[
"pass"
],
null
],
[
"deliver",
"step",
"done",
[
"pass"
],
null
],
[
"restart",
"step",
"failed",
[],
"RolloutFailed"
],
[
"restore-kv",
"revert",
"done",
[
"pass"
],
null
],
[
"restore-directory",
"revert",
"done",
[
"pass"
],
null
],
[
"redeliver",
"revert",
"done",
[
"pass"
],
null
],
[
"restart-again",
"revert",
"done",
[
"pass"
],
null
]
],
"reverted": true,
"pdp": "not-evaluated",
"events": [
"execution.run.started",
"execution.attribution.receipt"
],
"met": true
}
],
"alerts": [],
"no_values_in_report": true,
"all_met": true,
"finished_at": "2026-10-31T17:59:58+00:00"
}