From 2a9d94652485424486da3b57726a9424aca4229c Mon Sep 17 00:00:00 2001 From: tegwick Date: Fri, 23 Oct 2026 07:08:41 +0200 Subject: [PATCH] NK-WP-0048-T34: integrate the corrected F3 owner configuration inverse text into 1.3 Applies the Custodian nk48-r5-f3-implementation-r2 type candidate (addresses RAPPS-F3-SESSION-1). Descriptors unchanged; validator and suites pass. Co-Authored-By: Claude Opus 5.5 Assistant: claude-code Assistant-Model: opus Assistant-Process: 696317@bnt-lap001 Assistant-Session: bab9e511-0915-45b3-926a-2fab552edff6 --- .../1.3/oidc-browser-relying-party/type.yaml | 49 ++++++++++++++----- workplans/NK-WP-0048-security-case-types.md | 16 ++++++ 2 files changed, 52 insertions(+), 13 deletions(-) diff --git a/security-case-type-revisions/1.3/oidc-browser-relying-party/type.yaml b/security-case-type-revisions/1.3/oidc-browser-relying-party/type.yaml index bb7f0a7..7260a79 100644 --- a/security-case-type-revisions/1.3/oidc-browser-relying-party/type.yaml +++ b/security-case-type-revisions/1.3/oidc-browser-relying-party/type.yaml @@ -362,16 +362,30 @@ spec: Secret values. - id: hand-over owner: '{consumer_owner_repo}' - entry_point: The consumer owner first makes its own Helm change configuring {consuming_service} - with issuer {issuer}, client {client_id} and custody bao:platform/workloads/keycape/{client_id}, - requiring one of {access_groups} in the groups claim before sign-in completes. - Then reviewed adapter net-kingdom/keycape-hand-over, dispatched by Warden's case - kernel inside the attended consumer-owner session, verifies the consumer with - four value-free probes (member-login, non-member-refused, membership-add-grants, - membership-remove-revokes) and records the hand-over receipt. + entry_point: The consumer owner's reviewed deployment entry wraps its own Helm + configuration and the admitted hand-over in one owner configuration transaction, + for public clients as well as confidential clients even when delivery is NO_CHANGE. + Before changing {consuming_service}, durably bind exact case, acceptance, human + principal, owner configuration source, cluster/release and before revision; + authenticate the case-created post revision under the owner's release-writer + exclusion before verification. Configure issuer {issuer}, client {client_id} + and, only for confidential clients, custody bao:platform/workloads/keycape/{client_id}, + requiring one of {access_groups} before sign-in completes. Preserve identical + preexisting configuration as NO_CHANGE and refuse conflicts. Then the reviewed + adapter net-kingdom/keycape-hand-over, dispatched by Warden's case kernel inside + the attended consumer-owner session, verifies the four value-free probes + (member-login, non-member-refused, membership-add-grants, membership-remove-revokes) + and records the receipt. The owner wrapper's separate configuration inverse is + reachable on failure before a receipt exists and on later owner case unwind; + it does not depend on delivery-created objects or receipt creation. Missing or + ambiguous configuration provenance requires owner reconciliation, never replay. auth: the attended consumer-owner session on lane apps-consumer-handover (actor human, parent-session revoked per attempt); the consumer configuration itself is the - owner's own deployment path + owner's own deployment path. Every configuration inverse is a distinct fresh + authorized attended owner operation, bound to operation, exact principal, case, + source, release and transaction, with its own per-attempt revocation on every + exit. Never reuse the already revoked hand-over parent session. Missing current + inverse authority retains pending owner reconciliation evidence lane: apps-consumer-handover warden_executes: false attended: true @@ -437,13 +451,22 @@ spec: reads_secret_value: false rollback: - reverses: hand-over - action: the adapter removes only its hand-over receipt. Removing the OIDC source - for {client_id} from {consuming_service} is the owner's Helm rollback (owner - {consumer_owner_repo}), done inside deliver-consumer-secret's owner_remove - before any consumer object is removed + action: the adapter removes only its authenticated case-created hand-over receipt. + Independently, the consumer owner's configuration transaction inverse restores + only this case's configuration change through the noted before Helm revision, + after authenticating exact case/principal/source/release binding and checking + the unchanged post revision under exclusion of all release writers. It runs + on owner unwind for public and confidential cases, including skipped or NO_CHANGE + delivery and failures before receipt creation. Preserve preexisting configuration; + drift or ambiguous provenance requires owner reconciliation. This owner inverse + is outside the receipt adapter and precedes any delivery-object removal; + receipt removal alone never proves configuration rollback. - reverses: deliver-consumer-secret when: client_type == confidential - action: After reverting consumer secret reference, delete only authenticated created + action: First verify the owner configuration transaction inverse and absence of + remaining consumer secret references; NO_CHANGE configuration alone is not proof of + deactivation. Do not repeat an unguarded Helm rollback inside owner_remove. + Then delete only authenticated created ExternalSecret/owned target by UID and ownerReference, then SecretStore and dedicated SA; preserve preexisting-matched resources and never delete a shared target. Retain audit and ownership receipts; removing SecretStore/SA alone is diff --git a/workplans/NK-WP-0048-security-case-types.md b/workplans/NK-WP-0048-security-case-types.md index 8f4c18f..4afb720 100644 --- a/workplans/NK-WP-0048-security-case-types.md +++ b/workplans/NK-WP-0048-security-case-types.md @@ -1676,6 +1676,22 @@ and `nk48-r5-f3-review-r1/`. Source review, owner acknowledgment and native proo remain distinct. T16's final composition/admission and T06's native first case are not completed by this refinement. +2026-10-23: the F3 type text is integrated. The corrected r2 candidate (Custodian +`nk48-r5-f3-implementation-r2/type-owner-configuration-inverse.candidate.patch`, +which addresses review RAPPS-F3-SESSION-1) is applied to the 1.3 type. The +hand-over entry_point and auth now describe one owner configuration transaction +around the consumer's Helm change, for public clients and NO_CHANGE delivery +alike, with an independently reachable inverse. Every inverse is a distinct +fresh attended owner operation that never reuses the revoked hand-over session. +The hand-over rollback stays receipt-only; delivery removal stays created-only +after deactivation is proven. +- Type validator: `OK oidc-browser-relying-party@1.3 (proposed)`. 22 package + tests and 363 adapter tests pass. The seven descriptors are unchanged by this + text. +- Still owed: railiance-apps adopting the revised C3 placement, then + RAPPS-WP-0016-T05's real wrapper, journal, inverse session and all-writer + release exclusion. After that, coordinator r7 and the owner re-checks. + ## T35 — Align source admission fixtures with the authenticated catalog and attended-session API ```task