coulomb/net-kingdom
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

NK-WP-0054-T04: first live conformance run (OpenBao, PostgreSQL)
All checks were successful
Bounded-execution contracts / contracts (push) Successful in 2m31s
Details
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 2s
Details

Browse source 
observe.py compares the service-identity declarations against
railiance-platform's value-safe live metadata (b0b6c0c) with a 7-day
freshness bound; read-only, offline, 9 tests. Result: 5 conformant,
2 unknown; undeclared keycape/platform-admin alias grants platform-admin
without aal2 (non-conformant), 14 undeclared roles unknown.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 149903@bnt-lap001
Assistant-Session: 4c20a536-1452-4a85-bc09-e1987d9817d6
This commit is contained in:
tegwick 2026-11-07 14:32:19 +01:00
parent e1cad11a80
commit 4a684baabf
6 changed files with 702 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

43
docs/evidence/2026-11-07-nk-wp-0054-t04-conformance/README.md Normal file
View file

@ -0,0 +1,43 @@
# NK-WP-0054-T04: first live conformance run, 2026-11-07
`report.json` was produced by `tools/service-identity/observe.py` with `--now 2026-11-07T14:00:00Z` (exit 1:
one non-conformant finding). The run was read-only and offline. It read no Secret and changed nothing.
**Inputs.** The railiance-platform owner metadata, at `b0b6c0c`, in
`docs/evidence/2026-11-03-nk-wp-0054-t04-identity-metadata/`:
| File | SHA-256 | collected_at |
|---|---|---|
| `openbao-identity-metadata.json` | `60da6df0934dcf9a9a5e25c7f05724a3b5edc719065ff5d5fe03e5537f58aa1b` | 2026-11-03T20:18:53Z |
| `postgresql-identity-metadata.json` | `e627278b02250d87986ae40e43e38c6ceaecdbc56652b447ac7324734f00541a` | 2026-11-03T20:18:54Z |
The declarations are those at this commit, all with `owner_confirmed: false`. The freshness bound is 7 days,
and both inputs were 89.7 h old.
## Result
Declared identities: 5 conformant, 2 unknown, 0 non-conformant.
| Identity | Verdict | Owner | Why |
|---|---|---|---|
| openbao/netkingdom-platform-admin | unknown | railiance-platform | `token_max_ttl` 0. Renewal falls back to the mount or system maximum, which the export omits. The declaration says a one-hour token. |
| bounded-executor/net-kingdom-bounded-executor | unknown | railiance-platform | `kubernetes/net-kingdom-bind-executor-svc-authelia-write` is absent. The export predates the 2026-11-04 go-live. |
| credential-broker, fluid-telegram-operators, secrets-engine-openbao, coding-agent | conformant | railiance-platform | Policies, aal2, groups, TTLs and the observe-only boundary all match. |
| postgresql/privacyidea | conformant | railiance-platform | No privilege flags; owns `privacyidea_db`. |
Undeclared observed roles: 1 non-conformant, 14 unknown.
- **Non-conformant:** `keycape/platform-admin` grants the full `platform-admin` policy and binds only
`groups: [net-kingdom-admins]`, with no `/assurance/level` aal2 claim. It still lists the retired
`bao.coulomb.social` callback. This is the "compatibility alias" from railiance-platform `docs/openbao.md`. It
shares KeyCape client `openbao-admin`, and its role is not declared in railiance-platform `openbao/auth/`.
So a second administrator login exists that the aal2 rule does not cover.
- **Unknown (SI-11, undeclared):**
- nine human OIDC KV-read roles on `netkingdom` without aal2: eight bound to `net-kingdom-admins` and one
to `whynot-design`;
- `kubernetes/external-secrets-issue-core`, which shares a declared policy;
- four PostgreSQL login roles: `postgres` (superuser, CNPG), `streaming_replica` (CNPG), `interhub` and
`probe`.
Not covered: KeyCape (its live view is KEY-WP-0045-T02, founder-run), LLDAP, Authelia and privacyIDEA. Posture
feedback does not consume these findings yet.

232
docs/evidence/2026-11-07-nk-wp-0054-t04-conformance/report.json Normal file
View file

@ -0,0 +1,232 @@
{
"as_of": "2026-11-07T14:00:00Z",
"freshness": [
{
"age_hours": 89.7,
"collected_at": "2026-11-03T20:18:53Z",
"fresh": true,
"max_age_days": 7,
"service": "openbao",
"source_kind": "live"
},
{
"age_hours": 89.7,
"collected_at": "2026-11-03T20:18:54Z",
"fresh": true,
"max_age_days": 7,
"service": "postgresql",
"source_kind": "live"
}
],
"identities": [
{
"evidence": "openbao",
"findings": [
{
"detail": "netkingdom/platform-admin has no role max ttl; renewal is bounded by the mount/system default, which the export does not include",
"identity": "netkingdom-platform-admin",
"owner": "railiance-platform",
"rule": "lifetime",
"verdict": "unknown"
}
],
"identity": "netkingdom-platform-admin",
"observed_as": [
"netkingdom/platform-admin"
],
"owner": "railiance-platform",
"service": "openbao",
"verdict": "unknown"
},
{
"evidence": "openbao",
"findings": [],
"identity": "credential-broker-keycape-client-secret-generate",
"observed_as": [
"netkingdom/credential-broker-keycape-client-secret-generate"
],
"owner": "railiance-platform",
"service": "openbao",
"verdict": "conformant"
},
{
"evidence": "openbao",
"findings": [],
"identity": "fluid-telegram-operators",
"observed_as": [
"netkingdom/fluid-telegram-hall-of-helix-workload-kv"
],
"owner": "railiance-platform",
"service": "openbao",
"verdict": "conformant"
},
{
"evidence": "openbao",
"findings": [],
"identity": "secrets-engine-openbao",
"observed_as": [
"keycape-services/secrets-engine-openbao"
],
"owner": "railiance-platform",
"service": "openbao",
"verdict": "conformant"
},
{
"evidence": "openbao",
"findings": [],
"identity": "coding-agent",
"observed_as": [
"netkingdom/coding-agent",
"approle/coding-agent-railiance-platform"
],
"owner": "railiance-platform",
"service": "openbao",
"verdict": "conformant"
},
{
"evidence": "openbao",
"findings": [
{
"detail": "role kubernetes/net-kingdom-bind-executor-svc-authelia-write is not in the export (missing, or created after collected_at)",
"identity": "net-kingdom-bounded-executor",
"owner": "railiance-platform (OpenBao role) for NetKingdom",
"rule": "observed",
"verdict": "unknown"
}
],
"identity": "net-kingdom-bounded-executor",
"observed_as": [
"kubernetes/net-kingdom-bind-executor-svc-authelia-write"
],
"owner": "railiance-platform (OpenBao role) for NetKingdom",
"service": "bounded-executor",
"verdict": "unknown"
},
{
"evidence": "postgresql",
"findings": [],
"identity": "privacyidea",
"observed_as": [
"net-kingdom-pg/privacyidea"
],
"owner": "railiance-platform",
"service": "postgresql",
"verdict": "conformant"
}
],
"summary": {
"conformant": 5,
"unknown": 2
},
"undeclared": [
{
"detail": "undeclared role grants admin policies ['platform-admin'] without binding aal2",
"identity": "keycape/platform-admin",
"owner": "railiance-platform",
"rule": "SI-11",
"verdict": "non-conformant"
},
{
"detail": "undeclared role shares declared policies ['workload-kv-read-issue-core-runtime']",
"identity": "kubernetes/external-secrets-issue-core",
"owner": "railiance-platform",
"rule": "SI-11",
"verdict": "unknown"
},
{
"detail": "undeclared human OIDC role without aal2 (groups ['net-kingdom-admins'], policies ['workload-kv-read-binky-company-email-imap'])",
"identity": "netkingdom/binky-company-email-imap-workload-kv-read",
"owner": "railiance-platform",
"rule": "SI-11",
"verdict": "unknown"
},
{
"detail": "undeclared human OIDC role without aal2 (groups ['net-kingdom-admins'], policies ['workload-kv-read-binky-qonto-api'])",
"identity": "netkingdom/binky-qonto-api-workload-kv-read",
"owner": "railiance-platform",
"rule": "SI-11",
"verdict": "unknown"
},
{
"detail": "undeclared human OIDC role without aal2 (groups ['net-kingdom-admins'], policies ['workload-kv-read-forgejo-admin'])",
"identity": "netkingdom/forgejo-admin-workload-kv-read",
"owner": "railiance-platform",
"rule": "SI-11",
"verdict": "unknown"
},
{
"detail": "undeclared human OIDC role without aal2 (groups ['net-kingdom-admins'], policies ['workload-kv-read-informed-decision-sitting-requester-client'])",
"identity": "netkingdom/informed-decision-sitting-requester-workload-kv-read",
"owner": "railiance-platform",
"rule": "SI-11",
"verdict": "unknown"
},
{
"detail": "undeclared human OIDC role without aal2 (groups ['net-kingdom-admins'], policies ['workload-kv-read-policy-nexus-forgejo-source'])",
"identity": "netkingdom/policy-nexus-forgejo-source-workload-kv-read",
"owner": "railiance-platform",
"rule": "SI-11",
"verdict": "unknown"
},
{
"detail": "undeclared human OIDC role without aal2 (groups ['net-kingdom-admins'], policies ['workload-kv-read-railiance-backup-offsite-lane'])",
"identity": "netkingdom/railiance-backup-workload-kv-read",
"owner": "railiance-platform",
"rule": "SI-11",
"verdict": "unknown"
},
{
"detail": "undeclared human OIDC role without aal2 (groups ['net-kingdom-admins'], policies ['workload-kv-read-secrets-engine-approval-client'])",
"identity": "netkingdom/secrets-engine-approval-client-workload-kv-read",
"owner": "railiance-platform",
"rule": "SI-11",
"verdict": "unknown"
},
{
"detail": "undeclared human OIDC role without aal2 (groups ['net-kingdom-admins'], policies ['workload-kv-read-secrets-engine-requester-client'])",
"identity": "netkingdom/secrets-engine-requester-workload-kv-read",
"owner": "railiance-platform",
"rule": "SI-11",
"verdict": "unknown"
},
{
"detail": "undeclared human OIDC role without aal2 (groups ['whynot-design'], policies ['workload-kv-read-whynot-design-npm-publish'])",
"identity": "netkingdom/whynot-design-workload-kv-read",
"owner": "railiance-platform",
"rule": "SI-11",
"verdict": "unknown"
},
{
"detail": "undeclared login role (flags none, owns ['interhub'])",
"identity": "net-kingdom-pg/interhub",
"owner": "railiance-platform",
"rule": "SI-11",
"verdict": "unknown"
},
{
"detail": "undeclared login role (flags ['superuser', 'create_role', 'create_db', 'replication', 'bypass_rls'], owns ['postgres'])",
"identity": "net-kingdom-pg/postgres",
"owner": "railiance-platform",
"rule": "SI-11",
"verdict": "unknown"
},
{
"detail": "undeclared login role (flags none, owns ['probe'])",
"identity": "net-kingdom-pg/probe",
"owner": "railiance-platform",
"rule": "SI-11",
"verdict": "unknown"
},
{
"detail": "undeclared login role (flags ['replication'], owns nothing)",
"identity": "net-kingdom-pg/streaming_replica",
"owner": "railiance-platform",
"rule": "SI-11",
"verdict": "unknown"
}
],
"undeclared_summary": {
"non-conformant": 1,
"unknown": 14
}
}