NK-WP-0054-T04: rerun on fresh export confirms keycape alias gone; window-scoped executor role
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 149903@bnt-lap001 Assistant-Session: 4c20a536-1452-4a85-bc09-e1987d9817d6
This commit is contained in:
parent
15c487313e
commit
6252ab8d7e
7 changed files with 7276 additions and 7 deletions
|
|
@ -56,5 +56,25 @@ Two earlier dry runs failed inside the helper, before any change: one left no re
|
|||
`4d70743`. On the first attempt WSL interop timeouts kept Edge from opening. On another, Authelia once dropped the
|
||||
OIDC flow to its default URL, `users.coulomb.social`.
|
||||
|
||||
Still open: railiance-platform removes the alias from its declarations (message `051b7391`), and a fresh export
|
||||
confirms the change with `make service-identity-observe`.
|
||||
Still open: railiance-platform removes the alias from its declarations (message `051b7391`).
|
||||
|
||||
## Rerun on a fresh export, 2026-11-07 14:40Z
|
||||
|
||||
The founder re-exported with the RPF-WP-0067-T03 commands. Both exited 0, and no secret-shaped values were found.
|
||||
|
||||
| File | SHA-256 | collected_at |
|
||||
|---|---|---|
|
||||
| `openbao-identity-metadata-20261107.json` | `58ceec665c8cbe6f3214d24307bbb584e63362ca51c30920db21ecdfdebd3cc7` | 2026-11-07T14:34:38Z |
|
||||
| `postgresql-identity-metadata-20261107.json` | `76fd1d795b3597fa44ab971c452956e4d3173230bd1d8b0e8708f742c1f560b2` | 2026-11-07T14:35:35Z |
|
||||
|
||||
**What changed in the data:**
|
||||
- Auth mounts are now `approle`, `keycape-services`, `kubernetes`, `netkingdom` and `token`; `keycape` is gone.
|
||||
- The only role removed since 2026-11-03 is `keycape/platform-admin`. Five executor and window-watch roles were
|
||||
added.
|
||||
|
||||
`report-20261107-rerun.json` (exit 0):
|
||||
- **Declared identities:** 6 conformant, 1 unknown (the `netkingdom/platform-admin` max TTL).
|
||||
- **Undeclared:** 0 non-conformant, 14 unknown.
|
||||
|
||||
The executor's write role `net-kingdom-bind-executor-svc-authelia-write` is absent, which CCR-2026-0058 requires
|
||||
between admitted runs. The checker now treats that absence as conformant (`window_scoped`).
|
||||
|
|
|
|||
File diff suppressed because it is too large
Load diff
|
|
@ -0,0 +1,97 @@
|
|||
{
|
||||
"collected_at": "2026-11-07T14:35:35Z",
|
||||
"postgresql": {
|
||||
"cluster": "net-kingdom-pg",
|
||||
"databases": [
|
||||
{
|
||||
"name": "interhub",
|
||||
"owner": "interhub"
|
||||
},
|
||||
{
|
||||
"name": "postgres",
|
||||
"owner": "postgres"
|
||||
},
|
||||
{
|
||||
"name": "privacyidea_db",
|
||||
"owner": "privacyidea"
|
||||
},
|
||||
{
|
||||
"name": "probe",
|
||||
"owner": "probe"
|
||||
}
|
||||
],
|
||||
"namespace": "databases",
|
||||
"roles": [
|
||||
{
|
||||
"bypass_rls": false,
|
||||
"can_login": true,
|
||||
"connection_limit": -1,
|
||||
"create_db": false,
|
||||
"create_role": false,
|
||||
"inherit": true,
|
||||
"member_of": [],
|
||||
"name": "interhub",
|
||||
"replication": false,
|
||||
"superuser": false,
|
||||
"valid_until": null
|
||||
},
|
||||
{
|
||||
"bypass_rls": true,
|
||||
"can_login": true,
|
||||
"connection_limit": -1,
|
||||
"create_db": true,
|
||||
"create_role": true,
|
||||
"inherit": true,
|
||||
"member_of": [],
|
||||
"name": "postgres",
|
||||
"replication": true,
|
||||
"superuser": true,
|
||||
"valid_until": null
|
||||
},
|
||||
{
|
||||
"bypass_rls": false,
|
||||
"can_login": true,
|
||||
"connection_limit": -1,
|
||||
"create_db": false,
|
||||
"create_role": false,
|
||||
"inherit": true,
|
||||
"member_of": [],
|
||||
"name": "privacyidea",
|
||||
"replication": false,
|
||||
"superuser": false,
|
||||
"valid_until": null
|
||||
},
|
||||
{
|
||||
"bypass_rls": false,
|
||||
"can_login": true,
|
||||
"connection_limit": -1,
|
||||
"create_db": false,
|
||||
"create_role": false,
|
||||
"inherit": true,
|
||||
"member_of": [],
|
||||
"name": "probe",
|
||||
"replication": false,
|
||||
"superuser": false,
|
||||
"valid_until": null
|
||||
},
|
||||
{
|
||||
"bypass_rls": false,
|
||||
"can_login": true,
|
||||
"connection_limit": -1,
|
||||
"create_db": false,
|
||||
"create_role": false,
|
||||
"inherit": true,
|
||||
"member_of": [],
|
||||
"name": "streaming_replica",
|
||||
"replication": true,
|
||||
"superuser": false,
|
||||
"valid_until": null
|
||||
}
|
||||
],
|
||||
"server_version": "16.13 (Debian 16.13-1.pgdg11+1)"
|
||||
},
|
||||
"schema": "railiance-platform.service-identity-metadata.v1",
|
||||
"service": "postgresql",
|
||||
"source_kind": "live",
|
||||
"value_safe": true
|
||||
}
|
||||
|
|
@ -0,0 +1,217 @@
|
|||
{
|
||||
"as_of": "2026-11-07T14:40:00Z",
|
||||
"freshness": [
|
||||
{
|
||||
"age_hours": 0.1,
|
||||
"collected_at": "2026-11-07T14:34:38Z",
|
||||
"fresh": true,
|
||||
"max_age_days": 7,
|
||||
"service": "openbao",
|
||||
"source_kind": "live"
|
||||
},
|
||||
{
|
||||
"age_hours": 0.1,
|
||||
"collected_at": "2026-11-07T14:35:35Z",
|
||||
"fresh": true,
|
||||
"max_age_days": 7,
|
||||
"service": "postgresql",
|
||||
"source_kind": "live"
|
||||
}
|
||||
],
|
||||
"identities": [
|
||||
{
|
||||
"evidence": "openbao",
|
||||
"findings": [
|
||||
{
|
||||
"detail": "netkingdom/platform-admin has no role max ttl; renewal is bounded by the mount/system default, which the export does not include",
|
||||
"identity": "netkingdom-platform-admin",
|
||||
"owner": "railiance-platform",
|
||||
"rule": "lifetime",
|
||||
"verdict": "unknown"
|
||||
}
|
||||
],
|
||||
"identity": "netkingdom-platform-admin",
|
||||
"observed_as": [
|
||||
"netkingdom/platform-admin"
|
||||
],
|
||||
"owner": "railiance-platform",
|
||||
"service": "openbao",
|
||||
"verdict": "unknown"
|
||||
},
|
||||
{
|
||||
"evidence": "openbao",
|
||||
"findings": [],
|
||||
"identity": "credential-broker-keycape-client-secret-generate",
|
||||
"observed_as": [
|
||||
"netkingdom/credential-broker-keycape-client-secret-generate"
|
||||
],
|
||||
"owner": "railiance-platform",
|
||||
"service": "openbao",
|
||||
"verdict": "conformant"
|
||||
},
|
||||
{
|
||||
"evidence": "openbao",
|
||||
"findings": [],
|
||||
"identity": "fluid-telegram-operators",
|
||||
"observed_as": [
|
||||
"netkingdom/fluid-telegram-hall-of-helix-workload-kv"
|
||||
],
|
||||
"owner": "railiance-platform",
|
||||
"service": "openbao",
|
||||
"verdict": "conformant"
|
||||
},
|
||||
{
|
||||
"evidence": "openbao",
|
||||
"findings": [],
|
||||
"identity": "secrets-engine-openbao",
|
||||
"observed_as": [
|
||||
"keycape-services/secrets-engine-openbao"
|
||||
],
|
||||
"owner": "railiance-platform",
|
||||
"service": "openbao",
|
||||
"verdict": "conformant"
|
||||
},
|
||||
{
|
||||
"evidence": "openbao",
|
||||
"findings": [],
|
||||
"identity": "coding-agent",
|
||||
"observed_as": [
|
||||
"netkingdom/coding-agent",
|
||||
"approle/coding-agent-railiance-platform"
|
||||
],
|
||||
"owner": "railiance-platform",
|
||||
"service": "openbao",
|
||||
"verdict": "conformant"
|
||||
},
|
||||
{
|
||||
"evidence": "openbao",
|
||||
"findings": [],
|
||||
"identity": "net-kingdom-bounded-executor",
|
||||
"observed_as": [
|
||||
"kubernetes/net-kingdom-bind-executor-svc-authelia-write"
|
||||
],
|
||||
"owner": "railiance-platform (OpenBao role) for NetKingdom",
|
||||
"service": "bounded-executor",
|
||||
"verdict": "conformant"
|
||||
},
|
||||
{
|
||||
"evidence": "postgresql",
|
||||
"findings": [],
|
||||
"identity": "privacyidea",
|
||||
"observed_as": [
|
||||
"net-kingdom-pg/privacyidea"
|
||||
],
|
||||
"owner": "railiance-platform",
|
||||
"service": "postgresql",
|
||||
"verdict": "conformant"
|
||||
}
|
||||
],
|
||||
"summary": {
|
||||
"conformant": 6,
|
||||
"unknown": 1
|
||||
},
|
||||
"undeclared": [
|
||||
{
|
||||
"detail": "undeclared role shares declared policies ['workload-kv-read-issue-core-runtime']",
|
||||
"identity": "kubernetes/external-secrets-issue-core",
|
||||
"owner": "railiance-platform",
|
||||
"rule": "SI-11",
|
||||
"verdict": "unknown"
|
||||
},
|
||||
{
|
||||
"detail": "undeclared human OIDC role without aal2 (groups ['net-kingdom-admins'], policies ['workload-kv-read-binky-company-email-imap'])",
|
||||
"identity": "netkingdom/binky-company-email-imap-workload-kv-read",
|
||||
"owner": "railiance-platform",
|
||||
"rule": "SI-11",
|
||||
"verdict": "unknown"
|
||||
},
|
||||
{
|
||||
"detail": "undeclared human OIDC role without aal2 (groups ['net-kingdom-admins'], policies ['workload-kv-read-binky-qonto-api'])",
|
||||
"identity": "netkingdom/binky-qonto-api-workload-kv-read",
|
||||
"owner": "railiance-platform",
|
||||
"rule": "SI-11",
|
||||
"verdict": "unknown"
|
||||
},
|
||||
{
|
||||
"detail": "undeclared human OIDC role without aal2 (groups ['net-kingdom-admins'], policies ['workload-kv-read-forgejo-admin'])",
|
||||
"identity": "netkingdom/forgejo-admin-workload-kv-read",
|
||||
"owner": "railiance-platform",
|
||||
"rule": "SI-11",
|
||||
"verdict": "unknown"
|
||||
},
|
||||
{
|
||||
"detail": "undeclared human OIDC role without aal2 (groups ['net-kingdom-admins'], policies ['workload-kv-read-informed-decision-sitting-requester-client'])",
|
||||
"identity": "netkingdom/informed-decision-sitting-requester-workload-kv-read",
|
||||
"owner": "railiance-platform",
|
||||
"rule": "SI-11",
|
||||
"verdict": "unknown"
|
||||
},
|
||||
{
|
||||
"detail": "undeclared human OIDC role without aal2 (groups ['net-kingdom-admins'], policies ['workload-kv-read-policy-nexus-forgejo-source'])",
|
||||
"identity": "netkingdom/policy-nexus-forgejo-source-workload-kv-read",
|
||||
"owner": "railiance-platform",
|
||||
"rule": "SI-11",
|
||||
"verdict": "unknown"
|
||||
},
|
||||
{
|
||||
"detail": "undeclared human OIDC role without aal2 (groups ['net-kingdom-admins'], policies ['workload-kv-read-railiance-backup-offsite-lane'])",
|
||||
"identity": "netkingdom/railiance-backup-workload-kv-read",
|
||||
"owner": "railiance-platform",
|
||||
"rule": "SI-11",
|
||||
"verdict": "unknown"
|
||||
},
|
||||
{
|
||||
"detail": "undeclared human OIDC role without aal2 (groups ['net-kingdom-admins'], policies ['workload-kv-read-secrets-engine-approval-client'])",
|
||||
"identity": "netkingdom/secrets-engine-approval-client-workload-kv-read",
|
||||
"owner": "railiance-platform",
|
||||
"rule": "SI-11",
|
||||
"verdict": "unknown"
|
||||
},
|
||||
{
|
||||
"detail": "undeclared human OIDC role without aal2 (groups ['net-kingdom-admins'], policies ['workload-kv-read-secrets-engine-requester-client'])",
|
||||
"identity": "netkingdom/secrets-engine-requester-workload-kv-read",
|
||||
"owner": "railiance-platform",
|
||||
"rule": "SI-11",
|
||||
"verdict": "unknown"
|
||||
},
|
||||
{
|
||||
"detail": "undeclared human OIDC role without aal2 (groups ['whynot-design'], policies ['workload-kv-read-whynot-design-npm-publish'])",
|
||||
"identity": "netkingdom/whynot-design-workload-kv-read",
|
||||
"owner": "railiance-platform",
|
||||
"rule": "SI-11",
|
||||
"verdict": "unknown"
|
||||
},
|
||||
{
|
||||
"detail": "undeclared login role (flags none, owns ['interhub'])",
|
||||
"identity": "net-kingdom-pg/interhub",
|
||||
"owner": "railiance-platform",
|
||||
"rule": "SI-11",
|
||||
"verdict": "unknown"
|
||||
},
|
||||
{
|
||||
"detail": "undeclared login role (flags ['superuser', 'create_role', 'create_db', 'replication', 'bypass_rls'], owns ['postgres'])",
|
||||
"identity": "net-kingdom-pg/postgres",
|
||||
"owner": "railiance-platform",
|
||||
"rule": "SI-11",
|
||||
"verdict": "unknown"
|
||||
},
|
||||
{
|
||||
"detail": "undeclared login role (flags none, owns ['probe'])",
|
||||
"identity": "net-kingdom-pg/probe",
|
||||
"owner": "railiance-platform",
|
||||
"rule": "SI-11",
|
||||
"verdict": "unknown"
|
||||
},
|
||||
{
|
||||
"detail": "undeclared login role (flags ['replication'], owns nothing)",
|
||||
"identity": "net-kingdom-pg/streaming_replica",
|
||||
"owner": "railiance-platform",
|
||||
"rule": "SI-11",
|
||||
"verdict": "unknown"
|
||||
}
|
||||
],
|
||||
"undeclared_summary": {
|
||||
"non-conformant": 0,
|
||||
"unknown": 14
|
||||
}
|
||||
}
|
||||
|
|
@ -57,7 +57,10 @@ OPENBAO_MAP: dict[tuple[str, str], list[dict[str, Any]]] = {
|
|||
"observe_only": True}],
|
||||
("bounded-executor", "net-kingdom-bounded-executor"): [
|
||||
{"mount": "kubernetes", "role": "net-kingdom-bind-executor-svc-authelia-write",
|
||||
"service_account": ("sso", "nk-bind-executor")}],
|
||||
"service_account": ("sso", "nk-bind-executor"),
|
||||
# CCR-2026-0058 role_window: created per admitted window and deleted after the receipt; the window watch
|
||||
# (CCR-2026-0064) alarms when it exists outside a run. Absent between runs is the conformant state.
|
||||
"window_scoped": "CCR-2026-0058"}],
|
||||
}
|
||||
|
||||
# Policies that make a role an administrator of OpenBao itself.
|
||||
|
|
@ -84,6 +87,8 @@ def finding(identity: str, owner: str, verdict: str, rule: str, detail: str) ->
|
|||
|
||||
def check_role(spec: dict, role: dict | None, declared: dict, ident: str, owner: str) -> list[dict]:
|
||||
where = f"{spec['mount']}/{spec['role']}"
|
||||
if role is None and spec.get("window_scoped"):
|
||||
return [] # absent between admitted runs, as declared; presence outside a run is the window watch's alarm
|
||||
if role is None:
|
||||
return [finding(ident, owner, "unknown", "observed",
|
||||
f"role {where} is not in the export (missing, or created after collected_at)")]
|
||||
|
|
|
|||
|
|
@ -119,8 +119,14 @@ def test_agent_data_read_is_non_conformant(tmp_path):
|
|||
|
||||
def test_missing_role_is_unknown(tmp_path):
|
||||
ob = openbao_doc()
|
||||
ob["openbao"]["roles"].pop()
|
||||
assert verdicts(run(tmp_path, ob=ob))["net-kingdom-bounded-executor"] == "unknown"
|
||||
del ob["openbao"]["roles"][3] # secrets-engine-openbao
|
||||
assert verdicts(run(tmp_path, ob=ob))["secrets-engine-openbao"] == "unknown"
|
||||
|
||||
|
||||
def test_window_scoped_role_absent_between_runs_is_conformant(tmp_path):
|
||||
ob = openbao_doc()
|
||||
ob["openbao"]["roles"].pop() # net-kingdom-bind-executor-svc-authelia-write, CCR-2026-0058
|
||||
assert verdicts(run(tmp_path, ob=ob))["net-kingdom-bounded-executor"] == "conformant"
|
||||
|
||||
|
||||
def test_postgres_privilege_flag_and_undeclared_role(tmp_path):
|
||||
|
|
|
|||
|
|
@ -195,7 +195,7 @@ status: wait
|
|||
priority: medium
|
||||
assignee: claude-code
|
||||
depends_on: [NK-WP-0054-T03]
|
||||
blocking_reason: "First run 2026-11-07 (OpenBao, PostgreSQL); the keycape/platform-admin alias (admin login without aal2) was disabled by the founder the same day (receipt disabled_verified). Remaining: owner answers on that and the 14 undeclared roles, a fresh OpenBao export after the 2026-11-04 go-live, the founder's KeyCape live view (KEY-WP-0045-T02), then the posture-feedback feed."
|
||||
blocking_reason: "Rerun 2026-11-07 on a fresh export: 0 non-conformant (keycape alias disabled, confirmed). Open: railiance-platform answers on the platform-admin max TTL and 14 undeclared roles, the founder's KeyCape live view (KEY-WP-0045-T02), then the posture-feedback feed."
|
||||
state_hub_task_id: "c8db4607-9306-572b-a3cb-c35ca5989ec7"
|
||||
```
|
||||
|
||||
|
|
@ -250,7 +250,10 @@ did not come from `auth/netkingdom`. railiance-platform removes the alias from i
|
|||
|
||||
**2026-11-07 14:15Z: disabled.** Founder-run, receipt `disabled_verified`
|
||||
([evidence](../docs/evidence/2026-11-07-nk-wp-0054-t04-conformance/README.md)): `keycape/` is gone, `netkingdom/`
|
||||
remains, and the session survived. A fresh export will confirm it.
|
||||
remains, and the session survived. **Confirmed by the 14:34Z fresh export:** the only role removed is
|
||||
`keycape/platform-admin`. The rerun found 6 conformant and 1 unknown among declared identities, and 0
|
||||
non-conformant and 14 unknown among undeclared roles. The executor's write role is absent between runs, as
|
||||
CCR-2026-0058 requires, and is now checked as window-scoped.
|
||||
|
||||
## Split the directory bind from the human admin
|
||||
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue