From 87e57aa710fa6762b1b301aa195976bbf74104ff Mon Sep 17 00:00:00 2001 From: tegwick Date: Fri, 30 Oct 2026 23:19:10 +0100 Subject: [PATCH] NK-WP-0056-T04: svc-provisioner bind delivered from OpenBao; setup and verify receipts Co-Authored-By: Claude Opus 5.5 Assistant: claude-code Assistant-Model: opus Assistant-Process: 673304@bnt-lap001 Assistant-Session: 959b12c7-cf2e-440b-a60d-91229cc9e96e --- .../01-setup.json | 14 ++++++++++++++ .../02a-verify-before-template-fix.json | 9 +++++++++ .../02b-verify.json | 18 ++++++++++++++++++ .../README.md | 19 +++++++++++++++++++ workplans/NK-WP-0056-bounded-executor-path.md | 5 +++++ 5 files changed, 65 insertions(+) create mode 100644 docs/evidence/2026-10-30-nk56-svc-provisioner-bind/01-setup.json create mode 100644 docs/evidence/2026-10-30-nk56-svc-provisioner-bind/02a-verify-before-template-fix.json create mode 100644 docs/evidence/2026-10-30-nk56-svc-provisioner-bind/02b-verify.json create mode 100644 docs/evidence/2026-10-30-nk56-svc-provisioner-bind/README.md diff --git a/docs/evidence/2026-10-30-nk56-svc-provisioner-bind/01-setup.json b/docs/evidence/2026-10-30-nk56-svc-provisioner-bind/01-setup.json new file mode 100644 index 0000000..82c3604 --- /dev/null +++ b/docs/evidence/2026-10-30-nk56-svc-provisioner-bind/01-setup.json @@ -0,0 +1,14 @@ +{ + "action": "setup", + "ccr_sha256": "582bc1f419b6a50ac13dcaf16f54a02199d125659ac5ed7b7acc54590b88d8d4", + "coding_agents_denied": true, + "custody_equals_live": true, + "external_secret_apply_and_verify_pending": true, + "kv_version": 1, + "lane": "svc-provisioner", + "phase": "done", + "source_ccr": "CCR-2026-0052", + "source_sha256": "b6b4c4ad4c8f9aa6d58e281c966e36926511d1dde8e33f03565d89d251bebee6", + "status": "custody_and_reader_prepared", + "values_recorded": false +} diff --git a/docs/evidence/2026-10-30-nk56-svc-provisioner-bind/02a-verify-before-template-fix.json b/docs/evidence/2026-10-30-nk56-svc-provisioner-bind/02a-verify-before-template-fix.json new file mode 100644 index 0000000..3bb0588 --- /dev/null +++ b/docs/evidence/2026-10-30-nk56-svc-provisioner-bind/02a-verify-before-template-fix.json @@ -0,0 +1,9 @@ +{ + "action": "verify", + "lane": "svc-provisioner", + "phase": "external_secret_ready", + "reason": "external_secret_not_ready", + "source_sha256": "b6b4c4ad4c8f9aa6d58e281c966e36926511d1dde8e33f03565d89d251bebee6", + "status": "failed", + "values_recorded": false +} diff --git a/docs/evidence/2026-10-30-nk56-svc-provisioner-bind/02b-verify.json b/docs/evidence/2026-10-30-nk56-svc-provisioner-bind/02b-verify.json new file mode 100644 index 0000000..98ec47e --- /dev/null +++ b/docs/evidence/2026-10-30-nk56-svc-provisioner-bind/02b-verify.json @@ -0,0 +1,18 @@ +{ + "action": "verify", + "ccr_sha256": "582bc1f419b6a50ac13dcaf16f54a02199d125659ac5ed7b7acc54590b88d8d4", + "eso_delivery_equality_verified": true, + "exact_policy_and_ttl_verified": true, + "external_secret_ready": true, + "kv_version": 1, + "lane": "svc-provisioner", + "phase": "done", + "sibling_metadata_and_token_create_denied": true, + "source_ccr": "CCR-2026-0052", + "source_sha256": "b6b4c4ad4c8f9aa6d58e281c966e36926511d1dde8e33f03565d89d251bebee6", + "status": "reader_and_delivery_verified", + "temporary_reader_revoked": true, + "values_recorded": false, + "wrong_audience_denied": true, + "wrong_service_account_denied": true +} diff --git a/docs/evidence/2026-10-30-nk56-svc-provisioner-bind/README.md b/docs/evidence/2026-10-30-nk56-svc-provisioner-bind/README.md new file mode 100644 index 0000000..229eede --- /dev/null +++ b/docs/evidence/2026-10-30-nk56-svc-provisioner-bind/README.md @@ -0,0 +1,19 @@ +# NK-WP-0056-T04 pilot — svc-provisioner bind in platform custody (2026-10-30) + +Founder-run in the founder's terminal under railiance-platform CCR-2026-0052 (approved by +platform-owner and net-kingdom-owner, binding confirmed; sha256 `582bc1f4…d8d4`). All receipts are +value-free (`values_recorded: false`). + +| Step | Result | Receipt | +| --- | --- | --- | +| setup (attended platform-admin, custody decrypted, re-sealed after) | custody equal to live; coding agents fenced; KV version 1 (CAS=0); policy and role in place | `01-setup.json` | +| apply `sso-mfa/k8s/identity-provisioner/bind-eso.yaml` (first) | SecretStore valid; ExternalSecret refused by `reject-secret-last-applied`: ESO copied the ExternalSecret's kubectl last-applied annotation onto the Secret. The Secret was not changed | operator output | +| verify (first) | refused at `external_secret_ready` | `02a-verify-before-template-fix.json` | +| manifest fix `985cfc3` (`target.template.metadata: {}`), re-apply | ExternalSecret Ready | operator output | +| verify | exact policy/TTL; wrong ServiceAccount and audience denied; metadata, other directory-bind paths and token create denied; KV equals the delivered Secret; temporary reader revoked | `02b-verify.json` | +| restart identity-provisioner | rolled out Ready (readiness includes the directory login) | operator output | + +`svc-provisioner`'s bind password is now delivered from OpenBao +(`platform/workloads/net-kingdom/directory-binds/svc-provisioner`); the custody copy still holds the same +value as a fallback. A rotation is now: change the password in LLDAP, write the next KV version — no +custody decryption needed for delivery. diff --git a/workplans/NK-WP-0056-bounded-executor-path.md b/workplans/NK-WP-0056-bounded-executor-path.md index 3bf2125..c69a7d1 100644 --- a/workplans/NK-WP-0056-bounded-executor-path.md +++ b/workplans/NK-WP-0056-bounded-executor-path.md @@ -148,6 +148,11 @@ CCR-2026-0052 (proposed) and policy `net-kingdom-svc-provisioner-bind-eso`; `sso live, coding-agent fence, KV CAS=0, value-free receipts); `tests/test_service_bind_lane.py` (7). Next: owner approval of the CCR, then the founder-run setup, ESO apply and verify. Authelia, KeyCape and privacyIDEA follow one at a time. +**2026-10-30, pilot live and verified:** CCR-2026-0052 approved; founder-run setup, ESO apply and verify passed; +`svc-provisioner` now binds with the ESO-delivered value ([evidence](../docs/evidence/2026-10-30-nk56-svc-provisioner-bind/README.md)). +Finding: ESO targets need `template.metadata: {}` or the admission guard refuses the Secret update. Remaining: +`svc-authelia`, `svc-keycape`, `svc-privacyidea`. + ## Synthetic verification instead of a founder sign-in ```task