tegwick
463fbbb954
docs/nk49-phase-b-plan.md sets out the shared internal network for the isolated original KeyCape and the restored OpenBao, owner by owner, with what the pinned T18 machinery forces (a new reviewed module; the T40 window has expired). The unsigned admission template names placeholders only. Hub decision e4db6c9f routes the founder choices. The workplan position paragraph now matches the task counts (37 done, 1 in progress, 5 waiting). Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: sonnet Assistant-Process: 328925@bnt-lap001 Assistant-Session: 14b795fd-c632-4c01-8d28-e7e490c7b0ed
52 lines
2.3 KiB
JSON
52 lines
2.3 KiB
JSON
{
|
|
"_template": "UNSIGNED PROPOSAL. Placeholders in <angle brackets> are unknown until the files exist and are reviewed. Signing it is the founder's act; this file authorizes nothing.",
|
|
"schema": "netkingdom.keycape-phase-b-attempt-admission.v1",
|
|
"namespace": "netkingdom-keycape-phase-b-attempt",
|
|
"attempt_id": "<new unique id>",
|
|
"not_before": "<YYYY-MM-DDTHH:MM:SSZ>",
|
|
"not_after": "<at most 24 h after not_before>",
|
|
"abort_operator": "<founder>",
|
|
"case": "secrets15-nk49-readiness",
|
|
"issuer": "https://kc.coulomb.social",
|
|
"network": {
|
|
"name": "<created by the named network owner, e.g. nk49-phase-b-<attempt_id>>",
|
|
"owner": "<railiance-platform | net-kingdom>",
|
|
"internal": true,
|
|
"alias_for_keycape": "kc.coulomb.social",
|
|
"attached_containers_exactly": ["keycape-worker", "restored-openbao", "consumer-runner"],
|
|
"egress_refusal_probe_sha256": "<reviewed probe>"
|
|
},
|
|
"bound_receipts": {
|
|
"t18_keycape_attempt_receipt_sha256": "16d72f7c…1651 (truncated in the public record; full digest from the founder workstation)",
|
|
"restored_openbao_receipt_sha256": "4e048dee…579d (same)",
|
|
"ciphertext_sha256": "7117b3fe1e4840c86b301c94c85e6b16709e5626bb0884bd0580bde630e30e30"
|
|
},
|
|
"tls": {
|
|
"decision": "<reissue | retain key from earlier attempt>",
|
|
"trust_sha256": "<ISRG Root X1 trust bytes, as in the T18 admission>",
|
|
"acme_duplicate_count_confirmed_by": "railiance-cluster"
|
|
},
|
|
"consumer": {
|
|
"client_id": "secrets-engine-openbao",
|
|
"secret_env": "KEYCAPE_SECRETS_ENGINE_OPENBAO_CLIENT_SECRET",
|
|
"audience": "secrets-engine-openbao",
|
|
"scope": "openbao:login",
|
|
"subject": "service:secrets-engine",
|
|
"tenant": "tenant:platform",
|
|
"roles": "secrets-engine",
|
|
"deny_scope": "openbao:admin",
|
|
"secret_custody": "<secrets-engine proposal; never a value in this document>"
|
|
},
|
|
"source_closure_sha256": {
|
|
"isolated-keycape-phase-b.py": "<after review>",
|
|
"run-isolated-keycape-phase-b.sh": "<after review>",
|
|
"verify-keycape-phase-b-receipt.py": "<after review>",
|
|
"unchanged_t38_pinned_sources": "<hash list from prepare-isolated-keycape.py>"
|
|
},
|
|
"not_authorized": [
|
|
"production redirect or new client grant",
|
|
"live OpenBao read of secret data",
|
|
"human login or MFA",
|
|
"any contact with railiance01 or the cluster"
|
|
]
|
|
}
|