tegwick
ac66753bd4
Schema, validator, fixtures, declarations and tests (40 pass) now use the imported principal_type and authority grants MODE @ SCOPE with activation and environments, estate conventions bind and service-admin, unknown placeholders, and an elimination path on every exception. SI-4 and SI-7 became decidable. Before/after over the same declarations: 1/11/2/5/6 to 1/10/2/5/7 (non-conformant/unknown/excepted/planned/ conformant); the only move is KeyCape's secrets-engine-openbao client, whose scope is established. lldap/admin is now also excepted under SI-4. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 328925@bnt-lap001 Assistant-Session: 14b795fd-c632-4c01-8d28-e7e490c7b0ed
88 lines
4.8 KiB
YAML
88 lines
4.8 KiB
YAML
schema_version: "0.1"
|
|
service: keycape
|
|
owner: "key-cape owners"
|
|
declared_at: 2026-10-24
|
|
attestation:
|
|
authored_by: claude-code
|
|
basis: [tools/bootstrap-recovery/identity-backup-profile.json, sso-mfa/k8s/keycape/deployment.yaml, sso-mfa/k8s/keycape/bootstrap-config.json, docs/service-identity-inventory.md]
|
|
owner_confirmed: false
|
|
complete: false
|
|
identities:
|
|
- name: secrets-engine-openbao
|
|
principal_type: SERVICE
|
|
purpose: "Confidential OIDC client; obtains a login token whose only scope is openbao:login"
|
|
grants:
|
|
- {mode: USE, scope: keycape, activation: STANDING, environments: [PRODUCTION], note: "client credentials"}
|
|
- {mode: USE, scope: openbao, activation: STANDING, environments: [PRODUCTION], note: "scope openbao:login only; openbao:admin denied"}
|
|
interactive_login: false
|
|
second_factor: not_applicable
|
|
custody: [delivered-secret]
|
|
consumers: [{name: secrets-engine, kind: service}]
|
|
owner: "key-cape owners and the consuming service owner"
|
|
rotation: {path: "Mint in custody, then deliver (credential broker); KeyCape reads it at start", coupling: [keycape, secrets-engine]}
|
|
status: active
|
|
- name: secrets-engine-approval
|
|
principal_type: SERVICE
|
|
purpose: "Confidential OIDC client; its token scopes are not established in the repository"
|
|
grants:
|
|
- {mode: USE, scope: keycape, activation: STANDING, environments: [PRODUCTION], note: "client credentials"}
|
|
- {mode: unknown, scope: "token scopes", note: "not established in the repository"}
|
|
interactive_login: false
|
|
second_factor: not_applicable
|
|
custody: [delivered-secret]
|
|
consumers: [{name: secrets-engine, kind: service}]
|
|
owner: "key-cape owners and the consuming service owner"
|
|
rotation: {path: "Mint in custody, then deliver (credential broker); KeyCape reads it at start", coupling: [keycape, secrets-engine]}
|
|
status: active
|
|
- name: secrets-engine-requester
|
|
principal_type: SERVICE
|
|
purpose: "Confidential OIDC client; its token scopes are not established in the repository"
|
|
grants:
|
|
- {mode: USE, scope: keycape, activation: STANDING, environments: [PRODUCTION], note: "client credentials"}
|
|
- {mode: unknown, scope: "token scopes", note: "not established in the repository"}
|
|
interactive_login: false
|
|
second_factor: not_applicable
|
|
custody: [delivered-secret]
|
|
consumers: [{name: secrets-engine, kind: service}]
|
|
owner: "key-cape owners and the consuming service owner"
|
|
rotation: {path: "Mint in custody, then deliver (credential broker); KeyCape reads it at start", coupling: [keycape, secrets-engine]}
|
|
status: active
|
|
- name: approval-engine-operator
|
|
principal_type: SERVICE
|
|
purpose: "Confidential OIDC client; its token scopes are not established in the repository"
|
|
grants:
|
|
- {mode: USE, scope: keycape, activation: STANDING, environments: [PRODUCTION], note: "client credentials"}
|
|
- {mode: unknown, scope: "token scopes", note: "not established in the repository"}
|
|
interactive_login: false
|
|
second_factor: not_applicable
|
|
custody: [delivered-secret]
|
|
consumers: [{name: approval-engine, kind: service}]
|
|
owner: "key-cape owners and the consuming service owner"
|
|
rotation: {path: "Mint in custody, then deliver (credential broker); KeyCape reads it at start", coupling: [keycape, approval-engine]}
|
|
status: active
|
|
- name: informed-decision-sitting-requester
|
|
principal_type: SERVICE
|
|
purpose: "Confidential OIDC client; its token scopes are not established in the repository"
|
|
grants:
|
|
- {mode: USE, scope: keycape, activation: STANDING, environments: [PRODUCTION], note: "client credentials"}
|
|
- {mode: unknown, scope: "token scopes", note: "not established in the repository"}
|
|
interactive_login: false
|
|
second_factor: not_applicable
|
|
custody: [delivered-secret]
|
|
consumers: [{name: informed-decision-sitting, kind: service}]
|
|
owner: "key-cape owners and the consuming service owner"
|
|
rotation: {path: "Mint in custody, then deliver (credential broker); KeyCape reads it at start", coupling: [keycape, informed-decision-sitting]}
|
|
status: active
|
|
- name: rapp-qonto
|
|
principal_type: SERVICE
|
|
purpose: "Confidential OIDC client; its token scopes are not established in the repository"
|
|
grants:
|
|
- {mode: USE, scope: keycape, activation: STANDING, environments: [PRODUCTION], note: "client credentials"}
|
|
- {mode: unknown, scope: "token scopes", note: "not established in the repository"}
|
|
interactive_login: false
|
|
second_factor: not_applicable
|
|
custody: [delivered-secret]
|
|
consumers: [{name: rapp-qonto, kind: service}]
|
|
owner: "key-cape owners and the consuming service owner"
|
|
rotation: {path: "Mint in custody, then deliver (credential broker); KeyCape reads it at start", coupling: [keycape, rapp-qonto]}
|
|
status: active
|