Rebuild Forgejo bundle from type 1.1; draft fluid-telegram custody descriptions
Bundle validates; ESO policy identical to applied CCR-2026-0041. Four fluid-telegram entries drafted from the approved plan; email-connect asked for its new path. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 327203@bnt-lap001 Assistant-Session: 55028ae3-4914-4bd1-8f5c-815f3527aef0
This commit is contained in:
parent
2ef0101412
commit
28386d3b4c
10 changed files with 97 additions and 30 deletions
|
|
@ -1,8 +1,8 @@
|
|||
proposal_for: ops-warden
|
||||
security_case:
|
||||
case: forgejo-netkingdom-oidc
|
||||
type: oidc-browser-relying-party@1.0
|
||||
render_digest: sha256:fb8b114d465341a46bb492259cb9c6b77bc0731670edace2e13a1f58758c6e23
|
||||
type: oidc-browser-relying-party@1.1
|
||||
render_digest: sha256:af1f4f81ef313f5e086e6e3de17197d9112dd40f00b4c20b52b5ca73c7a6d18a
|
||||
acceptance_record: key-cape docs/forgejo-oidc-client-request.yaml (status accepted-2026-10-08, KEY-WP-0038-T01);
|
||||
type acknowledged via informed-decision memo nk-wp-0048-t05-oidc-browser-relying-party-r4, hub decision e418263e
|
||||
accepted_at: '2026-10-08'
|
||||
|
|
|
|||
|
|
@ -2,14 +2,14 @@ id: CCR-DRAFT-FORGEJO-NETKINGDOM-OIDC-ESO
|
|||
kind: credential-change-request
|
||||
schema_version: 1
|
||||
request_type: workload-kv-read
|
||||
title: 'forgejo-netkingdom-oidc: keycape-reader-policy (oidc-browser-relying-party@1.0)'
|
||||
title: 'forgejo-netkingdom-oidc: keycape-reader-policy (oidc-browser-relying-party@1.1)'
|
||||
status: proposed
|
||||
created: '2026-10-09'
|
||||
updated: '2026-10-09'
|
||||
created: '2026-10-10'
|
||||
updated: '2026-10-10'
|
||||
requester:
|
||||
agent: ops-mason
|
||||
reason: 'MASON-WP-0010-T03 build of SecurityCase forgejo-netkingdom-oidc (oidc-browser-relying-party@1.0), render
|
||||
sha256:fb8b114d465341a46bb492259cb9c6b77bc0731670edace2e13a1f58758c6e23. Accepted by owner, founder on 2026-10-08:
|
||||
reason: 'MASON-WP-0010-T03 build of SecurityCase forgejo-netkingdom-oidc (oidc-browser-relying-party@1.1), render
|
||||
sha256:af1f4f81ef313f5e086e6e3de17197d9112dd40f00b4c20b52b5ca73c7a6d18a. Accepted by owner, founder on 2026-10-08:
|
||||
key-cape docs/forgejo-oidc-client-request.yaml (status accepted-2026-10-08, KEY-WP-0038-T01); type acknowledged
|
||||
via informed-decision memo nk-wp-0048-t05-oidc-browser-relying-party-r4, hub decision e418263e. The case acceptance
|
||||
replaces a fresh executive summary.'
|
||||
|
|
@ -76,8 +76,8 @@ lifecycle:
|
|||
compromised: owner incident process; no automatic read, reseed or cleanup
|
||||
security_case:
|
||||
case: forgejo-netkingdom-oidc
|
||||
type: oidc-browser-relying-party@1.0
|
||||
render_digest: sha256:fb8b114d465341a46bb492259cb9c6b77bc0731670edace2e13a1f58758c6e23
|
||||
type: oidc-browser-relying-party@1.1
|
||||
render_digest: sha256:af1f4f81ef313f5e086e6e3de17197d9112dd40f00b4c20b52b5ca73c7a6d18a
|
||||
acceptance_record: key-cape docs/forgejo-oidc-client-request.yaml (status accepted-2026-10-08, KEY-WP-0038-T01);
|
||||
type acknowledged via informed-decision memo nk-wp-0048-t05-oidc-browser-relying-party-r4, hub decision e418263e
|
||||
accepted_at: '2026-10-08'
|
||||
|
|
|
|||
|
|
@ -2,14 +2,14 @@ id: CCR-DRAFT-FORGEJO-NETKINGDOM-OIDC-FORGEJO
|
|||
kind: credential-change-request
|
||||
schema_version: 1
|
||||
request_type: workload-kv-read
|
||||
title: 'forgejo-netkingdom-oidc: consumer-reader-policy (oidc-browser-relying-party@1.0)'
|
||||
title: 'forgejo-netkingdom-oidc: consumer-reader-policy (oidc-browser-relying-party@1.1)'
|
||||
status: in_flight
|
||||
created: '2026-10-09'
|
||||
updated: '2026-10-09'
|
||||
created: '2026-10-10'
|
||||
updated: '2026-10-10'
|
||||
requester:
|
||||
agent: ops-mason
|
||||
reason: 'MASON-WP-0010-T03 build of SecurityCase forgejo-netkingdom-oidc (oidc-browser-relying-party@1.0), render
|
||||
sha256:fb8b114d465341a46bb492259cb9c6b77bc0731670edace2e13a1f58758c6e23. Accepted by owner, founder on 2026-10-08:
|
||||
reason: 'MASON-WP-0010-T03 build of SecurityCase forgejo-netkingdom-oidc (oidc-browser-relying-party@1.1), render
|
||||
sha256:af1f4f81ef313f5e086e6e3de17197d9112dd40f00b4c20b52b5ca73c7a6d18a. Accepted by owner, founder on 2026-10-08:
|
||||
key-cape docs/forgejo-oidc-client-request.yaml (status accepted-2026-10-08, KEY-WP-0038-T01); type acknowledged
|
||||
via informed-decision memo nk-wp-0048-t05-oidc-browser-relying-party-r4, hub decision e418263e. The case acceptance
|
||||
replaces a fresh executive summary.'
|
||||
|
|
@ -59,8 +59,8 @@ lifecycle:
|
|||
compromised: owner incident process; no automatic read, reseed or cleanup
|
||||
security_case:
|
||||
case: forgejo-netkingdom-oidc
|
||||
type: oidc-browser-relying-party@1.0
|
||||
render_digest: sha256:fb8b114d465341a46bb492259cb9c6b77bc0731670edace2e13a1f58758c6e23
|
||||
type: oidc-browser-relying-party@1.1
|
||||
render_digest: sha256:af1f4f81ef313f5e086e6e3de17197d9112dd40f00b4c20b52b5ca73c7a6d18a
|
||||
acceptance_record: key-cape docs/forgejo-oidc-client-request.yaml (status accepted-2026-10-08, KEY-WP-0038-T01);
|
||||
type acknowledged via informed-decision memo nk-wp-0048-t05-oidc-browser-relying-party-r4, hub decision e418263e
|
||||
accepted_at: '2026-10-08'
|
||||
|
|
|
|||
|
|
@ -1,12 +1,12 @@
|
|||
{
|
||||
"applier": "railiance-platform credential-change.py applier-apply (founder), after it files the CCR drafts",
|
||||
"files": {
|
||||
"catalog-proposal.yaml": "8bb3faedca22c7fa995e26978a0f040def032882fb9072b3a818cd40d5ff3818",
|
||||
"credential-change-requests/CCR-DRAFT-FORGEJO-NETKINGDOM-OIDC-ESO.yaml": "50940969383a9c7a6a8a3c2d03a0aa6fbed574a12139072b5388402651550b3e",
|
||||
"credential-change-requests/CCR-DRAFT-FORGEJO-NETKINGDOM-OIDC-FORGEJO.yaml": "691423c684da31d4611b15adb601f622f89c9cd465b55c637aed0836bb9ac9c8",
|
||||
"openbao/policies/workload-kv-read-keycape-forgejo-eso.hcl": "a25095bba974a6d63674765330abf9bc0dd719c27b446c22d95e79bb21b9631e",
|
||||
"openbao/policies/workload-kv-read-keycape-forgejo-forgejo.hcl": "1abeb50d99e850e3ea8d8d860216520fb73f4c26c12b551587dc4c95ce754950",
|
||||
"rollback.yaml": "b8bc1a3c99507183733a246d415fa5508e0f45590e9517d5a70e48ae73206fc9"
|
||||
"catalog-proposal.yaml": "193bae12338d67cd8a5548ccc00e884b44054182ce55969c7cdf5445a5e5c495",
|
||||
"credential-change-requests/CCR-DRAFT-FORGEJO-NETKINGDOM-OIDC-ESO.yaml": "41cdd89c90df7f28730a3350ab7828e89df8bd02770594bc7ccfe47fe9db8b90",
|
||||
"credential-change-requests/CCR-DRAFT-FORGEJO-NETKINGDOM-OIDC-FORGEJO.yaml": "f7e2303463ac5ac28bdb590be6f3f5445e37f8c61e23ba252af86f44b284fac0",
|
||||
"openbao/policies/workload-kv-read-keycape-forgejo-eso.hcl": "861c3a84d11b7ed596dbc707592b2ab437cd161aeb063e71dfcb92fdb8ebee0d",
|
||||
"openbao/policies/workload-kv-read-keycape-forgejo-forgejo.hcl": "7e5cb1ce0ee4546cdb564b1c9550e4fd83af47f9d5e8b9e3ee96bdaab79e2402",
|
||||
"rollback.yaml": "db5a892f953d833b7e76fe1b20d1f5d21b733786d6117017fce801e2e05fd8ca"
|
||||
},
|
||||
"kv_path": "platform/workloads/keycape/forgejo",
|
||||
"not_ops_mason": [
|
||||
|
|
@ -14,7 +14,6 @@
|
|||
"catalog activation (ops-warden)",
|
||||
"client registration (net-kingdom, attended)"
|
||||
],
|
||||
"note": "2026-10-10: policy files updated with the token self-lifecycle stanzas (render defect found in CCR-2026-0041 review); filed as CCR-2026-0041/0042.",
|
||||
"security_case": {
|
||||
"acceptance_record": "key-cape docs/forgejo-oidc-client-request.yaml (status accepted-2026-10-08, KEY-WP-0038-T01); type acknowledged via informed-decision memo nk-wp-0048-t05-oidc-browser-relying-party-r4, hub decision e418263e",
|
||||
"accepted_at": "2026-10-08",
|
||||
|
|
@ -23,7 +22,7 @@
|
|||
"founder"
|
||||
],
|
||||
"case": "forgejo-netkingdom-oidc",
|
||||
"render_digest": "sha256:fb8b114d465341a46bb492259cb9c6b77bc0731670edace2e13a1f58758c6e23",
|
||||
"type": "oidc-browser-relying-party@1.0"
|
||||
"render_digest": "sha256:af1f4f81ef313f5e086e6e3de17197d9112dd40f00b4c20b52b5ca73c7a6d18a",
|
||||
"type": "oidc-browser-relying-party@1.1"
|
||||
}
|
||||
}
|
||||
|
|
|
|||
|
|
@ -1,4 +1,4 @@
|
|||
# workload-kv-read-keycape-forgejo-eso: rendered by ops-mason from SecurityCase forgejo-netkingdom-oidc (oidc-browser-relying-party@1.0, render sha256:fb8b114d465341a46bb492259cb9c6b77bc0731670edace2e13a1f58758c6e23).
|
||||
# workload-kv-read-keycape-forgejo-eso: rendered by ops-mason from SecurityCase forgejo-netkingdom-oidc (oidc-browser-relying-party@1.1, render sha256:af1f4f81ef313f5e086e6e3de17197d9112dd40f00b4c20b52b5ca73c7a6d18a).
|
||||
# Do not edit: re-run ops-mason build --case.
|
||||
|
||||
path "platform/data/workloads/keycape/forgejo" {
|
||||
|
|
|
|||
|
|
@ -1,4 +1,4 @@
|
|||
# workload-kv-read-keycape-forgejo-forgejo: rendered by ops-mason from SecurityCase forgejo-netkingdom-oidc (oidc-browser-relying-party@1.0, render sha256:fb8b114d465341a46bb492259cb9c6b77bc0731670edace2e13a1f58758c6e23).
|
||||
# workload-kv-read-keycape-forgejo-forgejo: rendered by ops-mason from SecurityCase forgejo-netkingdom-oidc (oidc-browser-relying-party@1.1, render sha256:af1f4f81ef313f5e086e6e3de17197d9112dd40f00b4c20b52b5ca73c7a6d18a).
|
||||
# Do not edit: re-run ops-mason build --case.
|
||||
|
||||
path "platform/data/workloads/keycape/forgejo" {
|
||||
|
|
|
|||
|
|
@ -1,7 +1,7 @@
|
|||
security_case:
|
||||
case: forgejo-netkingdom-oidc
|
||||
type: oidc-browser-relying-party@1.0
|
||||
render_digest: sha256:fb8b114d465341a46bb492259cb9c6b77bc0731670edace2e13a1f58758c6e23
|
||||
type: oidc-browser-relying-party@1.1
|
||||
render_digest: sha256:af1f4f81ef313f5e086e6e3de17197d9112dd40f00b4c20b52b5ca73c7a6d18a
|
||||
acceptance_record: key-cape docs/forgejo-oidc-client-request.yaml (status accepted-2026-10-08, KEY-WP-0038-T01);
|
||||
type acknowledged via informed-decision memo nk-wp-0048-t05-oidc-browser-relying-party-r4, hub decision e418263e
|
||||
accepted_at: '2026-10-08'
|
||||
|
|
@ -22,7 +22,7 @@ removes_exactly:
|
|||
steps:
|
||||
- remove the OIDC source for forgejo from forgejo (owner railiance-apps)
|
||||
- keycape-client.py apply --operation remove for forgejo
|
||||
- remove env KEYCAPE_<CLIENT_ID>_CLIENT_SECRET from Deployment sso/keycape, after register-client is reversed
|
||||
- remove env KEYCAPE_FORGEJO_CLIENT_SECRET from Deployment sso/keycape, after register-client is reversed
|
||||
- delete ExternalSecret sso/keycape-forgejo-client and its target
|
||||
- 'covered by client-secret-path: one metadata delete, after deliver-secret is reversed'
|
||||
- identity-provisioner revoke_service_groups inside the provisioner pod (attended, as ensure-groups) with the case's
|
||||
|
|
|
|||
|
|
@ -170,6 +170,60 @@ platform/workloads/coulomb-social/backup-primary:
|
|||
sources:
|
||||
- CCR-2026-0036-coulomb-social-backup-primary.yaml
|
||||
used_by: /etc/coulomb-social-backup/primary.env
|
||||
platform/workloads/coulomb/fluid-telegram/hall-of-helix/bot-token:
|
||||
description: Telegram bot token for the hall-of-helix campaign bot, created by the provisioner. Not
|
||||
the operator session.
|
||||
missing: []
|
||||
on_loss: Regenerate with BotFather via the operator account (attended) and write a new version; the
|
||||
old token stops working.
|
||||
owner: fluid-telegram
|
||||
review: draft
|
||||
rotation: ops-mason/plans/fluid-telegram-operator-credential-lane.md; railiance-platform CCR-2026-0039
|
||||
sources:
|
||||
- ops-mason plan fluid-telegram-operator-credential-lane.md (approved 2026-10-09)
|
||||
used_by: Attended fluid-telegram provisioner only, via bao login -method=oidc -path=netkingdom role=fluid-telegram-hall-of-helix-workload-kv
|
||||
(group fluid-telegram-operators, aal2, 15m). Agents are denied (agent-high-risk-boundary). Create,
|
||||
read, update. The future adapter lane (MASON-IN-0003) may read it.
|
||||
platform/workloads/coulomb/fluid-telegram/hall-of-helix/operator-app:
|
||||
description: Telegram API application credentials (api_id, api_hash) for the hall-of-helix provisioner.
|
||||
Not a session and not a bot token.
|
||||
missing: []
|
||||
on_loss: 'Re-create the app at my.telegram.org with the operator''s account and write a new version
|
||||
(attended). Cost: provisioning pauses; the existing session and bot keep working.'
|
||||
owner: fluid-telegram
|
||||
review: draft
|
||||
rotation: ops-mason/plans/fluid-telegram-operator-credential-lane.md; railiance-platform CCR-2026-0039
|
||||
sources:
|
||||
- ops-mason plan fluid-telegram-operator-credential-lane.md (approved 2026-10-09)
|
||||
used_by: Attended fluid-telegram provisioner only, via bao login -method=oidc -path=netkingdom role=fluid-telegram-hall-of-helix-workload-kv
|
||||
(group fluid-telegram-operators, aal2, 15m). Agents are denied (agent-high-risk-boundary). Read only.
|
||||
platform/workloads/coulomb/fluid-telegram/hall-of-helix/operator-session:
|
||||
description: 'MTProto session (session_b64) of the operator''s Telegram account: a full-account credential.
|
||||
Not the bot token.'
|
||||
missing: []
|
||||
on_loss: Log in again with the operator's Telegram account through the provisioner (attended, needs
|
||||
the phone/2FA) and write a new version. Revoke the old session in Telegram if it may have leaked.
|
||||
owner: fluid-telegram
|
||||
review: draft
|
||||
rotation: ops-mason/plans/fluid-telegram-operator-credential-lane.md; railiance-platform CCR-2026-0039
|
||||
sources:
|
||||
- ops-mason plan fluid-telegram-operator-credential-lane.md (approved 2026-10-09)
|
||||
used_by: Attended fluid-telegram provisioner only, via bao login -method=oidc -path=netkingdom role=fluid-telegram-hall-of-helix-workload-kv
|
||||
(group fluid-telegram-operators, aal2, 15m). Agents are denied (agent-high-risk-boundary). Create,
|
||||
read, update.
|
||||
platform/workloads/coulomb/fluid-telegram/hall-of-helix/redaction-salt:
|
||||
description: Redaction salt (salt) for hall-of-helix, created once by the provisioner; write-once.
|
||||
missing: []
|
||||
on_loss: Not recoverable by design; a new salt changes every redacted identifier. Replacing it is a
|
||||
separately approved platform action, not a provisioner capability.
|
||||
owner: fluid-telegram
|
||||
review: draft
|
||||
rotation: ops-mason/plans/fluid-telegram-operator-credential-lane.md; railiance-platform CCR-2026-0039
|
||||
sources:
|
||||
- ops-mason plan fluid-telegram-operator-credential-lane.md (approved 2026-10-09)
|
||||
used_by: Attended fluid-telegram provisioner only, via bao login -method=oidc -path=netkingdom role=fluid-telegram-hall-of-helix-workload-kv
|
||||
(group fluid-telegram-operators, aal2, 15m). Agents are denied (agent-high-risk-boundary). Create
|
||||
once, read.
|
||||
platform/workloads/coulomb/whynot-design/npm-publish:
|
||||
description: npm package publishing through ops-warden caller-scoped fetch/exec
|
||||
missing: []
|
||||
|
|
|
|||
|
|
@ -196,6 +196,13 @@ readable but neither patch nor put may write it. Asked railiance-platform
|
|||
whether `operators/*` metadata is write-protected by design and who writes
|
||||
descriptions there (message `6b08c40d`).
|
||||
|
||||
2026-10-10 inventory (same grant as WP-0009-T05): 49 paths, 11 undescribed.
|
||||
New since the last run: the four fluid-telegram entries at the `coulomb` path
|
||||
(moved, never described) and `email-connect/callers/user-engine`. Drafted the
|
||||
fluid-telegram four from the approved plan (draft until fluid-telegram confirms,
|
||||
message `da7e711c`); asked email-connect for its new path (message
|
||||
`acb3ff22`).
|
||||
|
||||
## Make an undescribed path visible before it accumulates
|
||||
|
||||
```task
|
||||
|
|
|
|||
|
|
@ -214,3 +214,10 @@ is stale: net-kingdom's `{client_id:env}` change moves the render digest from
|
|||
`af1f4f81…`; policy `workload-kv-read-keycape-forgejo-eso` shown as already
|
||||
present from this case's own bundle. The ESO role did not appear as present;
|
||||
check on the next grant.
|
||||
|
||||
2026-10-10: type 1.1 (net-kingdom `e2174ce`, message `af66538c`) adds the
|
||||
consumer-enforces-groups verification and tightens redirect URIs; the case is
|
||||
re-pinned to @1.1. The live re-render above was already 1.1. Bundle rebuilt
|
||||
from it (`builds/case-forgejo-netkingdom-oidc/`, platform validation pass);
|
||||
the ESO policy is unchanged against the applied CCR-2026-0041, so 1.1 changes
|
||||
no OpenBao object.
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue