From 28386d3b4cbb74eef7b05a660515e0c2983fed0c Mon Sep 17 00:00:00 2001 From: tegwick Date: Sat, 10 Oct 2026 15:12:56 +0200 Subject: [PATCH] Rebuild Forgejo bundle from type 1.1; draft fluid-telegram custody descriptions Bundle validates; ESO policy identical to applied CCR-2026-0041. Four fluid-telegram entries drafted from the approved plan; email-connect asked for its new path. Co-Authored-By: Claude Opus 5.5 Assistant: claude-code Assistant-Model: opus Assistant-Process: 327203@bnt-lap001 Assistant-Session: 55028ae3-4914-4bd1-8f5c-815f3527aef0 --- .../catalog-proposal.yaml | 4 +- ...CCR-DRAFT-FORGEJO-NETKINGDOM-OIDC-ESO.yaml | 14 ++--- ...DRAFT-FORGEJO-NETKINGDOM-OIDC-FORGEJO.yaml | 14 ++--- .../manifest.json | 17 +++--- .../workload-kv-read-keycape-forgejo-eso.hcl | 2 +- ...rkload-kv-read-keycape-forgejo-forgejo.hcl | 2 +- .../rollback.yaml | 6 +-- manifests/custody-descriptions.yaml | 54 +++++++++++++++++++ ...-0004-credential-inventory-descriptions.md | 7 +++ ...N-WP-0010-security-case-materialization.md | 7 +++ 10 files changed, 97 insertions(+), 30 deletions(-) diff --git a/builds/case-forgejo-netkingdom-oidc/catalog-proposal.yaml b/builds/case-forgejo-netkingdom-oidc/catalog-proposal.yaml index 3775d7d..edffb9a 100644 --- a/builds/case-forgejo-netkingdom-oidc/catalog-proposal.yaml +++ b/builds/case-forgejo-netkingdom-oidc/catalog-proposal.yaml @@ -1,8 +1,8 @@ proposal_for: ops-warden security_case: case: forgejo-netkingdom-oidc - type: oidc-browser-relying-party@1.0 - render_digest: sha256:fb8b114d465341a46bb492259cb9c6b77bc0731670edace2e13a1f58758c6e23 + type: oidc-browser-relying-party@1.1 + render_digest: sha256:af1f4f81ef313f5e086e6e3de17197d9112dd40f00b4c20b52b5ca73c7a6d18a acceptance_record: key-cape docs/forgejo-oidc-client-request.yaml (status accepted-2026-10-08, KEY-WP-0038-T01); type acknowledged via informed-decision memo nk-wp-0048-t05-oidc-browser-relying-party-r4, hub decision e418263e accepted_at: '2026-10-08' diff --git a/builds/case-forgejo-netkingdom-oidc/credential-change-requests/CCR-DRAFT-FORGEJO-NETKINGDOM-OIDC-ESO.yaml b/builds/case-forgejo-netkingdom-oidc/credential-change-requests/CCR-DRAFT-FORGEJO-NETKINGDOM-OIDC-ESO.yaml index 3def51c..0b58164 100644 --- a/builds/case-forgejo-netkingdom-oidc/credential-change-requests/CCR-DRAFT-FORGEJO-NETKINGDOM-OIDC-ESO.yaml +++ b/builds/case-forgejo-netkingdom-oidc/credential-change-requests/CCR-DRAFT-FORGEJO-NETKINGDOM-OIDC-ESO.yaml @@ -2,14 +2,14 @@ id: CCR-DRAFT-FORGEJO-NETKINGDOM-OIDC-ESO kind: credential-change-request schema_version: 1 request_type: workload-kv-read -title: 'forgejo-netkingdom-oidc: keycape-reader-policy (oidc-browser-relying-party@1.0)' +title: 'forgejo-netkingdom-oidc: keycape-reader-policy (oidc-browser-relying-party@1.1)' status: proposed -created: '2026-10-09' -updated: '2026-10-09' +created: '2026-10-10' +updated: '2026-10-10' requester: agent: ops-mason - reason: 'MASON-WP-0010-T03 build of SecurityCase forgejo-netkingdom-oidc (oidc-browser-relying-party@1.0), render - sha256:fb8b114d465341a46bb492259cb9c6b77bc0731670edace2e13a1f58758c6e23. Accepted by owner, founder on 2026-10-08: + reason: 'MASON-WP-0010-T03 build of SecurityCase forgejo-netkingdom-oidc (oidc-browser-relying-party@1.1), render + sha256:af1f4f81ef313f5e086e6e3de17197d9112dd40f00b4c20b52b5ca73c7a6d18a. Accepted by owner, founder on 2026-10-08: key-cape docs/forgejo-oidc-client-request.yaml (status accepted-2026-10-08, KEY-WP-0038-T01); type acknowledged via informed-decision memo nk-wp-0048-t05-oidc-browser-relying-party-r4, hub decision e418263e. The case acceptance replaces a fresh executive summary.' @@ -76,8 +76,8 @@ lifecycle: compromised: owner incident process; no automatic read, reseed or cleanup security_case: case: forgejo-netkingdom-oidc - type: oidc-browser-relying-party@1.0 - render_digest: sha256:fb8b114d465341a46bb492259cb9c6b77bc0731670edace2e13a1f58758c6e23 + type: oidc-browser-relying-party@1.1 + render_digest: sha256:af1f4f81ef313f5e086e6e3de17197d9112dd40f00b4c20b52b5ca73c7a6d18a acceptance_record: key-cape docs/forgejo-oidc-client-request.yaml (status accepted-2026-10-08, KEY-WP-0038-T01); type acknowledged via informed-decision memo nk-wp-0048-t05-oidc-browser-relying-party-r4, hub decision e418263e accepted_at: '2026-10-08' diff --git a/builds/case-forgejo-netkingdom-oidc/credential-change-requests/CCR-DRAFT-FORGEJO-NETKINGDOM-OIDC-FORGEJO.yaml b/builds/case-forgejo-netkingdom-oidc/credential-change-requests/CCR-DRAFT-FORGEJO-NETKINGDOM-OIDC-FORGEJO.yaml index 7e73672..25de926 100644 --- a/builds/case-forgejo-netkingdom-oidc/credential-change-requests/CCR-DRAFT-FORGEJO-NETKINGDOM-OIDC-FORGEJO.yaml +++ b/builds/case-forgejo-netkingdom-oidc/credential-change-requests/CCR-DRAFT-FORGEJO-NETKINGDOM-OIDC-FORGEJO.yaml @@ -2,14 +2,14 @@ id: CCR-DRAFT-FORGEJO-NETKINGDOM-OIDC-FORGEJO kind: credential-change-request schema_version: 1 request_type: workload-kv-read -title: 'forgejo-netkingdom-oidc: consumer-reader-policy (oidc-browser-relying-party@1.0)' +title: 'forgejo-netkingdom-oidc: consumer-reader-policy (oidc-browser-relying-party@1.1)' status: in_flight -created: '2026-10-09' -updated: '2026-10-09' +created: '2026-10-10' +updated: '2026-10-10' requester: agent: ops-mason - reason: 'MASON-WP-0010-T03 build of SecurityCase forgejo-netkingdom-oidc (oidc-browser-relying-party@1.0), render - sha256:fb8b114d465341a46bb492259cb9c6b77bc0731670edace2e13a1f58758c6e23. Accepted by owner, founder on 2026-10-08: + reason: 'MASON-WP-0010-T03 build of SecurityCase forgejo-netkingdom-oidc (oidc-browser-relying-party@1.1), render + sha256:af1f4f81ef313f5e086e6e3de17197d9112dd40f00b4c20b52b5ca73c7a6d18a. Accepted by owner, founder on 2026-10-08: key-cape docs/forgejo-oidc-client-request.yaml (status accepted-2026-10-08, KEY-WP-0038-T01); type acknowledged via informed-decision memo nk-wp-0048-t05-oidc-browser-relying-party-r4, hub decision e418263e. The case acceptance replaces a fresh executive summary.' @@ -59,8 +59,8 @@ lifecycle: compromised: owner incident process; no automatic read, reseed or cleanup security_case: case: forgejo-netkingdom-oidc - type: oidc-browser-relying-party@1.0 - render_digest: sha256:fb8b114d465341a46bb492259cb9c6b77bc0731670edace2e13a1f58758c6e23 + type: oidc-browser-relying-party@1.1 + render_digest: sha256:af1f4f81ef313f5e086e6e3de17197d9112dd40f00b4c20b52b5ca73c7a6d18a acceptance_record: key-cape docs/forgejo-oidc-client-request.yaml (status accepted-2026-10-08, KEY-WP-0038-T01); type acknowledged via informed-decision memo nk-wp-0048-t05-oidc-browser-relying-party-r4, hub decision e418263e accepted_at: '2026-10-08' diff --git a/builds/case-forgejo-netkingdom-oidc/manifest.json b/builds/case-forgejo-netkingdom-oidc/manifest.json index fb76bdb..9a07302 100644 --- a/builds/case-forgejo-netkingdom-oidc/manifest.json +++ b/builds/case-forgejo-netkingdom-oidc/manifest.json @@ -1,12 +1,12 @@ { "applier": "railiance-platform credential-change.py applier-apply (founder), after it files the CCR drafts", "files": { - "catalog-proposal.yaml": "8bb3faedca22c7fa995e26978a0f040def032882fb9072b3a818cd40d5ff3818", - "credential-change-requests/CCR-DRAFT-FORGEJO-NETKINGDOM-OIDC-ESO.yaml": "50940969383a9c7a6a8a3c2d03a0aa6fbed574a12139072b5388402651550b3e", - "credential-change-requests/CCR-DRAFT-FORGEJO-NETKINGDOM-OIDC-FORGEJO.yaml": "691423c684da31d4611b15adb601f622f89c9cd465b55c637aed0836bb9ac9c8", - "openbao/policies/workload-kv-read-keycape-forgejo-eso.hcl": "a25095bba974a6d63674765330abf9bc0dd719c27b446c22d95e79bb21b9631e", - "openbao/policies/workload-kv-read-keycape-forgejo-forgejo.hcl": "1abeb50d99e850e3ea8d8d860216520fb73f4c26c12b551587dc4c95ce754950", - "rollback.yaml": "b8bc1a3c99507183733a246d415fa5508e0f45590e9517d5a70e48ae73206fc9" + "catalog-proposal.yaml": "193bae12338d67cd8a5548ccc00e884b44054182ce55969c7cdf5445a5e5c495", + "credential-change-requests/CCR-DRAFT-FORGEJO-NETKINGDOM-OIDC-ESO.yaml": "41cdd89c90df7f28730a3350ab7828e89df8bd02770594bc7ccfe47fe9db8b90", + "credential-change-requests/CCR-DRAFT-FORGEJO-NETKINGDOM-OIDC-FORGEJO.yaml": "f7e2303463ac5ac28bdb590be6f3f5445e37f8c61e23ba252af86f44b284fac0", + "openbao/policies/workload-kv-read-keycape-forgejo-eso.hcl": "861c3a84d11b7ed596dbc707592b2ab437cd161aeb063e71dfcb92fdb8ebee0d", + "openbao/policies/workload-kv-read-keycape-forgejo-forgejo.hcl": "7e5cb1ce0ee4546cdb564b1c9550e4fd83af47f9d5e8b9e3ee96bdaab79e2402", + "rollback.yaml": "db5a892f953d833b7e76fe1b20d1f5d21b733786d6117017fce801e2e05fd8ca" }, "kv_path": "platform/workloads/keycape/forgejo", "not_ops_mason": [ @@ -14,7 +14,6 @@ "catalog activation (ops-warden)", "client registration (net-kingdom, attended)" ], - "note": "2026-10-10: policy files updated with the token self-lifecycle stanzas (render defect found in CCR-2026-0041 review); filed as CCR-2026-0041/0042.", "security_case": { "acceptance_record": "key-cape docs/forgejo-oidc-client-request.yaml (status accepted-2026-10-08, KEY-WP-0038-T01); type acknowledged via informed-decision memo nk-wp-0048-t05-oidc-browser-relying-party-r4, hub decision e418263e", "accepted_at": "2026-10-08", @@ -23,7 +22,7 @@ "founder" ], "case": "forgejo-netkingdom-oidc", - "render_digest": "sha256:fb8b114d465341a46bb492259cb9c6b77bc0731670edace2e13a1f58758c6e23", - "type": "oidc-browser-relying-party@1.0" + "render_digest": "sha256:af1f4f81ef313f5e086e6e3de17197d9112dd40f00b4c20b52b5ca73c7a6d18a", + "type": "oidc-browser-relying-party@1.1" } } diff --git a/builds/case-forgejo-netkingdom-oidc/openbao/policies/workload-kv-read-keycape-forgejo-eso.hcl b/builds/case-forgejo-netkingdom-oidc/openbao/policies/workload-kv-read-keycape-forgejo-eso.hcl index cf94ae8..7a41c40 100644 --- a/builds/case-forgejo-netkingdom-oidc/openbao/policies/workload-kv-read-keycape-forgejo-eso.hcl +++ b/builds/case-forgejo-netkingdom-oidc/openbao/policies/workload-kv-read-keycape-forgejo-eso.hcl @@ -1,4 +1,4 @@ -# workload-kv-read-keycape-forgejo-eso: rendered by ops-mason from SecurityCase forgejo-netkingdom-oidc (oidc-browser-relying-party@1.0, render sha256:fb8b114d465341a46bb492259cb9c6b77bc0731670edace2e13a1f58758c6e23). +# workload-kv-read-keycape-forgejo-eso: rendered by ops-mason from SecurityCase forgejo-netkingdom-oidc (oidc-browser-relying-party@1.1, render sha256:af1f4f81ef313f5e086e6e3de17197d9112dd40f00b4c20b52b5ca73c7a6d18a). # Do not edit: re-run ops-mason build --case. path "platform/data/workloads/keycape/forgejo" { diff --git a/builds/case-forgejo-netkingdom-oidc/openbao/policies/workload-kv-read-keycape-forgejo-forgejo.hcl b/builds/case-forgejo-netkingdom-oidc/openbao/policies/workload-kv-read-keycape-forgejo-forgejo.hcl index c524571..55a3141 100644 --- a/builds/case-forgejo-netkingdom-oidc/openbao/policies/workload-kv-read-keycape-forgejo-forgejo.hcl +++ b/builds/case-forgejo-netkingdom-oidc/openbao/policies/workload-kv-read-keycape-forgejo-forgejo.hcl @@ -1,4 +1,4 @@ -# workload-kv-read-keycape-forgejo-forgejo: rendered by ops-mason from SecurityCase forgejo-netkingdom-oidc (oidc-browser-relying-party@1.0, render sha256:fb8b114d465341a46bb492259cb9c6b77bc0731670edace2e13a1f58758c6e23). +# workload-kv-read-keycape-forgejo-forgejo: rendered by ops-mason from SecurityCase forgejo-netkingdom-oidc (oidc-browser-relying-party@1.1, render sha256:af1f4f81ef313f5e086e6e3de17197d9112dd40f00b4c20b52b5ca73c7a6d18a). # Do not edit: re-run ops-mason build --case. path "platform/data/workloads/keycape/forgejo" { diff --git a/builds/case-forgejo-netkingdom-oidc/rollback.yaml b/builds/case-forgejo-netkingdom-oidc/rollback.yaml index f064e08..6b34437 100644 --- a/builds/case-forgejo-netkingdom-oidc/rollback.yaml +++ b/builds/case-forgejo-netkingdom-oidc/rollback.yaml @@ -1,7 +1,7 @@ security_case: case: forgejo-netkingdom-oidc - type: oidc-browser-relying-party@1.0 - render_digest: sha256:fb8b114d465341a46bb492259cb9c6b77bc0731670edace2e13a1f58758c6e23 + type: oidc-browser-relying-party@1.1 + render_digest: sha256:af1f4f81ef313f5e086e6e3de17197d9112dd40f00b4c20b52b5ca73c7a6d18a acceptance_record: key-cape docs/forgejo-oidc-client-request.yaml (status accepted-2026-10-08, KEY-WP-0038-T01); type acknowledged via informed-decision memo nk-wp-0048-t05-oidc-browser-relying-party-r4, hub decision e418263e accepted_at: '2026-10-08' @@ -22,7 +22,7 @@ removes_exactly: steps: - remove the OIDC source for forgejo from forgejo (owner railiance-apps) - keycape-client.py apply --operation remove for forgejo -- remove env KEYCAPE__CLIENT_SECRET from Deployment sso/keycape, after register-client is reversed +- remove env KEYCAPE_FORGEJO_CLIENT_SECRET from Deployment sso/keycape, after register-client is reversed - delete ExternalSecret sso/keycape-forgejo-client and its target - 'covered by client-secret-path: one metadata delete, after deliver-secret is reversed' - identity-provisioner revoke_service_groups inside the provisioner pod (attended, as ensure-groups) with the case's diff --git a/manifests/custody-descriptions.yaml b/manifests/custody-descriptions.yaml index 9dffb3f..94891d7 100644 --- a/manifests/custody-descriptions.yaml +++ b/manifests/custody-descriptions.yaml @@ -170,6 +170,60 @@ platform/workloads/coulomb-social/backup-primary: sources: - CCR-2026-0036-coulomb-social-backup-primary.yaml used_by: /etc/coulomb-social-backup/primary.env +platform/workloads/coulomb/fluid-telegram/hall-of-helix/bot-token: + description: Telegram bot token for the hall-of-helix campaign bot, created by the provisioner. Not + the operator session. + missing: [] + on_loss: Regenerate with BotFather via the operator account (attended) and write a new version; the + old token stops working. + owner: fluid-telegram + review: draft + rotation: ops-mason/plans/fluid-telegram-operator-credential-lane.md; railiance-platform CCR-2026-0039 + sources: + - ops-mason plan fluid-telegram-operator-credential-lane.md (approved 2026-10-09) + used_by: Attended fluid-telegram provisioner only, via bao login -method=oidc -path=netkingdom role=fluid-telegram-hall-of-helix-workload-kv + (group fluid-telegram-operators, aal2, 15m). Agents are denied (agent-high-risk-boundary). Create, + read, update. The future adapter lane (MASON-IN-0003) may read it. +platform/workloads/coulomb/fluid-telegram/hall-of-helix/operator-app: + description: Telegram API application credentials (api_id, api_hash) for the hall-of-helix provisioner. + Not a session and not a bot token. + missing: [] + on_loss: 'Re-create the app at my.telegram.org with the operator''s account and write a new version + (attended). Cost: provisioning pauses; the existing session and bot keep working.' + owner: fluid-telegram + review: draft + rotation: ops-mason/plans/fluid-telegram-operator-credential-lane.md; railiance-platform CCR-2026-0039 + sources: + - ops-mason plan fluid-telegram-operator-credential-lane.md (approved 2026-10-09) + used_by: Attended fluid-telegram provisioner only, via bao login -method=oidc -path=netkingdom role=fluid-telegram-hall-of-helix-workload-kv + (group fluid-telegram-operators, aal2, 15m). Agents are denied (agent-high-risk-boundary). Read only. +platform/workloads/coulomb/fluid-telegram/hall-of-helix/operator-session: + description: 'MTProto session (session_b64) of the operator''s Telegram account: a full-account credential. + Not the bot token.' + missing: [] + on_loss: Log in again with the operator's Telegram account through the provisioner (attended, needs + the phone/2FA) and write a new version. Revoke the old session in Telegram if it may have leaked. + owner: fluid-telegram + review: draft + rotation: ops-mason/plans/fluid-telegram-operator-credential-lane.md; railiance-platform CCR-2026-0039 + sources: + - ops-mason plan fluid-telegram-operator-credential-lane.md (approved 2026-10-09) + used_by: Attended fluid-telegram provisioner only, via bao login -method=oidc -path=netkingdom role=fluid-telegram-hall-of-helix-workload-kv + (group fluid-telegram-operators, aal2, 15m). Agents are denied (agent-high-risk-boundary). Create, + read, update. +platform/workloads/coulomb/fluid-telegram/hall-of-helix/redaction-salt: + description: Redaction salt (salt) for hall-of-helix, created once by the provisioner; write-once. + missing: [] + on_loss: Not recoverable by design; a new salt changes every redacted identifier. Replacing it is a + separately approved platform action, not a provisioner capability. + owner: fluid-telegram + review: draft + rotation: ops-mason/plans/fluid-telegram-operator-credential-lane.md; railiance-platform CCR-2026-0039 + sources: + - ops-mason plan fluid-telegram-operator-credential-lane.md (approved 2026-10-09) + used_by: Attended fluid-telegram provisioner only, via bao login -method=oidc -path=netkingdom role=fluid-telegram-hall-of-helix-workload-kv + (group fluid-telegram-operators, aal2, 15m). Agents are denied (agent-high-risk-boundary). Create + once, read. platform/workloads/coulomb/whynot-design/npm-publish: description: npm package publishing through ops-warden caller-scoped fetch/exec missing: [] diff --git a/workplans/MASON-WP-0004-credential-inventory-descriptions.md b/workplans/MASON-WP-0004-credential-inventory-descriptions.md index e7b38fc..f4b68a2 100644 --- a/workplans/MASON-WP-0004-credential-inventory-descriptions.md +++ b/workplans/MASON-WP-0004-credential-inventory-descriptions.md @@ -196,6 +196,13 @@ readable but neither patch nor put may write it. Asked railiance-platform whether `operators/*` metadata is write-protected by design and who writes descriptions there (message `6b08c40d`). +2026-10-10 inventory (same grant as WP-0009-T05): 49 paths, 11 undescribed. +New since the last run: the four fluid-telegram entries at the `coulomb` path +(moved, never described) and `email-connect/callers/user-engine`. Drafted the +fluid-telegram four from the approved plan (draft until fluid-telegram confirms, +message `da7e711c`); asked email-connect for its new path (message +`acb3ff22`). + ## Make an undescribed path visible before it accumulates ```task diff --git a/workplans/MASON-WP-0010-security-case-materialization.md b/workplans/MASON-WP-0010-security-case-materialization.md index c2861d7..9bb70d3 100644 --- a/workplans/MASON-WP-0010-security-case-materialization.md +++ b/workplans/MASON-WP-0010-security-case-materialization.md @@ -214,3 +214,10 @@ is stale: net-kingdom's `{client_id:env}` change moves the render digest from `af1f4f81…`; policy `workload-kv-read-keycape-forgejo-eso` shown as already present from this case's own bundle. The ESO role did not appear as present; check on the next grant. + +2026-10-10: type 1.1 (net-kingdom `e2174ce`, message `af66538c`) adds the +consumer-enforces-groups verification and tightens redirect URIs; the case is +re-pinned to @1.1. The live re-render above was already 1.1. Bundle rebuilt +from it (`builds/case-forgejo-netkingdom-oidc/`, platform validation pass); +the ESO policy is unchanged against the applied CCR-2026-0041, so 1.1 changes +no OpenBao object.