coulomb/ops-mason
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

WP-0009-T05 invariant (ii) verified; survey policy covers keycape-services roles; Forgejo plan re-rendered

Browse source 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 327203@bnt-lap001
Assistant-Session: 55028ae3-4914-4bd1-8f5c-815f3527aef0
This commit is contained in:
tegwick 2026-10-10 14:13:02 +02:00
parent 8f8692a100
commit 2ef0101412
4 changed files with 31 additions and 7 deletions
Download patch file Download diff file Expand all files Collapse all files

19
plans/case-forgejo-netkingdom-oidc.md
View file

@ -3,8 +3,8 @@ id: case-forgejo-netkingdom-oidc
demand_source: SecurityCase forgejo-netkingdom-oidc (owner railiance-apps)
consumer_repo: railiance-apps
credential_type: security-case
derived_from_type: oidc-browser-relying-party@1.0
render_digest: sha256:fb8b114d465341a46bb492259cb9c6b77bc0731670edace2e13a1f58758c6e23
derived_from_type: oidc-browser-relying-party@1.1
render_digest: sha256:af1f4f81ef313f5e086e6e3de17197d9112dd40f00b4c20b52b5ca73c7a6d18a
status: reviewed
case_acceptance:
record: key-cape docs/forgejo-oidc-client-request.yaml (status accepted-2026-10-08,
@ -21,8 +21,8 @@ approved_at: null
# Construction plan (derived-from-type): forgejo-netkingdom-oidc
Rendered from `oidc-browser-relying-party@1.0` (Browser OIDC relying party for an internal service). Do not edit by hand:
re-run `ops-mason plan --case` instead. Render digest `sha256:fb8b114d465341a46bb492259cb9c6b77bc0731670edace2e13a1f58758c6e23`.
Rendered from `oidc-browser-relying-party@1.1` (Browser OIDC relying party for an internal service). Do not edit by hand:
re-run `ops-mason plan --case` instead. Render digest `sha256:af1f4f81ef313f5e086e6e3de17197d9112dd40f00b4c20b52b5ca73c7a6d18a`.
**Reference case:** the type is `acknowledged`, not yet `implemented`. This case
is the one whose live materialization takes the type to `implemented`.
@ -37,6 +37,10 @@ Survey source: live (metadata only).
No collision with existing policies, roles, KV paths or catalog entries.
Already present from this case's own build bundle (not collisions):
- openbao_policy workload-kv-read-keycape-forgejo-eso
## 3. Objects (from the type's materialization)
| Item | Kind | Name |
@ -106,9 +110,9 @@ Follow-through (ops-warden):
- ensure-groups — net-kingdom (attended): identity-provisioner ensure_service_groups, run inside the provisioner pod through the session's contained cluster access (groups forge-admins,forge-coulomb-owners,forge-coulomb-readers; members exactly forge-admins=tegwick;forge-coulomb-owners=tegwick as recorded in the accepted case, nothing else)
- mint-secret — railiance-platform: railiance-platform credential broker: generate a client secret inside custody at bao:platform/workloads/keycape/forgejo
- deliver-secret — railiance-platform: ExternalSecret sso/keycape-forgejo-client (key client-secret) from bao:platform/workloads/keycape/forgejo
- bind-env — net-kingdom (attended): patch Deployment sso/keycape: env KEYCAPE_<CLIENT_ID>_CLIENT_SECRET from sso/keycape-forgejo-client
- bind-env — net-kingdom (attended): patch Deployment sso/keycape: env KEYCAPE_FORGEJO_CLIENT_SECRET from sso/keycape-forgejo-client
- register-client — net-kingdom (attended): sso-mfa/k8s/keycape/keycape-client.py apply --client-file <client-from-case> --case-acceptance <record> (net-kingdom.keycape-client-registration)
- hand-over — railiance-apps: configure forgejo with issuer https://kc.coulomb.social, client forgejo and custody bao:platform/workloads/keycape/forgejo
- hand-over — railiance-apps: configure forgejo with issuer https://kc.coulomb.social, client forgejo and custody bao:platform/workloads/keycape/forgejo, and make it require one of forge-admins,forge-coulomb-owners,forge-coulomb-readers in the groups claim before sign-in completes
Verification:
@ -117,6 +121,7 @@ Verification:
- custody-denied-to-default (deny): a default-only OpenBao identity has no read capability on bao:platform/workloads/keycape/forgejo
- custody-allowed-to-consumer (allow): policy workload-kv-read-keycape-forgejo-forgejo grants read on bao:platform/workloads/keycape/forgejo (capabilities check only)
- groups-present (present): LLDAP groups forge-admins,forge-coulomb-owners,forge-coulomb-readers exist, with exactly the memberships of the accepted case added
- consumer-enforces-groups (present): forgejo's OIDC source for forgejo (owner railiance-apps) requires one of forge-admins,forge-coulomb-owners,forge-coulomb-readers in the groups claim (configuration read, no secret value)
- secret-delivered (present): the delivery for sso/keycape-forgejo-client reports Ready=True (status only)
- mfa-pinned (present): keycape-client.py inspect for forgejo shows the MFA pin on the registered client (non-secret client view)
@ -124,7 +129,7 @@ Rollback, in order:
- remove the OIDC source for forgejo from forgejo (owner railiance-apps)
- keycape-client.py apply --operation remove for forgejo
- remove env KEYCAPE_<CLIENT_ID>_CLIENT_SECRET from Deployment sso/keycape, after register-client is reversed
- remove env KEYCAPE_FORGEJO_CLIENT_SECRET from Deployment sso/keycape, after register-client is reversed
- delete ExternalSecret sso/keycape-forgejo-client and its target
- covered by client-secret-path: one metadata delete, after deliver-secret is reversed
- identity-provisioner revoke_service_groups inside the provisioner pod (attended, as ensure-groups) with the case's memberships; delete_if_empty only if no other case uses forge-admins,forge-coulomb-owners,forge-coulomb-readers

5
policies/ops-mason-survey.hcl
View file

@ -67,6 +67,11 @@ path "auth/jwt/role/*" {
capabilities = ["read", "list"]
}
# Service-JWT lane (CCR-2026-0038); role definitions only, never secret-ids or tokens.
path "auth/keycape-services/role/*" {
capabilities = ["read", "list"]
}
# --- survey: KV structure, never KV values ----------------------------------
# Metadata carries versions, timestamps and custom_metadata — enough to confirm
# a path exists and that a paste-once delivery landed. Read/list only: this

9
workplans/MASON-WP-0009-keycape-secrets-engine-openbao-client-custody.md
View file

@ -158,3 +158,12 @@ probe-openbao`: ok, auth provider service-jwt, secret source
openbao-oidc-in-memory, both revoke-self true (secrets-engine evidence
`docs/evidence/2026-10-10-keycape-openbao-probe.json`, `a963a77`; message
`6ed92390`). SECRETS-WP-0012 is finished.
2026-10-10 (grant `claude-MASON-WP-0009-T05`, revoked): invariant (ii) holds:
live `secrets-engine-login-self` equals the railiance-platform file and carries
`deny` on both `platform/data/` and `platform/metadata/` for
`workloads/keycape/secrets-engine-openbao`; the ESO and operator reader
policies equal their files; mount `keycape-services/` is type jwt. Reading the
role was refused: `ops-mason-survey` did not cover `auth/keycape-services/role/*`.
Added to `policies/ops-mason-survey.hcl`; the founder reinstalls it (AGENTS.md
command), then the role check runs.

5
workplans/MASON-WP-0010-security-case-materialization.md
View file

@ -209,3 +209,8 @@ case's own committed bundle (`builds/case-<id>/rollback.yaml`, same case id) as
existing still collides (2 tests, suite 177 passed). The committed Forgejo plan
is stale: net-kingdom's `{client_id:env}` change moves the render digest from
`fb8b114d…` to `5e97931e…`. Re-render it live under the next survey grant.
2026-10-10: Forgejo plan re-rendered live: `reviewed`, no collision, digest
`af1f4f81…`; policy `workload-kv-read-keycape-forgejo-eso` shown as already
present from this case's own bundle. The ESO role did not appear as present;
check on the next grant.