diff --git a/plans/case-forgejo-netkingdom-oidc.md b/plans/case-forgejo-netkingdom-oidc.md index 0ab7150..3628edb 100644 --- a/plans/case-forgejo-netkingdom-oidc.md +++ b/plans/case-forgejo-netkingdom-oidc.md @@ -3,8 +3,8 @@ id: case-forgejo-netkingdom-oidc demand_source: SecurityCase forgejo-netkingdom-oidc (owner railiance-apps) consumer_repo: railiance-apps credential_type: security-case -derived_from_type: oidc-browser-relying-party@1.0 -render_digest: sha256:fb8b114d465341a46bb492259cb9c6b77bc0731670edace2e13a1f58758c6e23 +derived_from_type: oidc-browser-relying-party@1.1 +render_digest: sha256:af1f4f81ef313f5e086e6e3de17197d9112dd40f00b4c20b52b5ca73c7a6d18a status: reviewed case_acceptance: record: key-cape docs/forgejo-oidc-client-request.yaml (status accepted-2026-10-08, @@ -21,8 +21,8 @@ approved_at: null # Construction plan (derived-from-type): forgejo-netkingdom-oidc -Rendered from `oidc-browser-relying-party@1.0` (Browser OIDC relying party for an internal service). Do not edit by hand: -re-run `ops-mason plan --case` instead. Render digest `sha256:fb8b114d465341a46bb492259cb9c6b77bc0731670edace2e13a1f58758c6e23`. +Rendered from `oidc-browser-relying-party@1.1` (Browser OIDC relying party for an internal service). Do not edit by hand: +re-run `ops-mason plan --case` instead. Render digest `sha256:af1f4f81ef313f5e086e6e3de17197d9112dd40f00b4c20b52b5ca73c7a6d18a`. **Reference case:** the type is `acknowledged`, not yet `implemented`. This case is the one whose live materialization takes the type to `implemented`. @@ -37,6 +37,10 @@ Survey source: live (metadata only). No collision with existing policies, roles, KV paths or catalog entries. +Already present from this case's own build bundle (not collisions): + +- openbao_policy workload-kv-read-keycape-forgejo-eso + ## 3. Objects (from the type's materialization) | Item | Kind | Name | @@ -106,9 +110,9 @@ Follow-through (ops-warden): - ensure-groups — net-kingdom (attended): identity-provisioner ensure_service_groups, run inside the provisioner pod through the session's contained cluster access (groups forge-admins,forge-coulomb-owners,forge-coulomb-readers; members exactly forge-admins=tegwick;forge-coulomb-owners=tegwick as recorded in the accepted case, nothing else) - mint-secret — railiance-platform: railiance-platform credential broker: generate a client secret inside custody at bao:platform/workloads/keycape/forgejo - deliver-secret — railiance-platform: ExternalSecret sso/keycape-forgejo-client (key client-secret) from bao:platform/workloads/keycape/forgejo -- bind-env — net-kingdom (attended): patch Deployment sso/keycape: env KEYCAPE__CLIENT_SECRET from sso/keycape-forgejo-client +- bind-env — net-kingdom (attended): patch Deployment sso/keycape: env KEYCAPE_FORGEJO_CLIENT_SECRET from sso/keycape-forgejo-client - register-client — net-kingdom (attended): sso-mfa/k8s/keycape/keycape-client.py apply --client-file --case-acceptance (net-kingdom.keycape-client-registration) -- hand-over — railiance-apps: configure forgejo with issuer https://kc.coulomb.social, client forgejo and custody bao:platform/workloads/keycape/forgejo +- hand-over — railiance-apps: configure forgejo with issuer https://kc.coulomb.social, client forgejo and custody bao:platform/workloads/keycape/forgejo, and make it require one of forge-admins,forge-coulomb-owners,forge-coulomb-readers in the groups claim before sign-in completes Verification: @@ -117,6 +121,7 @@ Verification: - custody-denied-to-default (deny): a default-only OpenBao identity has no read capability on bao:platform/workloads/keycape/forgejo - custody-allowed-to-consumer (allow): policy workload-kv-read-keycape-forgejo-forgejo grants read on bao:platform/workloads/keycape/forgejo (capabilities check only) - groups-present (present): LLDAP groups forge-admins,forge-coulomb-owners,forge-coulomb-readers exist, with exactly the memberships of the accepted case added +- consumer-enforces-groups (present): forgejo's OIDC source for forgejo (owner railiance-apps) requires one of forge-admins,forge-coulomb-owners,forge-coulomb-readers in the groups claim (configuration read, no secret value) - secret-delivered (present): the delivery for sso/keycape-forgejo-client reports Ready=True (status only) - mfa-pinned (present): keycape-client.py inspect for forgejo shows the MFA pin on the registered client (non-secret client view) @@ -124,7 +129,7 @@ Rollback, in order: - remove the OIDC source for forgejo from forgejo (owner railiance-apps) - keycape-client.py apply --operation remove for forgejo -- remove env KEYCAPE__CLIENT_SECRET from Deployment sso/keycape, after register-client is reversed +- remove env KEYCAPE_FORGEJO_CLIENT_SECRET from Deployment sso/keycape, after register-client is reversed - delete ExternalSecret sso/keycape-forgejo-client and its target - covered by client-secret-path: one metadata delete, after deliver-secret is reversed - identity-provisioner revoke_service_groups inside the provisioner pod (attended, as ensure-groups) with the case's memberships; delete_if_empty only if no other case uses forge-admins,forge-coulomb-owners,forge-coulomb-readers diff --git a/policies/ops-mason-survey.hcl b/policies/ops-mason-survey.hcl index fcf1769..ac64660 100644 --- a/policies/ops-mason-survey.hcl +++ b/policies/ops-mason-survey.hcl @@ -67,6 +67,11 @@ path "auth/jwt/role/*" { capabilities = ["read", "list"] } +# Service-JWT lane (CCR-2026-0038); role definitions only, never secret-ids or tokens. +path "auth/keycape-services/role/*" { + capabilities = ["read", "list"] +} + # --- survey: KV structure, never KV values ---------------------------------- # Metadata carries versions, timestamps and custom_metadata — enough to confirm # a path exists and that a paste-once delivery landed. Read/list only: this diff --git a/workplans/MASON-WP-0009-keycape-secrets-engine-openbao-client-custody.md b/workplans/MASON-WP-0009-keycape-secrets-engine-openbao-client-custody.md index cb35142..e84f1c6 100644 --- a/workplans/MASON-WP-0009-keycape-secrets-engine-openbao-client-custody.md +++ b/workplans/MASON-WP-0009-keycape-secrets-engine-openbao-client-custody.md @@ -158,3 +158,12 @@ probe-openbao`: ok, auth provider service-jwt, secret source openbao-oidc-in-memory, both revoke-self true (secrets-engine evidence `docs/evidence/2026-10-10-keycape-openbao-probe.json`, `a963a77`; message `6ed92390`). SECRETS-WP-0012 is finished. + +2026-10-10 (grant `claude-MASON-WP-0009-T05`, revoked): invariant (ii) holds: +live `secrets-engine-login-self` equals the railiance-platform file and carries +`deny` on both `platform/data/` and `platform/metadata/` for +`workloads/keycape/secrets-engine-openbao`; the ESO and operator reader +policies equal their files; mount `keycape-services/` is type jwt. Reading the +role was refused: `ops-mason-survey` did not cover `auth/keycape-services/role/*`. +Added to `policies/ops-mason-survey.hcl`; the founder reinstalls it (AGENTS.md +command), then the role check runs. diff --git a/workplans/MASON-WP-0010-security-case-materialization.md b/workplans/MASON-WP-0010-security-case-materialization.md index 2eb9a2a..c2861d7 100644 --- a/workplans/MASON-WP-0010-security-case-materialization.md +++ b/workplans/MASON-WP-0010-security-case-materialization.md @@ -209,3 +209,8 @@ case's own committed bundle (`builds/case-/rollback.yaml`, same case id) as existing still collides (2 tests, suite 177 passed). The committed Forgejo plan is stale: net-kingdom's `{client_id:env}` change moves the render digest from `fb8b114d…` to `5e97931e…`. Re-render it live under the next survey grant. + +2026-10-10: Forgejo plan re-rendered live: `reviewed`, no collision, digest +`af1f4f81…`; policy `workload-kv-read-keycape-forgejo-eso` shown as already +present from this case's own bundle. The ESO role did not appear as present; +check on the next grant.