MASON-WP-0009-T04 done: live capability verification of the KeyCape secrets-engine-openbao lane
Value-free evidence under the read-only ops-mason-survey grant (revoked after use). Adds T05 for live-token checks and the pointer route. Fixes bao-session.sh grant misreporting an unreadable policy as absent. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 132360@bnt-lap001 Assistant-Session: 769b1afd-4330-4c86-96b2-e510e26db42b
This commit is contained in:
parent
dee5bac2c6
commit
6a602edafb
4 changed files with 229 additions and 7 deletions
|
|
@ -0,0 +1,134 @@
|
|||
{
|
||||
"workplan": "MASON-WP-0009",
|
||||
"task": "MASON-WP-0009-T04",
|
||||
"date": "2026-10-07",
|
||||
"kind": "capability verification (metadata and policy text only; value-free)",
|
||||
"status": "pass",
|
||||
"grant": {
|
||||
"policy": "ops-mason-survey",
|
||||
"extra_policies": ["default"],
|
||||
"display_name": "token-claude-MASON-WP-0009-T04",
|
||||
"bao_addr": "http://127.0.0.1:18200",
|
||||
"founder_session_used": false,
|
||||
"revoked_self": true,
|
||||
"lookup_after_revoke_failed": true,
|
||||
"token_file_shredded": true
|
||||
},
|
||||
"kv_path": "platform/workloads/keycape/secrets-engine-openbao",
|
||||
"secret_value_read": false,
|
||||
"checks": {
|
||||
"1_policies": {
|
||||
"result": "pass",
|
||||
"workload-kv-read-keycape-secrets-engine-openbao-eso": {
|
||||
"live_matches_repo_file": true,
|
||||
"repo_file": "railiance-platform/openbao/policies/workload-kv-read-keycape-secrets-engine-openbao-eso.hcl",
|
||||
"paths": {
|
||||
"platform/data/workloads/keycape/secrets-engine-openbao": ["read"],
|
||||
"auth/token/lookup-self": ["read"],
|
||||
"auth/token/revoke-self": ["update"]
|
||||
}
|
||||
},
|
||||
"workload-kv-read-keycape-secrets-engine-openbao-operator": {
|
||||
"live_matches_repo_file": true,
|
||||
"repo_file": "railiance-platform/openbao/policies/workload-kv-read-keycape-secrets-engine-openbao-operator.hcl",
|
||||
"paths": {
|
||||
"platform/data/workloads/keycape/secrets-engine-openbao": ["read"],
|
||||
"auth/token/revoke-self": ["update"]
|
||||
}
|
||||
}
|
||||
},
|
||||
"2_roles": {
|
||||
"result": "pass",
|
||||
"auth/kubernetes/role/external-secrets-keycape-secrets-engine-openbao": {
|
||||
"matches": "railiance-platform/credential-change-requests/CCR-2026-0033.yaml",
|
||||
"bound_service_account_names": ["external-secrets"],
|
||||
"bound_service_account_namespaces": ["external-secrets"],
|
||||
"audience": "openbao",
|
||||
"token_ttl_s": 900, "token_max_ttl_s": 900, "token_explicit_max_ttl_s": 900,
|
||||
"token_no_default_policy": true,
|
||||
"token_policies": ["workload-kv-read-keycape-secrets-engine-openbao-eso"]
|
||||
},
|
||||
"auth/netkingdom/role/keycape-secrets-engine-openbao-operator-workload-kv-read": {
|
||||
"matches": "railiance-platform/credential-change-requests/CCR-2026-0034.yaml",
|
||||
"role_type": "oidc",
|
||||
"bound_claims_keys": ["groups", "/assurance/level"],
|
||||
"bound_groups": ["net-kingdom-admins"],
|
||||
"bound_assurance_level": "aal2",
|
||||
"bound_claims_type": "string",
|
||||
"user_claim": "sub", "groups_claim": "groups",
|
||||
"oidc_scopes": ["openid", "profile", "email", "groups"],
|
||||
"token_ttl_s": 300, "token_max_ttl_s": 300, "token_explicit_max_ttl_s": 300,
|
||||
"token_num_uses": 4,
|
||||
"token_type": "service",
|
||||
"token_no_default_policy": true,
|
||||
"token_policies": ["workload-kv-read-keycape-secrets-engine-openbao-operator"],
|
||||
"allowed_redirect_uris_match_ccr": true,
|
||||
"note": "includes the known harmless retired redirect https://bao.coulomb.social/ui/vault/auth/netkingdom/oidc/callback, as in the CCR"
|
||||
}
|
||||
},
|
||||
"3_kv_metadata": {
|
||||
"result": "pass",
|
||||
"method": "bao kv metadata get (never kv get)",
|
||||
"current_version": 1,
|
||||
"version_1_deleted": false,
|
||||
"version_1_destroyed": false,
|
||||
"cas_required": true,
|
||||
"max_versions": 2,
|
||||
"delete_version_after": "0s",
|
||||
"custom_metadata_keys": ["ccr", "classification", "client_id", "issuer", "owner", "plan", "readers", "rotation"],
|
||||
"custom_metadata_matches_plan_section_3_1": true
|
||||
},
|
||||
"4_circularity": {
|
||||
"result": "pass",
|
||||
"a_policies_reaching_data_path": {
|
||||
"policies_listed": 81,
|
||||
"policies_read": 79,
|
||||
"not_readable": {"ops-mason-survey": "denied by its own explicit deny (by design)", "root": "built-in, not readable"},
|
||||
"lane_policies": ["workload-kv-read-keycape-secrets-engine-openbao-eso", "workload-kv-read-keycape-secrets-engine-openbao-operator"],
|
||||
"broad_policies": {
|
||||
"platform-admin": "platform/* create/read/update/delete/list; bound to auth/netkingdom/role/platform-admin (with operator-custody)",
|
||||
"root": "built-in"
|
||||
},
|
||||
"other_grant_on_path": false,
|
||||
"secrets_engine_policies_reach_path": false,
|
||||
"secrets_engine_policies_checked": ["secrets-engine-build", "secrets-engine-prod", "secrets-engine-test"],
|
||||
"secrets-engine-openbao_jwt_policy_exists": false
|
||||
},
|
||||
"b_jwt_roles": {
|
||||
"auth_jwt_mount_present": false,
|
||||
"keycape_services_jwt_mount_present": false,
|
||||
"auth_mounts": ["approle", "keycape (oidc)", "kubernetes", "netkingdom (oidc)", "token"],
|
||||
"roles_surveyed": {"kubernetes": 27, "netkingdom": 12, "approle": 14},
|
||||
"roles_binding_path_reaching_policies": [
|
||||
"kubernetes/external-secrets-keycape-secrets-engine-openbao",
|
||||
"netkingdom/keycape-secrets-engine-openbao-operator-workload-kv-read",
|
||||
"netkingdom/platform-admin"
|
||||
]
|
||||
},
|
||||
"c_eso_reader_on_kubernetes_auth": true
|
||||
},
|
||||
"5_grant_self_check": {
|
||||
"result": "pass",
|
||||
"platform/data/workloads/keycape/secrets-engine-openbao": "deny",
|
||||
"platform/metadata/workloads/keycape/secrets-engine-openbao": "list, read",
|
||||
"sys/policies/acl/x": "read",
|
||||
"sys/policies/acl/ops-mason-survey": "deny",
|
||||
"auth/approle/role/x/secret-id": "deny",
|
||||
"auth/token/create": "deny"
|
||||
}
|
||||
},
|
||||
"not_permitted_by_ops-mason-survey": [
|
||||
"auth/keycape/role (list/read) - the KeyCape human OIDC mount's roles were not surveyed; invariant (i)/(ii) cover it only through policy text",
|
||||
"sys/policies/acl/ops-mason-survey (own policy, explicit deny)"
|
||||
],
|
||||
"observations_for_owners": [
|
||||
"ops-mason-build (retired, 'never to be installed') is still installed. It denies platform/data/* but grants create/update on platform/metadata/*, which could change cas_required/max_versions of this entry. No surveyed role binds it. Founder/platform should delete it.",
|
||||
"secrets-engine-prod may write sys/policies/acl/se-prod-* with unconstrained content and bind it via auth/approle/role/se-prod-*; it could author a policy reaching this path. No such policy exists now; this is an indirect route outside invariant (ii) as worded.",
|
||||
"agent-high-risk-boundary does not list this path among its explicit denies, unlike the sibling secrets-engine approval-client/requester entries."
|
||||
],
|
||||
"not_covered_here": [
|
||||
"Plan section 4 checks 1-3 and 6 need live lane tokens (operator OIDC login, ESO token, non-member identity, secrets-engine service-jwt run). The survey grant cannot mint or use them; policy text and role definitions are verified equivalent instead.",
|
||||
"The secrets-engine-openbao service-JWT mount (keycape-services) and its policy do not exist yet (RPF-WP-0035-T02); invariant (ii) must be rechecked once they are applied.",
|
||||
"Pointer-only ops-warden route for the operator lane (MASON-WP-0009-T05)."
|
||||
]
|
||||
}
|
||||
Loading…
Add table
Add a link
Reference in a new issue