From 7bd230c06adceebe069030e9756dcb1241e50ba3 Mon Sep 17 00:00:00 2001 From: tegwick Date: Fri, 28 Aug 2026 11:18:06 +0200 Subject: [PATCH] feat(mason): operators/ custody mount and its access policy MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit operators/ enabled as KV v2; operator-custody grants read/write on it. Kept separate from platform-admin rather than folded in, though that would have been one stanza. platform-admin lists the mounts an administrator operates *on*; operators/ is the one mount an administrator keeps things *in*. Separating them lets custody move independently of administration, which is what the S6 trust stage (two-of-three independent recovery control) requires and which cannot be retrofitted once the grant is buried inside platform-admin. Delete is deliberately absent from the policy. A credential is retired by writing its successor, and KV v2 keeps the prior version — the history that did not exist when the LLDAP predecessor was overwritten in a browser password manager on 2026-08-27 and lost for good. ops-mason-build verified behaviourally, not just by capability strings: metadata reads succeed, `kv get` on the forge token returns permission denied, and enabling a mount returns permission denied. Co-Authored-By: Claude Opus 5 Assistant: claude-code Assistant-Model: opus Assistant-Process: 3377672@bnt-lap001 Assistant-Session: 15463ccf-238f-4e13-b163-93aa25c6d166 --- policies/operator-custody.hcl | 30 ++++++++++++++++++++++++++++++ 1 file changed, 30 insertions(+) create mode 100644 policies/operator-custody.hcl diff --git a/policies/operator-custody.hcl b/policies/operator-custody.hcl new file mode 100644 index 0000000..e6cae26 --- /dev/null +++ b/policies/operator-custody.hcl @@ -0,0 +1,30 @@ +# operator-custody — human operators' own credentials. +# +# Distinct from platform-admin on purpose. platform-admin lists the mounts an +# administrator operates *on*; this is the one mount an administrator keeps +# things *in*. Separating them means custody can move independently of +# administration — which is exactly what the S6 trust stage (two-of-three +# independent recovery control) requires, and it cannot be done later if the +# grant is buried inside platform-admin. +# +# Holds: service account passwords, provider PATs, LLDAP admin bind, +# privacyIDEA pi-admin, machine identities. See +# net-kingdom/docs/platform-root-custody.md, "Operator Credential Custody". +# +# Does NOT hold, and must never: platform-root's own password, unseal shares, +# the break-glass password. Those live in the offline packet — putting them +# here is a circular dependency, since you would need this store to reach the +# credential that opens it. + +path "operators/data/*" { + capabilities = ["create", "read", "update", "list"] +} + +path "operators/metadata/*" { + capabilities = ["read", "list"] +} + +# Delete is deliberately absent. A credential is retired by writing its +# successor — KV v2 keeps the prior version, which is the history that did not +# exist when the LLDAP predecessor was overwritten on 2026-08-27 and lost. +# Destroying a version is a separate, deliberate act under a broader identity.