MASON-WP-0005-T01: live survey for the fluid-telegram operator lane
Generated section 2 plus a full policy-body scan and the netkingdom OIDC role list: path unused, names free, only platform-admin covers the target, live reference role confirms the groups+aal2 binding shape. T01 now waits only on net-kingdom's group evidence. Grant revoked after use. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 327203@bnt-lap001 Assistant-Session: 55028ae3-4914-4bd1-8f5c-815f3527aef0
This commit is contained in:
parent
4a7f23f176
commit
a09dda651b
2 changed files with 94 additions and 43 deletions
|
|
@ -48,59 +48,103 @@ different, narrower need and is intentionally excluded from this plan.
|
|||
only `request_type: workload-kv-read`; its validator also requires the
|
||||
`workload-kv-read-` policy prefix and `-workload-kv-read` OIDC role suffix.
|
||||
|
||||
### Live survey pending
|
||||
### Live survey (2026-10-08)
|
||||
|
||||
No valid scoped OpenBao session was available during intake, so the required
|
||||
live outputs from `bao secrets list`, `bao auth list`, `bao policy list`, and
|
||||
the relevant `auth/netkingdom/role/*` reads are not yet attached. Phase 2 must
|
||||
repeat the survey with `./scripts/bao-session.sh grant MASON-WP-0005-T01`.
|
||||
Generated by `scripts/plan-survey.py` at 2026-10-08T21:53:55Z against `BAO_ADDR=http://127.0.0.1:18200`, token display_name `token-claude-MASON-WP-0005-T01` (policies: default, ops-mason-survey). Metadata only: no `kv get` and no `*/data/*` read was issued; policy bodies were read with `bao policy read` for name-matched candidates only.
|
||||
|
||||
**Existing-lane answer:** none is known from source state. This remains a
|
||||
draft finding until the live survey confirms it.
|
||||
Demand: KV path `platform/workloads/coulomb/fluid-telegram/hall-of-helix`, proposed policy `workload-kv-fluid-telegram-hall-of-helix-operator`, AppRole `-`, Kubernetes role `-`, consumer `fluid-telegram`. Match terms: `fluid-telegram`, `hall-of-helix`, `telegram`, `coulomb`.
|
||||
|
||||
## 3. Proposed changes
|
||||
#### `bao secrets list` (10 mounts, 1 relevant)
|
||||
|
||||
The recommended CLI prefix is
|
||||
`platform/workloads/coulomb/fluid-telegram/hall-of-helix`. `coulomb` is a
|
||||
recommendation from the existing owner precedent, not an authorization; T01
|
||||
must replace this paragraph with railiance-platform's explicit decision before
|
||||
review.
|
||||
```text
|
||||
platform/ kv version=2
|
||||
```
|
||||
|
||||
The recommended objects are:
|
||||
#### `bao auth list` (5 auth mounts, 2 relevant)
|
||||
|
||||
| # | Action | Object | Rationale |
|
||||
|---|---|---|---|
|
||||
| 1 | create | Policy `workload-kv-fluid-telegram-hall-of-helix-operator` | A new exact-path matrix is required; no read-only lane can satisfy the writes. |
|
||||
| 2 | create | OIDC role `fluid-telegram-hall-of-helix-workload-kv` at `auth/netkingdom` | The caller is an attended operator; AppRole and Kubernetes auth are the wrong identity shapes. |
|
||||
| 3 | modify | ops-mason executor with an approved OIDC KV matrix spec | The current executor cannot safely express OIDC or per-path capabilities. |
|
||||
| 4 | modify | railiance-platform CCR schema/validator with an approved read/write request type and naming rules | The platform owner explicitly rejects this shape today; bypassing that gate is forbidden. |
|
||||
| 5 | modify | railiance-platform agent high-risk boundary with exact data and metadata denies for all four paths | Agent-bound identities must not inherit this lane through another policy. |
|
||||
| 6 | propose | ops-warden entry `fluid-telegram-operator`, pointer-only, `status: draft`, `resolvable: false` | A concrete selector is useful before activation; no placeholder prefix becomes routable. |
|
||||
```text
|
||||
approle/ approle
|
||||
kubernetes/ kubernetes
|
||||
```
|
||||
|
||||
### Exact policy matrix
|
||||
#### `bao policy list` (81 policies, 0 relevant)
|
||||
|
||||
All entries are individual KV-v2 API paths. There is no `*` grant, parent
|
||||
`list`, metadata mutation, delete, destroy, undelete, or sudo capability.
|
||||
```text
|
||||
(no relevant entries)
|
||||
```
|
||||
|
||||
| CLI entry | KV-v2 data-path capabilities | Risk and reason |
|
||||
|---|---|---|
|
||||
| `.../operator-app` | `read` | High confidentiality: Telegram application id/hash; entered only through sanctioned attended value entry. |
|
||||
| `.../operator-session` | `create,read,update` | High: full-account MTProto credential. Provisioning only; never adapter-visible. |
|
||||
| `.../bot-token` | `create,read,update` | High: controls Bot API publication. Provisioner writes immediately after BotFather issues it. |
|
||||
| `.../redaction-salt` | `create,read` | High integrity and sensitive pseudonymisation material. Overwrite, patch, and deletion are denied. |
|
||||
#### `bao list auth/approle/role` (approle) (14 roles, 0 relevant)
|
||||
|
||||
OpenBao KV v2 documents that it honors the ACL distinction between `create`
|
||||
and `update`; it also documents CAS `0` as create-if-absent. The fluid-telegram
|
||||
client currently performs a read followed by a normal POST. The ACL therefore
|
||||
supplies the decisive server-side write-once boundary: the first POST is a
|
||||
create and a later POST is an update, which this policy denies. The client
|
||||
should still add CAS `0` to make its intent race-safe and explicit, but this
|
||||
plan does not depend on client-only behavior.
|
||||
```text
|
||||
(no relevant entries)
|
||||
```
|
||||
|
||||
This is operational write-once for the provisioner, not immutable storage.
|
||||
A platform administrator can recover from a corrupt first write through a
|
||||
separately approved attended action. That action must preserve the old version
|
||||
until recovery is verified and must never be exposed through this OIDC role.
|
||||
#### `bao list auth/kubernetes/role` (kubernetes) (27 roles, 0 relevant)
|
||||
|
||||
```text
|
||||
(no relevant entries)
|
||||
```
|
||||
|
||||
#### `bao policy read` of name-matched candidates (target `platform/data/workloads/coulomb/fluid-telegram/hall-of-helix`)
|
||||
|
||||
```text
|
||||
(no relevant entries)
|
||||
```
|
||||
|
||||
#### `bao kv metadata get` / `bao kv list` (metadata only)
|
||||
|
||||
```text
|
||||
platform/workloads/coulomb/fluid-telegram/hall-of-helix: no metadata (path unused)
|
||||
platform/workloads/coulomb/fluid-telegram/: request failed (output suppressed)
|
||||
```
|
||||
|
||||
#### ops-warden routing catalog `/home/worsch/ops-warden/registry/routing/catalog.yaml` (42 entries, 4 relevant)
|
||||
|
||||
```text
|
||||
whynot-design-npm-publish owner=railiance-platform status=active matches: coulomb
|
||||
path_template: platform/workloads/coulomb/whynot-design/npm-publish
|
||||
policy_ref: flex-auth check secret.read:whynot-design
|
||||
auth_method: bao login -method=oidc -path=netkingdom role=whynot-design-workload-kv-read
|
||||
reuse-surface-hub-write-token owner=railiance-platform status=active matches: coulomb
|
||||
path_template: platform/workloads/reuse/reuse-surface/runtime-secrets
|
||||
policy_ref: flex-auth check secret.read:reuse
|
||||
auth_method: caller's own OpenBao token (operator OIDC via key-cape, or a token carrying workload-kv-read-reuse-surface-runtime)
|
||||
inbound-library-imap-approle owner=ops-mason status=active matches: coulomb
|
||||
path_template: platform/workloads/inbound-library/imap
|
||||
auth_method: AppRole login role=inbound-library (role_id+secret_id in ~/.local/inbound-library/approle, config/library.json credential.approle_dir)
|
||||
coulomb-social-runtime-env owner=railiance-platform status=active matches: coulomb
|
||||
path_template: k8s:coulomb-social/coulomb-social-env
|
||||
auth_method: kubectl as platform operator (or bao OIDC when OpenBao lane is provisioned)
|
||||
```
|
||||
|
||||
#### Does an existing lane already satisfy this demand?
|
||||
|
||||
**Draft answer: no.** Review before committing; this is generated, not a decision.
|
||||
|
||||
- no surveyed policy grants `platform/data/workloads/coulomb/fluid-telegram/hall-of-helix`, the proposed names are free, the KV path is unused and no catalog entry routes it
|
||||
- policy grants were checked only for name-matched candidates; a policy with an unrelated name that covers `platform/data/workloads/coulomb/fluid-telegram/hall-of-helix` is not detected
|
||||
|
||||
|
||||
#### Additions by hand (same grant)
|
||||
|
||||
- `bao list auth/netkingdom/role` (12 roles): no `fluid-telegram*` role; the
|
||||
proposed `fluid-telegram-hall-of-helix-workload-kv` is free. The generator
|
||||
did not flag the `netkingdom` OIDC mount as relevant; it is the one this lane
|
||||
reuses.
|
||||
- All 81 policy bodies scanned (closing the generator's name-match gap): only
|
||||
`platform-admin` (`platform/*`) covers the target. No workload policy does.
|
||||
- Live reference role `keycape-secrets-engine-openbao-operator-workload-kv-read`
|
||||
has exactly the binding this plan renders: `bound_claims_type=string`,
|
||||
`bound_claims={groups:[net-kingdom-admins], /assurance/level: aal2}`,
|
||||
`groups_claim=groups`, `token_no_default_policy=true`. The executor's role
|
||||
document matches that shape.
|
||||
- Naming: live OIDC roles end `-workload-kv-read` and their policies start
|
||||
`workload-kv-read-`. This lane writes, so it drops `-read`
|
||||
(`workload-kv-fluid-telegram-hall-of-helix-operator`); that is why the CCR
|
||||
schema extension (T02) is needed.
|
||||
|
||||
**Existing-lane answer: none.** Confirmed live: path unused, names free, no
|
||||
covering workload policy, no catalog route.
|
||||
|
||||
### OIDC role shape
|
||||
|
||||
|
|
|
|||
|
|
@ -45,7 +45,7 @@ consumer workplan `FT-WP-0002` (`f2373858-c932-5a4d-81b6-db9a3595135a`).
|
|||
id: MASON-WP-0005-T01
|
||||
status: wait
|
||||
blocked_on: message-from:net-kingdom
|
||||
blocking_reason: "Founder go given 2026-10-08 (group fluid-telegram-operators, member tegwick); net-kingdom creates it and returns metadata-only evidence. Also needs a scoped OpenBao grant (bao-session.sh grant MASON-WP-0005-T01) for the live survey."
|
||||
blocking_reason: "Founder go given 2026-10-08 (group fluid-telegram-operators, member tegwick); net-kingdom creates it and returns metadata-only evidence. Live survey done 2026-10-08."
|
||||
priority: high
|
||||
state_hub_task_id: "18c9099f-882f-575c-93b9-cc68d7fbc2af"
|
||||
```
|
||||
|
|
@ -87,6 +87,13 @@ members, and a scoped grant for the live survey (no operator session today).
|
|||
net-kingdom (message `259ec26d`), which owns directory acts; ops-mason does not
|
||||
write LLDAP. Waiting for net-kingdom's metadata-only evidence.
|
||||
|
||||
2026-10-08: live survey run under grant `claude-MASON-WP-0005-T01`
|
||||
(`ops-mason-survey`), recorded in the plan's section 2: path unused, proposed
|
||||
policy and OIDC role names free, all 81 policy bodies scanned and only
|
||||
`platform-admin` covers the path, no catalog route. The live
|
||||
`keycape-secrets-engine-openbao-operator` role confirms the binding shape. Only
|
||||
the group evidence remains for T01; the plan can then move to `reviewed`.
|
||||
|
||||
## Extend the construction and credential-change contracts
|
||||
|
||||
```task
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue