coulomb/ops-mason
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Prepare reviewed Forgejo consumer ESO scope and truthful recovery records

Browse source 
Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a126e1-76f8-7643-8cf3-e93336539ade
This commit is contained in:
tegwick 2026-10-11 04:09:26 +02:00
parent f52c94cd4e
commit a41312e5a4
8 changed files with 278 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

23
src/ops_mason/case_build.py
View file

@ -34,7 +34,7 @@ RAILIANCE_PLATFORM = Path.home() / "railiance-platform"
class CaseBuildRefused(RuntimeError):
"""The case cannot be built yet; nothing was written."""
"""The case admission or prepared source inventory is invalid."""
def _plan_front(path: Path) -> dict:
@ -83,7 +83,20 @@ def _ccr(case: dict, rendered: dict, policy: dict, role: dict | None, kv_path: s
"service_account_namespaces": list(role_body.get("bound_service_account_namespaces") or [])},
"bound_claims_confirmed": False,
}
reader = "eso" if role else params["consuming_service"]
consumer = policy["id"] == "consumer-reader-policy"
reader = "eso" if role and not consumer else params["consuming_service"]
workload = params["consuming_service"] if consumer else "keycape"
deactivate = f"delete the role, then policy {policy['template']} (case rollback)"
if consumer and role:
deactivate = (
"Revert the consumer reference first; remove only independently proved "
"case-created delivery objects, role and policy, preserving preexisting-matched "
"and shared objects. Revoke issued reader tokens through owner custody or "
"prove independently verified expiry before declaring deactivation; role/SA/store "
"deletion alone does not revoke tokens. Recovery uses existing owner admission: "
"no new login and no remint. Preserve authenticated creation/ownership/recovery "
"receipts and stop on changed references, UIDs or ownership."
)
doc = {
"id": f"CCR-DRAFT-{prov['case']}-{reader}".upper(),
"kind": "credential-change-request",
@ -98,7 +111,7 @@ def _ccr(case: dict, rendered: dict, policy: dict, role: dict | None, kv_path: s
f"{prov['render_digest']}. Accepted by {', '.join(prov['accepted_by'])} on {prov['accepted_at']}: "
f"{prov['acceptance_record']}. The case acceptance replaces a fresh executive summary.")},
"review": {"required": True, "required_approvers": ["platform-owner"], "comments": []},
"target": {"domain": "infotech", "tenant": "platform", "workload": "keycape", "environment": "production",
"target": {"domain": "infotech", "tenant": "platform", "workload": workload, "environment": "production",
"purpose": policy.get("description") or policy["id"]},
"openbao": openbao,
"access_frontdoor": {"type": "external-secrets" if role else "none",
@ -111,7 +124,7 @@ def _ccr(case: dict, rendered: dict, policy: dict, role: dict | None, kv_path: s
"positive": [f"policy {policy['template']} grants read on {kv_path.replace('/', '/data/', 1)} only (capabilities check)"],
"negative": ["a default-only identity has no read capability on the path", "sibling GET and parent LIST are denied"],
"activation_conditions": ["case acceptance present", "bound claims confirmed by the platform owner"]},
"lifecycle": {"deactivate": f"delete the role, then policy {policy['template']} (case rollback)",
"lifecycle": {"deactivate": deactivate,
"rotate": "roll-forward through the credential broker (mint-secret); never a read of the old value",
"compromised": "owner incident process; no automatic read, reseed or cleanup"},
"security_case": prov,
@ -193,6 +206,8 @@ def build_from_case(case_path: Path, plan_path: Path, out_dir: Path, *, nk_root:
files: dict[str, str] = {}
def write(rel: str, text: str) -> Path:
if rel in files:
raise CaseBuildRefused("duplicate output identity in case bundle")
path = out_dir / rel
path.parent.mkdir(parents=True, exist_ok=True)
path.write_text(text)