From fdc0e578c0a7a2c4a032bfab8f04e5405dcae5bc Mon Sep 17 00:00:00 2001 From: tegwick Date: Thu, 8 Oct 2026 23:21:03 +0200 Subject: [PATCH] MASON-WP-0010-T01: review oidc-browser-relying-party materialization section Six refinements: fix the custody path in the type, reuse the workload-kv-read-keycape-* policy family, template policy bodies, add the ESO role, align catalog naming, collapse duplicate rollback steps. T02 now waits on NK-WP-0048-T05. Also commits pending sync output (WP-0009-T05 task id, WORK-RECORDS refresh). Co-Authored-By: Claude Opus 5.5 Assistant: claude-code Assistant-Model: opus Assistant-Process: 327203@bnt-lap001 Assistant-Session: 55028ae3-4914-4bd1-8f5c-815f3527aef0 --- WORK-RECORDS.md | 10 ++++- ...e-secrets-engine-openbao-client-custody.md | 1 + ...N-WP-0010-security-case-materialization.md | 41 +++++++++++++++++-- 3 files changed, 46 insertions(+), 6 deletions(-) diff --git a/WORK-RECORDS.md b/WORK-RECORDS.md index 903a718..0af0b26 100644 --- a/WORK-RECORDS.md +++ b/WORK-RECORDS.md @@ -18,6 +18,7 @@ | workplan | MASON-WP-0007 | blocked | — | workplans/MASON-WP-0007-tenant-engine-audit-core-sender-projection.md | | workplan | MASON-WP-0008 | finished | — | workplans/MASON-WP-0008-plan-survey.md | | workplan | MASON-WP-0009 | blocked | — | workplans/MASON-WP-0009-keycape-secrets-engine-openbao-client-custody.md | +| workplan | MASON-WP-0010 | ready | — | workplans/MASON-WP-0010-security-case-materialization.md | | task | MASON-0001-T01 | done | — | workplans/MASON-0001-statehub-bootstrap.md | | task | MASON-0001-T02 | done | — | workplans/MASON-0001-statehub-bootstrap.md | | task | MASON-0001-T03 | done | — | workplans/MASON-0001-statehub-bootstrap.md | @@ -63,8 +64,13 @@ | task | MASON-WP-0009-T01 | done | — | workplans/MASON-WP-0009-keycape-secrets-engine-openbao-client-custody.md | | task | MASON-WP-0009-T02 | wait | — | workplans/MASON-WP-0009-keycape-secrets-engine-openbao-client-custody.md | | task | MASON-WP-0009-T03 | wait | — | workplans/MASON-WP-0009-keycape-secrets-engine-openbao-client-custody.md | -| task | MASON-WP-0009-T04 | todo | — | workplans/MASON-WP-0009-keycape-secrets-engine-openbao-client-custody.md | +| task | MASON-WP-0009-T04 | done | — | workplans/MASON-WP-0009-keycape-secrets-engine-openbao-client-custody.md | +| task | MASON-WP-0009-T05 | wait | — | workplans/MASON-WP-0009-keycape-secrets-engine-openbao-client-custody.md | +| task | MASON-WP-0010-T01 | wait | — | workplans/MASON-WP-0010-security-case-materialization.md | +| task | MASON-WP-0010-T02 | wait | — | workplans/MASON-WP-0010-security-case-materialization.md | +| task | MASON-WP-0010-T03 | wait | — | workplans/MASON-WP-0010-security-case-materialization.md | +| task | MASON-WP-0010-T04 | wait | — | workplans/MASON-WP-0010-security-case-materialization.md | | intake | MASON-IN-0001 | closed | green | intakes/intakes.md | | intake | MASON-IN-0002 | closed | — | intakes/intakes.md | | intake | MASON-IN-0003 | open | — | intakes/intakes.md | -| intake | MASON-IN-0004 | open | — | intakes/intakes.md | +| intake | MASON-IN-0004 | closed | — | intakes/intakes.md | diff --git a/workplans/MASON-WP-0009-keycape-secrets-engine-openbao-client-custody.md b/workplans/MASON-WP-0009-keycape-secrets-engine-openbao-client-custody.md index 3394f2f..ce80e7d 100644 --- a/workplans/MASON-WP-0009-keycape-secrets-engine-openbao-client-custody.md +++ b/workplans/MASON-WP-0009-keycape-secrets-engine-openbao-client-custody.md @@ -117,6 +117,7 @@ status: wait blocked_on: message-from:railiance-platform blocking_reason: "Plan section 4 checks 1-3 and 6 need live lane tokens and the secrets-engine-openbao service-JWT mount and policy (RPF-WP-0035-T02), which are not applied yet; then recheck invariant (ii) and propose the pointer-only ops-warden route." priority: medium +state_hub_task_id: "1b1a0566-add7-59c1-94b0-6bb81d2d1537" ``` Once the service-JWT lane exists: re-run invariant (ii) against its policy, diff --git a/workplans/MASON-WP-0010-security-case-materialization.md b/workplans/MASON-WP-0010-security-case-materialization.md index 80c1659..63ddae6 100644 --- a/workplans/MASON-WP-0010-security-case-materialization.md +++ b/workplans/MASON-WP-0010-security-case-materialization.md @@ -42,9 +42,8 @@ of work this replaces. It becomes a reference instance for the first type. ```task id: MASON-WP-0010-T01 -status: wait +status: done depends_on: [NK-WP-0048-T03] -blocking_reason: "The materialization section follows the type schema and template." priority: high state_hub_task_id: "3382ea7b-65ca-59a9-97ae-273455af44c2" ``` @@ -58,11 +57,45 @@ case parameters, with naming rules. These must respect ops-mason's existing template sprawl. Write it for the first type, `oidc-browser-relying-party`, from MASON-WP-0009 and the existing key-cape client custody paths. +**Review (2026-10-08) of net-kingdom `security-case-types/oidc-browser-relying-party/type.yaml` 1.0.** +The structure (four items, all but the catalog entry conditional on +`confidential`) is right. The names add three new families where existing ones +cover the need, so they fail "respect, extend or compact before adding". +Requested refinements, each from the live CCR-2026-0033 placement +(`plans/keycape-secrets-engine-openbao-client-custody.md`): + +1. **Fix the path in the type.** `secret_ref` should not be case-settable; a + free pattern under `platform/workloads/` lets every case pick its own layout. + Derive it: `platform/workloads/keycape/{client_id}` (field `CLIENT_SECRET`), + as for `secrets-engine-openbao`. +2. **Reuse the policy family.** Existing readers are + `workload-kv-read-keycape--`. Rename + `keycape-client-{client_id}-read` to `workload-kv-read-keycape-{client_id}-eso` + (KeyCape reads its client secret only through ESO), and + `{consuming_service}-oidc-client-{client_id}-read` to + `workload-kv-read-keycape-{client_id}-{consuming_service}`. Update + verification `custody-allowed-to-consumer` and rollback to match. +3. **Template the policy body, not just its name.** An `openbao_policy` item + needs its rules (`read` on `platform/data/workloads/keycape/{client_id}`, + nothing else: no metadata, list, parent or sibling), or the review cannot + check invariant (ii) and a rendered plan is not buildable. +4. **Add the missing ESO role.** `deliver-secret` needs a Kubernetes-auth role + `external-secrets-keycape-{client_id}` (kind `openbao_role`, bound to the + ESO service account, policy from item 2, 15m TTL, no default policy), as + the reference placement has. +5. **Catalog naming.** The one existing entry is `rapp-qonto-keycape-client`; + prefer `{consuming_service}-keycape-client` over `oidc-client-{client_id}`. +6. **Rollback order.** `mint-secret` "destroy" and `client-secret-path` + "remove" act on the same KV path; collapse to one step (metadata delete + after the ExternalSecret is gone) so rollback cannot fail on a missing path. + +With 1-4 applied, the section is acceptable to ops-mason for NK-WP-0048-T05. + ```task id: MASON-WP-0010-T02 status: wait -depends_on: [MASON-WP-0010-T01] -blocking_reason: "Rendering needs the agreed materialization section." +depends_on: [MASON-WP-0010-T01, NK-WP-0048-T05] +blocking_reason: "Rendering waits for net-kingdom to fold in the T01 review and acknowledge the type (NK-WP-0048-T05)." priority: high state_hub_task_id: "fd385537-7378-5539-8a6e-f45851296f42" ```