tegwick
28386d3b4c
Bundle validates; ESO policy identical to applied CCR-2026-0041. Four fluid-telegram entries drafted from the approved plan; email-connect asked for its new path. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 327203@bnt-lap001 Assistant-Session: 55028ae3-4914-4bd1-8f5c-815f3527aef0
74 lines
3 KiB
YAML
74 lines
3 KiB
YAML
id: CCR-DRAFT-FORGEJO-NETKINGDOM-OIDC-FORGEJO
|
|
kind: credential-change-request
|
|
schema_version: 1
|
|
request_type: workload-kv-read
|
|
title: 'forgejo-netkingdom-oidc: consumer-reader-policy (oidc-browser-relying-party@1.1)'
|
|
status: in_flight
|
|
created: '2026-10-10'
|
|
updated: '2026-10-10'
|
|
requester:
|
|
agent: ops-mason
|
|
reason: 'MASON-WP-0010-T03 build of SecurityCase forgejo-netkingdom-oidc (oidc-browser-relying-party@1.1), render
|
|
sha256:af1f4f81ef313f5e086e6e3de17197d9112dd40f00b4c20b52b5ca73c7a6d18a. Accepted by owner, founder on 2026-10-08:
|
|
key-cape docs/forgejo-oidc-client-request.yaml (status accepted-2026-10-08, KEY-WP-0038-T01); type acknowledged
|
|
via informed-decision memo nk-wp-0048-t05-oidc-browser-relying-party-r4, hub decision e418263e. The case acceptance
|
|
replaces a fresh executive summary.'
|
|
review:
|
|
required: true
|
|
required_approvers:
|
|
- platform-owner
|
|
comments: []
|
|
target:
|
|
domain: infotech
|
|
tenant: platform
|
|
workload: keycape
|
|
environment: production
|
|
purpose: The consuming service reads the same secret. No metadata, list, parent or sibling access.
|
|
openbao:
|
|
mount: platform
|
|
kv_path: platform/workloads/keycape/forgejo
|
|
fields:
|
|
- CLIENT_SECRET
|
|
policy_name: workload-kv-read-keycape-forgejo-forgejo
|
|
policy_file: openbao/policies/workload-kv-read-keycape-forgejo-forgejo.hcl
|
|
metadata_read: false
|
|
token_self_lifecycle: true
|
|
access_frontdoor:
|
|
type: none
|
|
catalog_id: forgejo-keycape-client
|
|
readiness: pending-review
|
|
resolvable: false
|
|
risk:
|
|
classification: high
|
|
notes:
|
|
- Rendered from an acknowledged SecurityCaseType; shape reviewed with the type, names checked against live structure.
|
|
- Exact read on one KV path; no metadata, list, parent or sibling access.
|
|
verification:
|
|
positive:
|
|
- policy workload-kv-read-keycape-forgejo-forgejo grants read on platform/data/workloads/keycape/forgejo only
|
|
(capabilities check)
|
|
negative:
|
|
- a default-only identity has no read capability on the path
|
|
- sibling GET and parent LIST are denied
|
|
activation_conditions:
|
|
- case acceptance present
|
|
- bound claims confirmed by the platform owner
|
|
lifecycle:
|
|
deactivate: delete the role, then policy workload-kv-read-keycape-forgejo-forgejo (case rollback)
|
|
rotate: roll-forward through the credential broker (mint-secret); never a read of the old value
|
|
compromised: owner incident process; no automatic read, reseed or cleanup
|
|
security_case:
|
|
case: forgejo-netkingdom-oidc
|
|
type: oidc-browser-relying-party@1.1
|
|
render_digest: sha256:af1f4f81ef313f5e086e6e3de17197d9112dd40f00b4c20b52b5ca73c7a6d18a
|
|
acceptance_record: key-cape docs/forgejo-oidc-client-request.yaml (status accepted-2026-10-08, KEY-WP-0038-T01);
|
|
type acknowledged via informed-decision memo nk-wp-0048-t05-oidc-browser-relying-party-r4, hub decision e418263e
|
|
accepted_at: '2026-10-08'
|
|
accepted_by:
|
|
- owner
|
|
- founder
|
|
in_flight:
|
|
missing_fields:
|
|
- openbao.auth
|
|
owner: railiance-apps
|
|
blocking_reason: railiance-apps binds this reader to forgejo's own identity in its deployment path (hand-over).
|