tegwick
b67b57a022
Assistant: codex Assistant-Model: gpt-6.1-sol Assistant-Session: 01a137ca-5c77-7a71-b9ae-23ad9b0b5684
278 lines
20 KiB
JSON
278 lines
20 KiB
JSON
{
|
|
"id": "MASON-CUST81-PRIVATE-READER-R1",
|
|
"revision": 2,
|
|
"status": "draft-not-executable",
|
|
"engine": "platform-owned-forgejo-restricted-reader-and-existing-eso-delta",
|
|
"execution_support": "requires platform reviewed adapter; not an ops_mason.executor supported build_spec",
|
|
"preparation_sha256": "7819eb51d249f5c7aff4df9fb520afcfb76603b05a4104439499102b6c20af99",
|
|
"metadata_consent_sha256": "4a4602ad926e3af855d6ddba4731430d33e4a7432c507ba0a5193b9f43056b52",
|
|
"disclosure_packet_sha256": "46ac4fe49a08054cc215aade2fbaf3b36ee334520997857ed84f530b52da9d35",
|
|
"identity": {
|
|
"forgejo_user": "reuse-surface-source",
|
|
"forgejo_org": "coulomb",
|
|
"forgejo_team": "reuse-surface-source-readers",
|
|
"restricted": true,
|
|
"is_admin": false,
|
|
"visibility": "private",
|
|
"password": "random value retained only in attended process memory; never stored in evidence",
|
|
"team_permission": "read",
|
|
"includes_all_repositories": false,
|
|
"can_create_org_repo": false,
|
|
"units_map": {
|
|
"repo.code": "read",
|
|
"repo.actions": "none",
|
|
"repo.packages": "none",
|
|
"repo.issues": "none",
|
|
"repo.ext_issues": "none",
|
|
"repo.wiki": "none",
|
|
"repo.pulls": "none",
|
|
"repo.releases": "none",
|
|
"repo.projects": "none",
|
|
"repo.ext_wiki": "none"
|
|
},
|
|
"team_repositories": [
|
|
"coulomb/rapp-openbao",
|
|
"coulomb/rapp-policy-nexus",
|
|
"coulomb/rapp-postgres",
|
|
"coulomb/rapp-sbom-nexus",
|
|
"coulomb/rapp-telemetry",
|
|
"coulomb/rapp-tenant-engine",
|
|
"coulomb/rapp-user-engine"
|
|
],
|
|
"token_scopes": [
|
|
"read:repository"
|
|
],
|
|
"token_name_prefix": "reuse-surface-source-read-",
|
|
"reuse_other_workload_token": false,
|
|
"fail_on_differing_existing_identity_or_team": true,
|
|
"enforcement": "Verify complete team membership and all effective user repository grants; no other team, collaborator or organisation grants may provide extra private read access."
|
|
},
|
|
"delivery": {
|
|
"kv_mount": "platform",
|
|
"kv_path": "platform/workloads/reuse/reuse-surface/forgejo-source-read",
|
|
"field": "FORGEJO_SOURCE_TOKEN",
|
|
"auth_env": "REUSE_SURFACE_FORGEJO_SOURCE_READ_TOKEN",
|
|
"eso_role": "reuse-surface-runtime-eso",
|
|
"eso_identity": "reuse/reuse-surface-eso",
|
|
"audience": "openbao",
|
|
"ttl": "15m",
|
|
"cluster_secret_store": "openbao-reuse",
|
|
"store_namespace_condition": [
|
|
"reuse"
|
|
],
|
|
"external_secret": "reuse/reuse-surface-runtime",
|
|
"target_secret": "reuse/reuse-surface-env",
|
|
"existing_consumption": "Existing envFrom interface is reusable only after approved full fixed image plus runtime-owned exact14 URL/auth-env allowlist is active. Existing authenticated sources need separately reviewed safe inventory and migration before fail-closed rollout.",
|
|
"policy_delta": {
|
|
"file": "railiance-platform/openbao/policies/workload-kv-read-reuse-surface-runtime-eso.hcl",
|
|
"add_exact_stanza": "path \"platform/data/workloads/reuse/reuse-surface/forgejo-source-read\" { capabilities = [\"read\"] }",
|
|
"retain_existing_paths": true,
|
|
"do_not_change": "Caller-facing workload-kv-read-reuse-surface-runtime policy or writer OIDC role; those remain unable to read this new path."
|
|
},
|
|
"external_secret_data_delta": {
|
|
"secretKey": "REUSE_SURFACE_FORGEJO_SOURCE_READ_TOKEN",
|
|
"remoteRef": {
|
|
"key": "workloads/reuse/reuse-surface/forgejo-source-read",
|
|
"property": "FORGEJO_SOURCE_TOKEN"
|
|
}
|
|
},
|
|
"delivery_design_reason": "Uses the existing namespace-limited ESO store and identity plus the existing envFrom interface. Separate new KV path keeps scoped writer callers from also acquiring private-source access. No new static ESO token or new store is needed.",
|
|
"native_source_auth": {
|
|
"auth_env": "REUSE_SURFACE_FORGEJO_SOURCE_READ_TOKEN",
|
|
"auth_header": "Authorization",
|
|
"header_behavior": "Native federation _auth_headers prefixes a bare token with Bearer; owner must verify accepted Forgejo raw API route with this actual native implementation."
|
|
},
|
|
"fixed_image_gate": {
|
|
"status": "pending owner patch and reviewed image",
|
|
"reason": "Current native fetch permits registration-selected auth_env plus arbitrary URL and forwards Authorization on redirect. Both must be fixed before credential delivery.",
|
|
"required": [
|
|
"reuse owner full redirect and auth_env/URL patch and meaningful boundary tests",
|
|
"exact full source/patch digest",
|
|
"approved image digest built from fixed source",
|
|
"runtime controlled exact14 auth allowlist config digest",
|
|
"safe owner inventory and reviewed migration of existing authenticated sources",
|
|
"runtime proof denied URLs are checked before credential lookup and authenticated redirects never forward credential",
|
|
"apps reviewed rollout and rollback with image/config changes explicit"
|
|
],
|
|
"current_image_accepts_new_pat": false,
|
|
"reviewed_candidate_inputs": {
|
|
"consumer_owner_allowlist_artifact": "/tmp/cust81-reuse-reader-owner/docs/assessments/cust81-private-reader/runtime-auth-source-allowlist-r1.json",
|
|
"consumer_owner_allowlist_sha256": "e1948c537e206b30fc72b9e4732a3f600d92e131813e6f7ecfd4bfbb18c27286",
|
|
"consumer_patch_artifact": "/tmp/cust81-reuse-reader-owner/docs/assessments/cust81-private-reader/reuse-owner-preparation-r1.patch",
|
|
"consumer_patch_sha256": "f707ddfd36d5d470c176530671bb30ff6a3af2dfff86937aa8a5618bcb79768e",
|
|
"fixed_federation_source_sha256": "dbaa40f25cc0f090143578cd1c7068cb2cb00960fafd17d5239bf8a5bac514dd",
|
|
"allowlist_semantic_crosscheck": "pass exact same env and exact14 URL sets; serialization ordering differs",
|
|
"image_digest": null,
|
|
"owner_review_status": "baseline changes_requested; full candidate must integrate and obtain runtime proof",
|
|
"test_report": "owner reports focused30pass; whole226pass1isolatedrelativepath failure; no live runtime proof",
|
|
"native_verification_helper_sha256": "c67a284091cc4dd62dca56658a14b8ea1357e2b3df1518120da4c51e0ee8d85c",
|
|
"native_verification_helper_artifact": "/tmp/cust81-reuse-reader-owner/reuse_surface/private_source_verify.py"
|
|
}
|
|
},
|
|
"runtime_auth_source_allowlist": {
|
|
"env": "REUSE_SURFACE_AUTH_SOURCE_ALLOWLIST",
|
|
"candidate_value": "{\"REUSE_SURFACE_FORGEJO_SOURCE_READ_TOKEN\":[\"https://forgejo.coulomb.social/api/v1/repos/coulomb/rapp-openbao/raw/registry/indexes/capabilities.yaml?ref=35672be138036c8433a5ac5de91e068c03c2b124\",\"https://forgejo.coulomb.social/api/v1/repos/coulomb/rapp-openbao/raw/registry/capabilities/capability.railiance.openbao-package.md?ref=35672be138036c8433a5ac5de91e068c03c2b124\",\"https://forgejo.coulomb.social/api/v1/repos/coulomb/rapp-policy-nexus/raw/registry/indexes/capabilities.yaml?ref=088b78ac03b0cebeec34a69aae3569eb7ec2f9c3\",\"https://forgejo.coulomb.social/api/v1/repos/coulomb/rapp-policy-nexus/raw/registry/capabilities/capability.railiance.policy-publication-package.md?ref=088b78ac03b0cebeec34a69aae3569eb7ec2f9c3\",\"https://forgejo.coulomb.social/api/v1/repos/coulomb/rapp-postgres/raw/registry/indexes/capabilities.yaml?ref=a9f569c96d74aa384ac8d3ac4aa960e4061550b5\",\"https://forgejo.coulomb.social/api/v1/repos/coulomb/rapp-postgres/raw/registry/capabilities/capability.railiance.postgres-isolation-recovery.md?ref=a9f569c96d74aa384ac8d3ac4aa960e4061550b5\",\"https://forgejo.coulomb.social/api/v1/repos/coulomb/rapp-sbom-nexus/raw/registry/indexes/capabilities.yaml?ref=adbedd349e8df97be43a1f57db7095af45ff29d1\",\"https://forgejo.coulomb.social/api/v1/repos/coulomb/rapp-sbom-nexus/raw/registry/capabilities/capability.railiance.sbom-runtime-package.md?ref=adbedd349e8df97be43a1f57db7095af45ff29d1\",\"https://forgejo.coulomb.social/api/v1/repos/coulomb/rapp-telemetry/raw/registry/indexes/capabilities.yaml?ref=f158307e24b86bab88a1af4830ff6b4f85afdeb5\",\"https://forgejo.coulomb.social/api/v1/repos/coulomb/rapp-telemetry/raw/registry/capabilities/capability.railiance.telemetry-package.md?ref=f158307e24b86bab88a1af4830ff6b4f85afdeb5\",\"https://forgejo.coulomb.social/api/v1/repos/coulomb/rapp-tenant-engine/raw/registry/indexes/capabilities.yaml?ref=9bdc86572728783a5ed94266f04f7b12d414c557\",\"https://forgejo.coulomb.social/api/v1/repos/coulomb/rapp-tenant-engine/raw/registry/capabilities/capability.railiance.tenant-engine-package.md?ref=9bdc86572728783a5ed94266f04f7b12d414c557\",\"https://forgejo.coulomb.social/api/v1/repos/coulomb/rapp-user-engine/raw/registry/indexes/capabilities.yaml?ref=f35108f9e1b8702fb6c526fe42b2fec5ca032738\",\"https://forgejo.coulomb.social/api/v1/repos/coulomb/rapp-user-engine/raw/registry/capabilities/capability.railiance.user-engine-package.md?ref=f35108f9e1b8702fb6c526fe42b2fec5ca032738\"]}",
|
|
"candidate_artifact": "builds/reuse-surface-private-source-reader/auth-source-allowlist.json",
|
|
"artifact_sha256": "9a5d5a1ffb6ff1fa9e0cba7fb77779fd832c5bff413718d63c6f6e314ac653fc",
|
|
"semantic_value_sha256": "30c823e0ccd4cd5bcccacfa731bcf0674b63ba6d5ec79f2c012ec650201f81f5",
|
|
"policy": "Only runtime owner may configure; untrusted registration cannot grant itself authorization. Exact equality checked before any credential env lookup. Exact14 pinned index and entry API URLs only.",
|
|
"existing_authenticated_sources": "Owner must safely inventory all authenticated sources using sanitized auth_env/URL metadata and migrate valid existing mappings before fail-closed rollout; do not expose secrets or blindly authorize inventory."
|
|
}
|
|
},
|
|
"sources": [
|
|
{
|
|
"repo": "rapp-openbao",
|
|
"capability_ids": [
|
|
"capability.railiance.openbao-package"
|
|
],
|
|
"consented_commit": "35672be138036c8433a5ac5de91e068c03c2b124",
|
|
"native_raw_url": "https://forgejo.coulomb.social/api/v1/repos/coulomb/rapp-openbao/raw/registry/indexes/capabilities.yaml?ref=35672be138036c8433a5ac5de91e068c03c2b124",
|
|
"index_sha256": "044efa3d02b90e1872f2516c581159d388a8080a689f76fcd78bb4d048d6ee64",
|
|
"auth_env": "REUSE_SURFACE_FORGEJO_SOURCE_READ_TOKEN"
|
|
},
|
|
{
|
|
"repo": "rapp-policy-nexus",
|
|
"capability_ids": [
|
|
"capability.railiance.policy-publication-package"
|
|
],
|
|
"consented_commit": "088b78ac03b0cebeec34a69aae3569eb7ec2f9c3",
|
|
"native_raw_url": "https://forgejo.coulomb.social/api/v1/repos/coulomb/rapp-policy-nexus/raw/registry/indexes/capabilities.yaml?ref=088b78ac03b0cebeec34a69aae3569eb7ec2f9c3",
|
|
"index_sha256": "e68bdedf61eee9ca2026f46a2434ce384c26234616e74f7a5d08a06c75b3bb00",
|
|
"auth_env": "REUSE_SURFACE_FORGEJO_SOURCE_READ_TOKEN"
|
|
},
|
|
{
|
|
"repo": "rapp-postgres",
|
|
"capability_ids": [
|
|
"capability.railiance.postgres-isolation-recovery"
|
|
],
|
|
"consented_commit": "a9f569c96d74aa384ac8d3ac4aa960e4061550b5",
|
|
"native_raw_url": "https://forgejo.coulomb.social/api/v1/repos/coulomb/rapp-postgres/raw/registry/indexes/capabilities.yaml?ref=a9f569c96d74aa384ac8d3ac4aa960e4061550b5",
|
|
"index_sha256": "d939333eed9d85172e006f526c445fbe2602a721d53f7c0d14bc68286ae08776",
|
|
"auth_env": "REUSE_SURFACE_FORGEJO_SOURCE_READ_TOKEN"
|
|
},
|
|
{
|
|
"repo": "rapp-sbom-nexus",
|
|
"capability_ids": [
|
|
"capability.railiance.sbom-runtime-package"
|
|
],
|
|
"consented_commit": "adbedd349e8df97be43a1f57db7095af45ff29d1",
|
|
"native_raw_url": "https://forgejo.coulomb.social/api/v1/repos/coulomb/rapp-sbom-nexus/raw/registry/indexes/capabilities.yaml?ref=adbedd349e8df97be43a1f57db7095af45ff29d1",
|
|
"index_sha256": "d2ee0f193d2198bf8f16ce64c90ae7664e59a2bc307ad711426af3fd47deb057",
|
|
"auth_env": "REUSE_SURFACE_FORGEJO_SOURCE_READ_TOKEN"
|
|
},
|
|
{
|
|
"repo": "rapp-telemetry",
|
|
"capability_ids": [
|
|
"capability.railiance.telemetry-package"
|
|
],
|
|
"consented_commit": "f158307e24b86bab88a1af4830ff6b4f85afdeb5",
|
|
"native_raw_url": "https://forgejo.coulomb.social/api/v1/repos/coulomb/rapp-telemetry/raw/registry/indexes/capabilities.yaml?ref=f158307e24b86bab88a1af4830ff6b4f85afdeb5",
|
|
"index_sha256": "ee8801f143ed5cf064205710a61c2bb24efc6ea8585d5786d6b679426ec4c1d4",
|
|
"auth_env": "REUSE_SURFACE_FORGEJO_SOURCE_READ_TOKEN"
|
|
},
|
|
{
|
|
"repo": "rapp-tenant-engine",
|
|
"capability_ids": [
|
|
"capability.railiance.tenant-engine-package"
|
|
],
|
|
"consented_commit": "9bdc86572728783a5ed94266f04f7b12d414c557",
|
|
"native_raw_url": "https://forgejo.coulomb.social/api/v1/repos/coulomb/rapp-tenant-engine/raw/registry/indexes/capabilities.yaml?ref=9bdc86572728783a5ed94266f04f7b12d414c557",
|
|
"index_sha256": "d8e9c1282350b5d2fd4f4d69712aa7a5fbcd2367bb1a7fad1b6eb16a97e5d732",
|
|
"auth_env": "REUSE_SURFACE_FORGEJO_SOURCE_READ_TOKEN"
|
|
},
|
|
{
|
|
"repo": "rapp-user-engine",
|
|
"capability_ids": [
|
|
"capability.railiance.user-engine-package"
|
|
],
|
|
"consented_commit": "f35108f9e1b8702fb6c526fe42b2fec5ca032738",
|
|
"native_raw_url": "https://forgejo.coulomb.social/api/v1/repos/coulomb/rapp-user-engine/raw/registry/indexes/capabilities.yaml?ref=f35108f9e1b8702fb6c526fe42b2fec5ca032738",
|
|
"index_sha256": "95b4ed2d0b189f6847b1c0899f740d1da46933a8f40491e1a02f2d4e57c819fc",
|
|
"auth_env": "REUSE_SURFACE_FORGEJO_SOURCE_READ_TOKEN"
|
|
}
|
|
],
|
|
"policy_before_sha256": "fab29572fe82fc6674837e430f616409070f97a3867a411b7e21b5141dfaba20",
|
|
"policy_candidate_sha256": "788bb9c49ab571e522beeecf7a5e29d1c79c842a84fe6d801978655facd3b5bd",
|
|
"caller_writer_policy_sha256": "53dd5eecc94fd8d7fc281a858f5d9fc27c8c895fd79161fd113cd3a1387a1257",
|
|
"lifecycle": {
|
|
"owner": "railiance-platform",
|
|
"target_owner": "railiance-forge",
|
|
"consumer": "reuse-surface hosted process only",
|
|
"rotation_days": 90,
|
|
"expiry": "No PAT native expiry demonstrated; 90-day attended rotation is proposed owner policy, not implemented expiry enforcement.",
|
|
"automatic_rotation": false,
|
|
"revoke_on": [
|
|
"compromise",
|
|
"scope drift",
|
|
"owner or consumer change",
|
|
"90-day rotation after replacement verifies"
|
|
],
|
|
"replacement_overlap_max_hours": 24,
|
|
"outage": "Private refresh fails closed; prior consented cache visibly stale, public sources continue. Never substitute admin/personal/core-hub PAT."
|
|
},
|
|
"approval": {
|
|
"supervisor": "Bernd Worsch, GOVERN @ estate",
|
|
"approved_by": null,
|
|
"approved_at": null,
|
|
"approved_digest": null,
|
|
"metadata_disclosure_is_not_credential_approval": true
|
|
},
|
|
"pre_execution_gates": [
|
|
"own scoped metadata survey or platform sanitized equivalent",
|
|
"Forgejo owner Q1-Q3 mechanism confirmation",
|
|
"platform CCR allocation and reviewed silent provisioner",
|
|
"effective exact-seven authorization proof design",
|
|
"own owner reviews including reuse native fetch and apps rollout",
|
|
"founder exact revision approval",
|
|
"headroom/PVC/rollout preflight",
|
|
"reuse owner redirect patch reviewed and fixed image approved",
|
|
"verify fixed image before projecting reader PAT into hub process",
|
|
"full consumer source-authorization patch reviewed, not redirect-only",
|
|
"runtime owner exact14 allowlist and existing auth-source migration reviewed"
|
|
],
|
|
"verification": {
|
|
"pre_apply": [
|
|
"Pin exact CCR and plan revision/digest, owner reviews, founder disposition and rollout artifacts. Resolve existing identity/team/path conflicts before any mutation.",
|
|
"Confirm live namespace/Deployment and its image digest, current ESO identity/binding and secret field presence through safe suppressing helper; no Secret dump.",
|
|
"Check CPU headroom and rollout strategy/PVC constraints; retain exact prior source manifest/image and server dry-run/client diff.",
|
|
"Current native fetch redirect forwarding hazard must be fixed in the reviewed image before PAT delivery to the hub. An unchanged vulnerable image is not acceptable.",
|
|
"Full consumer patch must reject registration-controlled auth_env/URL destinations before credential lookup; configure owner-reviewed allowlist and migrate existing authenticated sources before rollout."
|
|
],
|
|
"positive": [
|
|
"PAT metadata scope exactly read:repository; exact seven team repos with no other private grants.",
|
|
"Actual native fetch_remote_index_text from hub process with the approved auth_env fetches all seven pinned raw index URLs; validate schema, one expected capability each and exact index SHA256. No token or fetched private source output.",
|
|
"ESO Ready and materialized key present checked without values; Deployment Ready on reviewed fixed-image digest after controlled rollout; redirect credential isolation verified.",
|
|
"Register private sources only after credential and native fetch receipts; fresh hosted federation then proves all70 reviewed IDs exactly once and matching metadata."
|
|
],
|
|
"negative": [
|
|
"Reader cannot fetch a known private repository outside the seven (preselected by platform using metadata, no unauthorized body retention).",
|
|
"Forgejo writes, admin/user operations and non-code unit access denied; probe design must avoid creating writes if an unexpected permission exists.",
|
|
"Default identity and scoped writer OIDC caller cannot read new KV path; ESO role cannot read any other sibling path, and wrong SA/namespace/audience cannot authenticate.",
|
|
"Native missing-auth and anonymous private-index fetch fail closed; no fallback to admin/personal/core-hub credentials.",
|
|
"Registration-selected auth_env or unlisted same-host/other-host/unpinned/wrong-query URL is refused before credential lookup; token value is never read or transmitted.",
|
|
"Authenticated redirects fail closed without forwarding Authorization, including same-origin path changes. Runtime allowlist contains exact14 consented pinned URL strings only for new readerenv."
|
|
],
|
|
"receipts": "Sanitized IDs, repo names, scopes, hashes, status booleans and timestamps only; no credentials, raw errors, private index bodies or Secret objects."
|
|
},
|
|
"rollback": {
|
|
"immediate": "Revoke this dedicated PAT and remove exact new team/user grants. Disable only private registrations created by the associated attempt after reconciling ambiguous requests; preserve all public registrations.",
|
|
"delivery": "Remove only new ES data item and exact new ESO policy stanza, restore prior source revision through owner path, delete only new materialized token key if needed using suppressed owner helper, then roll the reviewed fixed image or restore a prior image only after credential removal is verified. Do not delete reuse-surface-env or rotate existing writer/webhook fields. Remove only the new reader environment mapping from runtime source allowlist while preserving separately reviewed existing mappings; coordinate image/config rollback so stale deployments never receive the PAT.",
|
|
"preserve_evidence": "Retain failed/partial outcomes, reconcile any ambiguous identity or token creation; never blindly remint after an observation timeout."
|
|
},
|
|
"cost_estimate_eur": 0,
|
|
"cost_assumptions": "Incremental cloud infrastructure only; existing service/resources. Build and rollout of reviewed fixed image is required. Human labor/compute changes not priced; re-estimate if owner rollout changes resources.",
|
|
"credible_loss_estimate_eur": null,
|
|
"risk_unpriced_reason": "Repository-wide private source exposure and availability impact cannot be bounded from local evidence; supervised execution required.",
|
|
"revision_history": [
|
|
{
|
|
"revision": 1,
|
|
"spec_sha256": "0d1f604c76e086c82675dc535004cf4da51ef5dc247959fab50295a673407980",
|
|
"status": "draft-unapproved-never-executed",
|
|
"ref": "custodian owner-assembly/mason-r1/"
|
|
},
|
|
{
|
|
"revision": 2,
|
|
"reason": "Same proposal refined after consumer owner found URL/auth_env credential exfiltration in addition to redirect forwarding."
|
|
}
|
|
]
|
|
}
|