From 308409bff1fecb588e4667f7e3db335fde9cbbe6 Mon Sep 17 00:00:00 2001 From: tegwick Date: Tue, 15 Sep 2026 20:38:47 +0200 Subject: [PATCH] Add informed-decision-sitting-requester reader login lane. Exact CCR-2026-0027 OIDC role. No secret fetch. Platform owns the reviewed exchange-proof child. Assistant: grok Assistant-Session: 01a0a23b-3bf0-7341-b4e5-9dc05f72573a --- registry/generated/high-risk-data-paths.yaml | 9 +++---- registry/routing/catalog.yaml | 24 +++++++++++++++++++ ...formed-decision-sitting-requester-login.md | 17 +++++++++++++ 3 files changed, 46 insertions(+), 4 deletions(-) create mode 100644 wiki/playbooks/informed-decision-sitting-requester-login.md diff --git a/registry/generated/high-risk-data-paths.yaml b/registry/generated/high-risk-data-paths.yaml index 09868a0..05025b4 100644 --- a/registry/generated/high-risk-data-paths.yaml +++ b/registry/generated/high-risk-data-paths.yaml @@ -10,12 +10,12 @@ # declares it, and is null where the field set has not been established -- # null means unknown, never 'one field'. -generated_at: "2026-09-14T07:58:30Z" +generated_at: "2026-09-15T18:38:11Z" source: ops-warden/registry/routing/catalog.yaml -catalog_revision: "4ebd241d88e0f65125b3097a6d3aeccd4c294eb6" -catalog_revision_date: "2026-09-14T04:57:55+02:00" +catalog_revision: "8a40dcb11b729115773630e449fd880c0700372e" +catalog_revision_date: "2026-09-14T09:59:11+02:00" catalog_dirty: true -high_risk_lane_count: 28 +high_risk_lane_count: 29 concrete_path_count: 15 # Graded high but not a single KV address -- a routing pattern, a broker @@ -23,6 +23,7 @@ concrete_path_count: 15 no_concrete_path: - database-dynamic-credentials - flex-auth-decision-envelope-signing-key + - informed-decision-sitting-requester-login - inter-hub-bootstrap-ssh - net-kingdom-lldap-bind-credential - net-kingdom-privacyidea-admin-token diff --git a/registry/routing/catalog.yaml b/registry/routing/catalog.yaml index 0624f17..6ab51b9 100644 --- a/registry/routing/catalog.yaml +++ b/registry/routing/catalog.yaml @@ -238,6 +238,30 @@ entries: exec_capable: true lane: login + - id: informed-decision-sitting-requester-login + title: Attended Informed Decision sitting-requester reader login + risk: high + workload_ref: + applicability: not-applicable + reason: "Attended operator identity for the exact CCR-2026-0027 reader." + need_keywords: [informed-decision, sitting-requester, reader, login, ccr-2026-0027] + owner_repo: railiance-platform + subsystem: OpenBao scoped operator OIDC via KeyCape + warden_executes: false + wiki_ref: wiki/playbooks/informed-decision-sitting-requester-login.md + canon_ref: railiance-platform/credential-change-requests/CCR-2026-0027-informed-decision-sitting-requester-reader.yaml + reviewed: "2026-09-15" + status: active + delegation: + mode: native + intended_owner: railiance-platform + reviewed: "2026-09-15" + verified: source-read + auth_method: "attended KeyCape OIDC, netkingdom role informed-decision-sitting-requester-workload-kv-read" + fetch_command: "bao login -no-print -method=oidc -path=netkingdom role=informed-decision-sitting-requester-workload-kv-read" + exec_capable: true + lane: login + - id: openbao-shamir-recovery-ceremony title: Attended OpenBao Shamir seal and unseal recovery ceremony # A ceremony pointer, not a credential-value lane. Approval coordinates diff --git a/wiki/playbooks/informed-decision-sitting-requester-login.md b/wiki/playbooks/informed-decision-sitting-requester-login.md new file mode 100644 index 0000000..784e690 --- /dev/null +++ b/wiki/playbooks/informed-decision-sitting-requester-login.md @@ -0,0 +1,17 @@ +# Sitting-requester reader session + +CCR-2026-0027 admits only +`platform/workloads/informed-decision/sitting-requester`. The contained Warden +login uses `informed-decision-sitting-requester-workload-kv-read`. Its owner +command checks exact reader policies, sibling denial of +`secrets-engine/approval-requester`, and a create-only KeyCape token exchange. +It does not POST sittings and never prints the client secret. + +Use the current source catalog explicitly: + +`WARDEN_ROUTING_CATALOG=/home/worsch/ops-warden/registry/routing/catalog.yaml` + +The reviewed child is +`/home/worsch/railiance-platform/scripts/prove-sitting-requester-exchange.sh`. +OpenBao is reached through `http://127.0.0.1:18200`. Warden self-revokes after +the child exits.