From 8a40dcb11b729115773630e449fd880c0700372e Mon Sep 17 00:00:00 2001 From: tegwick Date: Mon, 14 Sep 2026 09:59:11 +0200 Subject: [PATCH] Draft the flex-auth envelope-signing credential route. Pointer-only, warden_executes false. Shape lives in flex-auth; OpenBao path is not built yet. Testdata keys are not this lane. Assistant: grok Assistant-Session: 01a09dc1-b21e-77e1-919e-fcad2f82b267 --- registry/generated/high-risk-data-paths.yaml | 9 ++--- registry/routing/catalog.yaml | 23 ++++++++++++ ...flex-auth-decision-envelope-signing-key.md | 35 +++++++++++++++++++ 3 files changed, 63 insertions(+), 4 deletions(-) create mode 100644 wiki/playbooks/flex-auth-decision-envelope-signing-key.md diff --git a/registry/generated/high-risk-data-paths.yaml b/registry/generated/high-risk-data-paths.yaml index 25561e6..09868a0 100644 --- a/registry/generated/high-risk-data-paths.yaml +++ b/registry/generated/high-risk-data-paths.yaml @@ -10,18 +10,19 @@ # declares it, and is null where the field set has not been established -- # null means unknown, never 'one field'. -generated_at: "2026-09-14T02:57:04Z" +generated_at: "2026-09-14T07:58:30Z" source: ops-warden/registry/routing/catalog.yaml -catalog_revision: "73e40af6ca27ca547eb42782d2ceb1a5cc8c3534" -catalog_revision_date: "2026-09-14T02:47:32+02:00" +catalog_revision: "4ebd241d88e0f65125b3097a6d3aeccd4c294eb6" +catalog_revision_date: "2026-09-14T04:57:55+02:00" catalog_dirty: true -high_risk_lane_count: 27 +high_risk_lane_count: 28 concrete_path_count: 15 # Graded high but not a single KV address -- a routing pattern, a broker # grant, or a non-KV lane. Nothing here for a policy to deny. no_concrete_path: - database-dynamic-credentials + - flex-auth-decision-envelope-signing-key - inter-hub-bootstrap-ssh - net-kingdom-lldap-bind-credential - net-kingdom-privacyidea-admin-token diff --git a/registry/routing/catalog.yaml b/registry/routing/catalog.yaml index da27413..0624f17 100644 --- a/registry/routing/catalog.yaml +++ b/registry/routing/catalog.yaml @@ -684,6 +684,29 @@ entries: - "Verify capabilities-safe on the data path (`bao token capabilities`); run a restore drill against a re-encrypted artifact." - "After rotation, clear EXPOSED taint: remove custom_metadata exposed_at/exposed_version (see `warden taint railiance-backup-offsite-lane`)." + - id: flex-auth-decision-envelope-signing-key + title: Ed25519 key that signs flex-auth decision envelopes + risk: high + workload_ref: + applicability: applicable + unknown_reason: "flex-auth has not published an authoritative workload identity declaration for envelope signing." + need_keywords: [flex-auth, decision, envelope, signing, signature, ed25519, responder, authenticity, FLEX-WP-0024] + owner_repo: railiance-platform + subsystem: OpenBao + flex-auth + warden_executes: false + wiki_ref: wiki/playbooks/flex-auth-decision-envelope-signing-key.md#worker-checklist + canon_ref: flex-auth/docs/decision-envelope-signature.md + reviewed: "2026-09-14" + status: draft + delegation: + mode: interim + intended_owner: railiance-platform + blocked_on: "Shape is chosen in flex-auth (FLEX-WP-0024-T02). OpenBao KV path, Kubernetes auth role, and paste_once_provision of the private seed are not built. Testdata key in flex-auth is not this lane." + reviewed: "2026-09-14" + verified: unverified + auth_method: "Kubernetes auth from the flex-auth pin (to be bound); not a static secret in git" + path_template: "platform/workloads/flex-auth/envelope-signing (fields ED25519_PRIVATE_KEY, ED25519_PUBLIC_KEY, kid)" + - id: state-hub-forge-derivation-read title: Forgejo read-only token for State Hub projection derivation risk: high diff --git a/wiki/playbooks/flex-auth-decision-envelope-signing-key.md b/wiki/playbooks/flex-auth-decision-envelope-signing-key.md new file mode 100644 index 0000000..31c7650 --- /dev/null +++ b/wiki/playbooks/flex-auth-decision-envelope-signing-key.md @@ -0,0 +1,35 @@ +# flex-auth decision-envelope signing key + +Date: 2026-09-14 +Catalog: `flex-auth-decision-envelope-signing-key` (status `draft` until the OpenBao lane exists) +Owner of **shape**: `flex-auth` (`docs/decision-envelope-signature.md`) +Owner of **key material**: OpenBao / `railiance-platform` — flex-auth does not mint this key + +Detached Ed25519 key used to sign `flex-auth.decision-record.v1` envelopes so a +stored allow remains attributable after the HTTP connection is gone +(`FLEX-WP-0024`, `FLEX-DEC-2026-010`). + +**This lane is a pointer.** ops-warden routes it and executes nothing. + +**Ask first:** `warden plan "decision envelope signing key" --json`. + +--- + +## Worker checklist + +1. Do **not** generate a key in `flex-auth` or paste a seed into Git, State Hub, or chat. +2. The proposed KV path is `platform/workloads/flex-auth/envelope-signing`. + Fields: `ED25519_PRIVATE_KEY` (secret), `ED25519_PUBLIC_KEY` and `kid` (public). +3. flex-auth loads the private key the same way it loads TokenReview credentials. + With no key configured it emits `signature.mode=unsigned`. +4. Consumers verify with `kid` against the published public key list, not a pinned + single key. Rotation overlap is the allow TTL (default 15m) plus a short margin. + +## Verify (capabilities-safe) + +```bash +bao token capabilities platform/data/workloads/flex-auth/envelope-signing +# expect: read on the workload identity; deny for unrelated paths +``` + +Do not print the private field.