diff --git a/registry/generated/high-risk-data-paths.yaml b/registry/generated/high-risk-data-paths.yaml index 75ff15b..b3a24bd 100644 --- a/registry/generated/high-risk-data-paths.yaml +++ b/registry/generated/high-risk-data-paths.yaml @@ -10,11 +10,11 @@ # declares it, and is null where the field set has not been established -- # null means unknown, never 'one field'. -generated_at: "2026-10-14T16:21:15Z" +generated_at: "2026-10-14T16:46:11Z" source: ops-warden/registry/routing/catalog.yaml catalog_revision: "8dbf62515a4e6b18d0b67beaa475a4747bf75cc7" catalog_revision_date: "2026-10-14T18:21:02+02:00" -catalog_dirty: false +catalog_dirty: true high_risk_lane_count: 35 concrete_path_count: 17 diff --git a/registry/routing/catalog.yaml b/registry/routing/catalog.yaml index b8c2e12..a734a50 100644 --- a/registry/routing/catalog.yaml +++ b/registry/routing/catalog.yaml @@ -665,11 +665,13 @@ entries: # proxies reads as the caller and never holds the value. # Data-plane identity is whichever token the OpenBao CLI resolves # (BAO_TOKEN, then VAULT_TOKEN, then ~/.vault-token). That is not the - # flex-auth caller. CCR-2026-0005 does not bind an OIDC role to - # workload-kv-read-reuse-surface-runtime; the only live binding is the - # ESO Kubernetes role reuse-surface-runtime-eso. platform-admin must not - # receive the scoped policy. See the playbook. - auth_method: "ambient OpenBao token (BAO_TOKEN, then VAULT_TOKEN, then ~/.vault-token); no OIDC role binds workload-kv-read-reuse-surface-runtime" + # flex-auth caller. CCR-2026-0005 does not bind an OIDC role. The only + # live binding is Kubernetes role reuse-surface-runtime-eso. + # CCR-2026-0044 (proposed, railiance-platform) reserves a dedicated + # caller. ops-mason (MASON-WP-0011) says that role stays out of + # auth_method until member and non-member verification both pass. + # platform-admin must not receive the scoped policy. See the playbook. + auth_method: "ambient OpenBao token (BAO_TOKEN, then VAULT_TOKEN, then ~/.vault-token); dedicated caller unnamed until CCR-2026-0044 is approved and member plus non-member verification pass" path_template: "platform/workloads/reuse/reuse-surface/runtime-secrets" fetch_command: "bao kv get -field=REUSE_SURFACE_TOKEN platform/workloads/reuse/reuse-surface/runtime-secrets" policy_ref: "flex-auth check secret.read:reuse" diff --git a/tests/test_reuse_surface_caller_gate.py b/tests/test_reuse_surface_caller_gate.py new file mode 100644 index 0000000..ea29034 --- /dev/null +++ b/tests/test_reuse_surface_caller_gate.py @@ -0,0 +1,17 @@ +"""The reuse-surface catalog caller stays unnamed until verification.""" +from __future__ import annotations + +from pathlib import Path + +from warden.routing import load_catalog + + +def test_dedicated_caller_stays_unnamed_until_ccr_2026_0044_verification(): + catalog = load_catalog(Path(__file__).resolve().parents[1] / "registry" / "routing" / "catalog.yaml") + entry = catalog.get("reuse-surface-hub-write-token") + assert entry is not None + auth = entry.auth_method or "" + # MASON-WP-0011: the proposed OIDC role is not the auth method yet. + assert "reuse-surface-hub-writer" not in auth + assert "CCR-2026-0044" in auth + assert "unnamed" in auth diff --git a/wiki/playbooks/reuse-surface-hub-write-token.md b/wiki/playbooks/reuse-surface-hub-write-token.md index 64cd555..97f9eb2 100644 --- a/wiki/playbooks/reuse-surface-hub-write-token.md +++ b/wiki/playbooks/reuse-surface-hub-write-token.md @@ -39,9 +39,9 @@ recorded in CCR-2026-0005. A capabilities check on one shell and a proxy in another can disagree. The OpenBao CLI in the proxy uses that process's ambient token. An attended `platform-admin` login (entity `4a1f663c-0621-0483-edd0-f852274f4b6b`, policies `default`, `operator-custody`, `platform-admin`) can show `read` on both exact paths while `auth/netkingdom/role/coding-agent` is denied: that role's `agent-high-risk-boundary` policy denies data read on this path. The 2026-10-14 hub registration attempt was that shape. PDP decision `f730e3da14beebdd` allowed the fetch; OpenBao then returned HTTP 403 and the helper did not run. -Do not attach `workload-kv-read-reuse-surface-runtime` to the platform-admin entity. CCR-2026-0005 does not name that caller. The only live binding is Kubernetes role `auth/kubernetes/role/reuse-surface-runtime-eso` (ServiceAccount `reuse/reuse-surface-eso`, audience `openbao`) with policy `workload-kv-read-reuse-surface-runtime-eso`: data read plus token self lookup and revoke. The caller-facing policy file allows read of the exact data and metadata paths and is not attached to any `auth/netkingdom` role. +Do not attach `workload-kv-read-reuse-surface-runtime` to the platform-admin entity. CCR-2026-0005 does not name that caller. The only live binding is Kubernetes role `auth/kubernetes/role/reuse-surface-runtime-eso` (ServiceAccount `reuse/reuse-surface-eso`, audience `openbao`) with policy `workload-kv-read-reuse-surface-runtime-eso`: data read plus token self lookup and revoke. The caller-facing policy file allows read of the exact data and metadata paths and is not attached to any live `auth/netkingdom` role. -A dedicated caller is a new `auth/netkingdom` OIDC role in railiance-platform, same shape as the other `workload-kv-read` roles: `token_policies` only `workload-kv-read-reuse-surface-runtime`, `token_no_default_policy` true, and a sibling path still denied. Platform-operator and reuse-surface-owner approve the named principal first. ops-warden does not apply that binding. +The dedicated caller is proposed, not applied. railiance-platform `CCR-2026-0044` (status `proposed`) and ops-mason `MASON-WP-0011` reserve OIDC role `reuse-surface-hub-writer-workload-kv-read` for group `reuse-surface-hub-writers`, policy `workload-kv-read-reuse-surface-runtime` only. Apply waits on platform-operator and reuse-surface-owner approval, key-cape confirmation of that group, and a member entity other than `4a1f663c-0621-0483-edd0-f852274f4b6b`. The catalog `auth_method` stays unnamed until `ops-mason/scripts/verify-reuse-surface-hub-writer.py` passes in both `member` and `non-member` modes. Those receipts do not exist yet. ops-warden does not apply the role and does not put it in `auth_method` before that gate. ### Break-glass (cluster read)