coulomb/ops-warden
4
0
Fork 0
Code Issues Pull requests Projects Releases 2 Packages Wiki Activity Actions

WARDEN-WP-0026 T01: capabilities-safe lane verification + incident note
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
T01 (done): canonical capabilities-based verify pattern in the fleet promotion
checklist (catalog-lane-promotion.md) and applied to the railiance-backup and
forgejo-admin lane playbooks. Verification proves allow/deny via
`bao token capabilities` against the KV v2 data path, never `bao kv get`; a denied
default-policy token-create is a pass, not a privileged-fallback trigger.

T07 (progress): lessons-learned note for the 2026-07-16 CCR-2026-0004 disclosure
(three root causes). Live re-verify + rotation block remain (depend on T06).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
tegwick 2026-07-16 14:26:05 +02:00
parent 2ad8a53781
commit ea98d6bf39
5 changed files with 161 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

26
wiki/playbooks/railiance-backup-offsite-lane.md
View file

@ -56,4 +56,28 @@ Used by `railiance-backup` (workstation) and `forgejo-backup` (platform).
tools/cmd/forgejo-backup
```
`AGE_PRIVATE_KEY` in the same path is recovery escrow — fetch only for restore drills.
`AGE_PRIVATE_KEY` in the same path is recovery escrow — fetch only for restore drills.
---
## Verify the lane (capabilities-safe — never read the value)
Prove allow/deny with `bao token capabilities`, **not** `bao kv get`. Reading the
value to "confirm" it triggered the 2026-07-16 disclosure of `NC_WEBDAV_TOKEN` /
`NC_WEBDAV_URL` / `AGE_PRIVATE_KEY` (see `history/2026-07-16-credential-disclosure-lessons.md`).
```bash
# Positive: lane OIDC identity can read the data path
bao login -method=oidc -path=netkingdom role=railiance-backup-workload-kv-read
bao token capabilities "$(bao print token)" platform/data/workloads/railiance/backup/offsite-lane
# → expect: read
# Negative: default-only identity is denied (no value is read)
DEFAULT_TOKEN=$(bao token create -policy=default -field=token) # if this is denied, that IS the pass — do NOT fall back
bao token capabilities "$DEFAULT_TOKEN" platform/data/workloads/railiance/backup/offsite-lane
# → expect: deny
```
The capability lists contain no secret material — safe to record on
`CCR-2026-0004` as promotion evidence. Full pattern:
`wiki/playbooks/catalog-lane-promotion.md#capabilities-safe-lane-verification`.