coulomb/ops-warden
4
0
Fork 0
Code Issues Pull requests Projects Releases 2 Packages Wiki Activity Actions

WARDEN-WP-0026 T01: capabilities-safe lane verification + incident note
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
T01 (done): canonical capabilities-based verify pattern in the fleet promotion
checklist (catalog-lane-promotion.md) and applied to the railiance-backup and
forgejo-admin lane playbooks. Verification proves allow/deny via
`bao token capabilities` against the KV v2 data path, never `bao kv get`; a denied
default-policy token-create is a pass, not a privileged-fallback trigger.

T07 (progress): lessons-learned note for the 2026-07-16 CCR-2026-0004 disclosure
(three root causes). Live re-verify + rotation block remain (depend on T06).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
tegwick 2026-07-16 14:26:05 +02:00
parent 2ad8a53781
commit ea98d6bf39
5 changed files with 161 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

19
workplans/WARDEN-WP-0026-credential-disclosure-hygiene.md
View file

@ -61,11 +61,19 @@ advisory knowledge held next to the routing catalog, not in OpenBao.
```task
id: WARDEN-WP-0026-T01
status: todo
status: done
priority: high
state_hub_task_id: "9329e72d-c07c-41ce-88ce-e8602eb72c43"
```
Done 2026-07-16: canonical capabilities-safe verification pattern added to
`wiki/playbooks/catalog-lane-promotion.md` (fleet promotion checklist criterion 8
+ dedicated section), and applied to the `railiance-backup-offsite-lane` and
`forgejo-admin-api-token` playbook verify sections. Positive/negative proven via
`bao token capabilities` against the KV v2 data path — never `bao kv get`; the
denied `default` token-create is documented as a pass, not a fallback trigger.
Live CCR-2026-0004 re-verify carried under T07.
Replace secret-reading verify flows with capability checks. Positive test:
approved identity has `read` on the KV data path. Negative test: a `default`-only
identity is `deny`. Both via `bao token capabilities <token> <path>` (or the
@ -170,11 +178,18 @@ every active lane, and the scorecard fails if any active lane lacks guidance.
```task
id: WARDEN-WP-0026-T07
status: todo
status: progress
priority: medium
state_hub_task_id: "9944f46d-3706-43a4-9300-7f63bf87c9ff"
```
Lessons-learned note written 2026-07-16:
`history/2026-07-16-credential-disclosure-lessons.md` (buildup context, exposure
accepted, three root causes). Remaining: capabilities-based live re-verify of
CCR-2026-0004 on `bao.coulomb.social` (uses T01 pattern) and its `rotation:` block
(depends on T06 registry) so the lane can promote to `resolvable: true` and unblock
RAILIANCE-WP-0015.
Write a short lessons-learned note (buildup context; exposure accepted; the three
root causes). Apply T01 + T06 to `CCR-2026-0004` as the first worked lane:
re-verify it the capabilities-safe way so it can finally promote to