tegwick
c8be24b940
Set flavor on open workplans from origin/prose/status. Copy existing depends_on aliases only. Do not promote residuals. Assistant: grok Assistant-Session: 01a09dc1-b21e-77e1-919e-fcad2f82b267
108 lines
5.5 KiB
Markdown
108 lines
5.5 KiB
Markdown
---
|
|
id: WARDEN-WP-0039
|
|
type: workplan
|
|
title: "Preserve explicit policy caller refusals before credential and CA effects"
|
|
domain: infotech
|
|
repo: ops-warden
|
|
status: blocked
|
|
flavor: residual
|
|
owner: codex
|
|
topic_slug: custodian
|
|
created: "2026-09-08"
|
|
updated: "2026-09-08"
|
|
origin: residual
|
|
origin_ref: HFACT-WP-0001
|
|
state_hub_workstream_id: "ae44a935-6fca-514c-a385-4550dd2b1fe8"
|
|
---
|
|
|
|
The factory critical-path review reproduced a live HTTP 403 from the reachable
|
|
PDP for the configured ops-warden caller and a railiance-platform secret read.
|
|
`check_fetch_policy` treated it as evaluator unavailability and used unknown-zone
|
|
fail-open. Caller-auth rejection is an explicit refusal, not a transport outage.
|
|
|
|
## Preserve explicit authentication and binding refusals
|
|
|
|
```task
|
|
id: WARDEN-WP-0039-T01
|
|
status: done
|
|
flavor: residual
|
|
priority: high
|
|
assignee: the-custodian
|
|
state_hub_task_id: "eaad08d9-ae47-5f50-8278-ea402a0e2869"
|
|
```
|
|
|
|
HTTP 401 and 403 stop signing and credential fetch irrespective of the outage
|
|
profile. Do not expose response bodies or alter system identity to bypass the
|
|
refusal. Preserve configured behavior for genuine evaluator failures. Prove
|
|
both permissive and closed outage profiles and refusal before child execution.
|
|
|
|
## Verify and publish the correction
|
|
|
|
```task
|
|
id: WARDEN-WP-0039-T02
|
|
status: done
|
|
flavor: residual
|
|
priority: high
|
|
assignee: the-custodian
|
|
state_hub_task_id: "ac85cf00-391c-5c63-b8f4-ed5bd57684e5"
|
|
```
|
|
|
|
Run the policy and proxy suites, retain a value-free live refusal receipt,
|
|
publish the reviewed source, and verify the installed CLI refuses before any
|
|
credential transport. A refusal is not a successful credential-read admission.
|
|
|
|
The owner installer initially reused a cached wheel despite `--force`, leaving
|
|
the pre-fix policy code installed. Both Makefile installation targets now use
|
|
`--reinstall-package ops-warden` to refresh this package from the reviewed source.
|
|
Verify the installed module as well as the checkout before the live refusal test.
|
|
|
|
## Resolve the credential proxy's admitted policy binding
|
|
|
|
```task
|
|
id: WARDEN-WP-0039-T03
|
|
status: wait
|
|
flavor: residual
|
|
priority: high
|
|
assignee: the-custodian
|
|
blocking_reason: "The configured ops-warden caller represents ops-warden; credential requests name their owner as resource.system. Need the flex-auth/credential-owner contract for that exact delegated read, without broadening caller bindings or relabelling resource ownership."
|
|
state_hub_task_id: "8ca28b63-2e04-5333-b635-011b124c1806"
|
|
```
|
|
|
|
Consume the existing native-lane handoff (WARDEN-WP-0033 / SECRETS-WP-0006)
|
|
and flex-auth caller contract. Establish whether this interim transport needs an
|
|
admitted dedicated policy route or must finish its native handoff. Retain the
|
|
refusal until that contract yields positive and wrong-caller/owner/tenant
|
|
negative evidence. No credential read, secret generation, or policy grant is
|
|
authorized by this workplan alone. HFACT-WP-0001-T03 consumes this return.
|
|
|
|
Validation: 429 tests passed (4 integration tests deselected by the repository default); Ruff passed for changed Python files. Full tests used the declared phase-memory source and an isolated temporary memory store. The focused policy/proxy suite passed 69 tests. The existing authenticated SSH policy probe still returns HTTP 200/ALLOW, decision:f3f7c88f9585582a; the credential-owner request returns 403. No CA issue or credential read was performed by these probes.
|
|
|
|
Installed verification: source guard present after refreshed owner installation (`19bb75c`). `warden access forgejo-admin-api-token --exec --field API_TOKEN -- true` exits 4 with explicit HTTP 403 before credential transport or child execution. The previous fail-open warning is absent. The probe requested no output value; no credential was fetched. T01/T02 are complete; T03 owns the remaining exact policy-binding admission.
|
|
|
|
**T03 routed 2026-09-09.** Asked `flex-auth` whether an admitted contract exists
|
|
for a delegated credential read where the caller (ops-warden) and the resource
|
|
owner differ, since that is exactly the shape drawing the live 403. Three outcomes
|
|
were named as equally acceptable answers, with no preference stated between the
|
|
first two: an existing contract to conform to; no contract yet, making this a
|
|
design question they should raise rather than one ops-warden invents a shape for;
|
|
or that there should be **no** such contract — the interim proxy transport is
|
|
itself the defect and the answer is to finish the native handoff
|
|
(`WARDEN-WP-0033` / `SECRETS-WP-0006`).
|
|
|
|
The third is a real possibility and was not argued against. Eleven catalog lanes
|
|
are ops-warden proxies with a named intended owner precisely because no owner
|
|
front door exists; if delegated reads should not be made policy-admissible, that
|
|
shortens WP-0033 rather than blocking it.
|
|
|
|
Two fixes were explicitly ruled out in the message rather than left unmentioned:
|
|
broadening the ops-warden caller binding so it may read other systems' resources,
|
|
and relabelling `resource.system` as ops-warden so the existing binding matches.
|
|
The second is worse — it would make the audit trail assert ops-warden owns
|
|
credentials it deliberately does not, which is the claim `ADR-0002` exists to
|
|
prevent, achieved by editing a field instead of making an argument.
|
|
|
|
The refusal stays in place until an answer yields positive evidence plus
|
|
wrong-caller, wrong-owner and wrong-tenant negatives. No grant was requested.
|
|
`secrets-engine` was told this bears on SECRETS-WP-0007-T04 and on how many lanes
|
|
stay proxied; `gate-house` was told it may reach how the signing lane's
|
|
approval-consume is built (GH-DEC-2026-005).
|