Fix access inventory evidence and reconcile closure coordination
Assistant: codex Assistant-Model: gpt-6.1-sol Assistant-Session: 01a11beb-4eef-7fc1-94a7-597130a01ae9
This commit is contained in:
parent
490a89dca6
commit
57ad4abefc
9 changed files with 342 additions and 111 deletions
|
|
@ -102,6 +102,8 @@ It must not:
|
|||
|
||||
## Tasks
|
||||
|
||||
### T01 — Build the repeatable reference inventory
|
||||
|
||||
```task
|
||||
id: ORGREF-WP-0001-T01
|
||||
status: wait
|
||||
|
|
@ -159,6 +161,8 @@ in `railiance-platform/argocd/applications/`; `repository:
|
|||
forgejo.coulomb.social/coulomb/core-hub` in `railiance-apps/charts/core-hub/values.yaml`;
|
||||
`home:`/`sources:` URLs across at least five charts.
|
||||
|
||||
### T02 — Agree stewardship criteria and taxonomy
|
||||
|
||||
```task
|
||||
id: ORGREF-WP-0001-T02
|
||||
status: wait
|
||||
|
|
@ -200,6 +204,8 @@ home, both pending acceptance. Decision
|
|||
whynot as an additional steward, and records evidence for ops-hub/disaster-control.
|
||||
Naming and maintainer acceptance remain pending.
|
||||
|
||||
### T03 — Verify Git and package transfer behavior
|
||||
|
||||
```task
|
||||
id: ORGREF-WP-0001-T03
|
||||
status: wait
|
||||
|
|
@ -222,6 +228,8 @@ documentation — the container-registry path is the dangerous one because its
|
|||
failure is deferred to the next pod reschedule rather than surfacing at rename
|
||||
time.
|
||||
|
||||
### T04 — Prove transfer rollback
|
||||
|
||||
```task
|
||||
id: ORGREF-WP-0001-T04
|
||||
status: wait
|
||||
|
|
@ -240,6 +248,8 @@ Record exact operation, product/version, old/new paths, uncached pulls, GitOps
|
|||
revision/health, retention protections, credentials scope, cleanup and recovery
|
||||
time. Unrelated application rollout rollback is not acceptable transfer proof.
|
||||
|
||||
### T05 — Write the staged cutover plan
|
||||
|
||||
```task
|
||||
id: ORGREF-WP-0001-T05
|
||||
status: wait
|
||||
|
|
|
|||
|
|
@ -9,7 +9,7 @@ flavor: implementation
|
|||
owner: claude-code
|
||||
topic_slug: railiance
|
||||
created: "2026-10-08"
|
||||
updated: "2026-10-08"
|
||||
updated: "2026-10-09"
|
||||
depends_on: []
|
||||
related_repos:
|
||||
- key-cape
|
||||
|
|
@ -48,9 +48,10 @@ does not apply. It changes **who may read**, not where things live.
|
|||
It reuses ORGREF-WP-0001's preparation: the `inventory/` collectors, the
|
||||
stewardship assignments in `taxonomy/` (as owners for each consumer) and the
|
||||
reference scan. It also gives back to ORGREF-WP-0001: once the forge is closed,
|
||||
the anonymous collector can no longer see private repositories, so T09 moves it
|
||||
to an authenticated read identity. That resolves the access half of decision
|
||||
`5f3680fc` (authenticated metadata).
|
||||
the anonymous collector can no longer see private repositories. T06 must prove
|
||||
its authenticated read identity before closure; T09 verifies the handback.
|
||||
Accepted complete metadata evidence can resolve the access half of decision
|
||||
`5f3680fc`; having a token alone does not establish completeness.
|
||||
|
||||
## Target state
|
||||
|
||||
|
|
@ -58,14 +59,15 @@ to an authenticated read identity. That resolves the access half of decision
|
|||
use NetKingdom-issued identities or scoped Forgejo tokens with an owner and a
|
||||
rotation path. A local administrator account remains only as sealed
|
||||
break-glass, with its credentials in OpenBao.
|
||||
- Organisations and repositories are **private by default**. Public visibility
|
||||
is an explicit, recorded allowlist entry with a reason.
|
||||
- Organisations, repositories and packages are private, with no anonymous
|
||||
forge access. Deliberate publication goes to a separate location through the
|
||||
reviewed per-repository `public/` convention.
|
||||
- Every consumer that read the forge anonymously reads it with its own
|
||||
credential, with least privilege, before its repositories close.
|
||||
- Campaign images that must stay world-readable (Telegram posts fetch them by
|
||||
URL) come from a deliberate public asset location, not from a forge repo that
|
||||
happens to be public.
|
||||
- Anonymous probes show only the allowlist; the evidence is recorded.
|
||||
- The fluid-telegram adapter reads private images with its own identity and
|
||||
uploads them to Telegram (FT-WP-0001-T14). A public asset store is later work.
|
||||
- Anonymous probes show no forge repositories or packages after the final wave;
|
||||
the evidence is recorded.
|
||||
|
||||
## Boundaries
|
||||
|
||||
|
|
@ -80,7 +82,9 @@ It must not:
|
|||
- configure key-cape, Forgejo, OpenBao or any consumer itself. Each change lands
|
||||
through the owner repo's own workplan.
|
||||
- flip a production repository's visibility before T07's rehearsal passes and
|
||||
the founder approves that wave
|
||||
the founder approves that wave, except the separately approved visibility-only
|
||||
interim route in `decisions/forge-visibility-policy.md` section 5, whose clone,
|
||||
sign-in, recovery and one-repository rollback checks remain mandatory
|
||||
- read or print secret values (credential routing: `warden route`)
|
||||
- move, rename or restructure repositories (that is ORGREF-WP-0001)
|
||||
|
||||
|
|
@ -90,6 +94,8 @@ separate review, not something the flip repairs.
|
|||
|
||||
## Tasks
|
||||
|
||||
### T01 — Decide the visibility policy
|
||||
|
||||
```task
|
||||
id: ORGREF-WP-0002-T01
|
||||
status: done
|
||||
|
|
@ -97,8 +103,6 @@ priority: high
|
|||
state_hub_task_id: "6387cb32-dd73-5ee0-b51e-d4aea475bcca"
|
||||
```
|
||||
|
||||
### T01 — Decide the visibility policy
|
||||
|
||||
Record a founder decision covering:
|
||||
|
||||
1. **Default:** private for organisations and repositories, plus whether
|
||||
|
|
@ -117,7 +121,7 @@ Record a founder decision covering:
|
|||
now with existing local accounts. If yes: which ones, accepting that their
|
||||
consumers move to local tokens temporarily and are re-homed in T06.
|
||||
|
||||
2026-10-08: points 1 and 2 decided, recorded in
|
||||
2026-10-08: all six policy points and the driver role decided, recorded in
|
||||
`decisions/forge-visibility-policy.md`. The forge is private with no anonymous
|
||||
access, and public codebases go to a separate location. Publication is a
|
||||
per-repo `public/` folder of symlinks only, projected outward by a shared
|
||||
|
|
@ -129,9 +133,14 @@ trust management comes later, not now. Points 5 and 6 decided: interim
|
|||
lockdown of 13 repositories under the founder's guardrail (tighten gradually,
|
||||
no lockout, no asset loss, nothing hard to repair: clones first, one repository,
|
||||
verify and roll back once, then small batches, visibility only). T03 runs in
|
||||
parallel. Pre-check: executor-sandbox (diverged, unpushed local commits) and
|
||||
ops-mason (uncommitted changes) wait for their owners. Open: point 3 (packages)
|
||||
and the owner.
|
||||
parallel. Packages are private; node registry auth, an ArgoCD credential template
|
||||
and scoped CI/package identities are the accepted approach. An agent drives the
|
||||
plan; the founder holds policy and production wave approval. Pre-check:
|
||||
executor-sandbox (diverged, unpushed local commits) and ops-mason (uncommitted
|
||||
changes) wait for their owners. All policy points are settled; implementation
|
||||
proof remains outstanding.
|
||||
|
||||
### T02 — Inventory every anonymous reader
|
||||
|
||||
```task
|
||||
id: ORGREF-WP-0002-T02
|
||||
|
|
@ -140,8 +149,6 @@ priority: high
|
|||
state_hub_task_id: "ace26a22-50e2-58c6-b4ad-85d95c284fce"
|
||||
```
|
||||
|
||||
### T02 — Inventory every anonymous reader
|
||||
|
||||
Read-only. Extend `inventory/` with an access-consumer inventory: every party
|
||||
that reads the forge today without credentials, the repositories or packages it
|
||||
reads, and the owner (from `taxonomy/assignments.csv`) who will give it an
|
||||
|
|
@ -178,6 +185,8 @@ pulls anonymous). One node-level registry auth entry would cover every pull
|
|||
(T06). The stale Gitea credential on the node is a cleanup item. Code-reader
|
||||
confirmation moves to the owners under T06.
|
||||
|
||||
### T03 — Review what has already been public
|
||||
|
||||
```task
|
||||
id: ORGREF-WP-0002-T03
|
||||
status: done
|
||||
|
|
@ -185,8 +194,6 @@ priority: high
|
|||
state_hub_task_id: "9c2ca7be-23f8-58c5-9bfd-e44a26ce4584"
|
||||
```
|
||||
|
||||
### T03 — Review what has already been public
|
||||
|
||||
Before closing, and independent of it: run a secret and sensitive-content scan
|
||||
over the public repositories' history (credentials, tokens, private keys,
|
||||
internal hostnames or IPs, personal data). Findings go to their owners for
|
||||
|
|
@ -207,19 +214,23 @@ rest is benign (identifiers, digests, test fixtures, placeholders). Record and
|
|||
limits: `inventory/history-exposure-2026-10-08.md`. The rotation is tracked with
|
||||
the owners.
|
||||
|
||||
### T04 — NetKingdom: Forgejo as an OIDC client (child workplan in key-cape)
|
||||
|
||||
```task
|
||||
id: ORGREF-WP-0002-T04
|
||||
status: wait
|
||||
depends_on: [ORGREF-WP-0002-T01]
|
||||
blocking_reason: "The NetKingdom side follows the visibility and identity decisions; open the key-cape child workplan once T01 is resolved."
|
||||
depends_on: [ORGREF-WP-0002-T01, KEY-WP-0038-T03]
|
||||
blocking_reason: "KEY-WP-0038-T03 must deliver claims evidence; registration T02 waits on NK-WP-0048-T06 (KnownSecurityCase), not an ad-hoc helper."
|
||||
priority: high
|
||||
state_hub_task_id: "112617e1-a7c3-59c1-bf25-235d58ec118b"
|
||||
```
|
||||
|
||||
### T04 — NetKingdom: Forgejo as an OIDC client (child workplan in key-cape)
|
||||
|
||||
Drafted 2026-10-08 as key-cape `KEY-WP-0038` (ready, founder-approved).
|
||||
Open a key-cape workplan, linked here by ID, to:
|
||||
Owner record: key-cape `KEY-WP-0038`
|
||||
(`098e3e2c-a138-560e-b2d3-3a15eb49d8a9`). Reviewed October 9: T01 claim
|
||||
contract accepted; T02 registration waits on net-kingdom `NK-WP-0048-T06`
|
||||
(`d9b26bcf-a7c6-59a2-92a0-f913d76a203c`); T03 claims proof is pending.
|
||||
The owner uses the accepted KnownSecurityCase route, with ops-mason and
|
||||
ops-warden, rather than a case-specific script. The owner record covers:
|
||||
|
||||
- register Forgejo as a confidential OIDC client (redirect URI, scopes, PKCE)
|
||||
with its client secret in OpenBao, through the railiance-platform custody path
|
||||
|
|
@ -233,20 +244,22 @@ Open a key-cape workplan, linked here by ID, to:
|
|||
Acceptance: a test login against a staging client returns the expected claims
|
||||
for one human, one agent and one service identity.
|
||||
|
||||
### T05 — Forgejo: NetKingdom login and team mapping (child workplan in railiance-apps)
|
||||
|
||||
```task
|
||||
id: ORGREF-WP-0002-T05
|
||||
status: wait
|
||||
depends_on: [ORGREF-WP-0002-T04]
|
||||
blocking_reason: "Forgejo can only add the authentication source once the NetKingdom client and claims exist."
|
||||
depends_on: [ORGREF-WP-0002-T04, RAPPS-WP-0016-T03]
|
||||
blocking_reason: "RAPPS-WP-0016-T03 must prove account linking and team grants after KEY-WP-0038 delivers the client and claims."
|
||||
priority: high
|
||||
state_hub_task_id: "6c635b25-a4ae-5259-9317-de3fe38f6234"
|
||||
```
|
||||
|
||||
### T05 — Forgejo: NetKingdom login and team mapping (child workplan in railiance-apps)
|
||||
|
||||
railiance-apps owns the Forgejo Helm release (`docs/forgejo-on-railiance01.md`).
|
||||
Drafted 2026-10-08 as railiance-apps `RAPPS-WP-0016` (ready, founder-approved).
|
||||
Open a railiance-apps workplan, linked here by ID, to:
|
||||
Owner record: railiance-apps `RAPPS-WP-0016`
|
||||
(`f6b1d6f6-0abb-5774-87b9-bf3cfb640a3b`). Reviewed October 9: break-glass
|
||||
preparation T01 is todo; authentication, linking and grants remain waiting.
|
||||
The owner record covers:
|
||||
|
||||
- add the NetKingdom OIDC authentication source and claim-to-team mapping;
|
||||
disable open registration; link existing local accounts (founder, agent
|
||||
|
|
@ -260,6 +273,8 @@ Open a railiance-apps workplan, linked here by ID, to:
|
|||
Acceptance: the founder and one agent sign in through NetKingdom and see what
|
||||
their team grants. Break-glass login is verified once and recorded.
|
||||
|
||||
### T06 — Give every consumer its own read identity
|
||||
|
||||
```task
|
||||
id: ORGREF-WP-0002-T06
|
||||
status: wait
|
||||
|
|
@ -269,23 +284,25 @@ priority: high
|
|||
state_hub_task_id: "1285f94d-3b57-502b-8aeb-96fab9578287"
|
||||
```
|
||||
|
||||
### T06 — Give every consumer its own read identity
|
||||
|
||||
For each consumer class in T02, its owner provisions a scoped credential and
|
||||
proves it works **against a private canary repository and package** created by
|
||||
this project, while anonymous access to that canary fails:
|
||||
|
||||
- cluster: deploy tokens for ArgoCD/Flux repo credentials, `imagePullSecrets`
|
||||
for registry pulls (railiance-apps, railiance-platform)
|
||||
- cluster: the accepted ArgoCD repository credential template and node-level
|
||||
read-only registry login (railiance-apps, railiance-platform and node owner);
|
||||
prove fresh pulls, including service-account and node credential behavior
|
||||
- runners: tokens or OIDC for checkout and reusable actions (railiance-apps, which runs `forgejo-runner`)
|
||||
- agents and workstations: NetKingdom identities or scoped tokens routed through
|
||||
ops-warden; nothing pasted into repositories
|
||||
- State Hub, repo-manager and the ORGREF collector: authenticated read identity
|
||||
- fluid-telegram and pr-hall-of-helix: images moved to the T01 public asset
|
||||
location, with the `compose visual` raw-URL bases updated
|
||||
- State Hub, repo-manager and the ORGREF collector: authenticated read identity,
|
||||
with private repository/package enumeration proven before T08
|
||||
- fluid-telegram and pr-hall-of-helix: private image fetch and Telegram upload
|
||||
through FT-WP-0001-T14; prove posts without anonymous raw-image reads
|
||||
|
||||
Each owner records its proof in its own workplan. This plan tracks the list.
|
||||
|
||||
### T07 — Rehearse the flip and the rollback
|
||||
|
||||
```task
|
||||
id: ORGREF-WP-0002-T07
|
||||
status: wait
|
||||
|
|
@ -295,14 +312,14 @@ priority: high
|
|||
state_hub_task_id: "0dcf25e2-cda1-5f87-b7fe-5b7e27635565"
|
||||
```
|
||||
|
||||
### T07 — Rehearse the flip and the rollback
|
||||
|
||||
On throwaway repositories and packages: switch public → private → public, and
|
||||
verify consumer reads, anonymous denial, web links, Actions runs and image pulls
|
||||
at each step. Record the exact commands or API calls, the time each step takes,
|
||||
and what a rollback restores (visibility) and what it does not (anything already
|
||||
fetched). This rehearsal is the gate for T08.
|
||||
|
||||
### T08 — Close the forge in waves
|
||||
|
||||
```task
|
||||
id: ORGREF-WP-0002-T08
|
||||
status: wait
|
||||
|
|
@ -313,8 +330,6 @@ priority: high
|
|||
state_hub_task_id: "42724077-9837-5aef-ad3b-6551f2103aa2"
|
||||
```
|
||||
|
||||
### T08 — Close the forge in waves
|
||||
|
||||
Change production visibility in founder-approved waves. Each wave lists its
|
||||
repositories and packages and the consumers that read them. Proposed order:
|
||||
|
||||
|
|
@ -327,6 +342,8 @@ After each wave: consumer health checks, anonymous probe, and a recorded
|
|||
rollback point. A failing consumer rolls its repositories back to public and
|
||||
stops the wave. The fix lands with the consumer's owner.
|
||||
|
||||
### T09 — Verify, hand back and record
|
||||
|
||||
```task
|
||||
id: ORGREF-WP-0002-T09
|
||||
status: wait
|
||||
|
|
@ -336,23 +353,27 @@ priority: medium
|
|||
state_hub_task_id: "82f53328-02f5-5953-830a-00019d7dee92"
|
||||
```
|
||||
|
||||
### T09 — Verify, hand back and record
|
||||
|
||||
- Anonymous probe of the server: only the T01 allowlist is visible. Record the
|
||||
evidence under `inventory/`.
|
||||
- Move ORGREF-WP-0001's collector to the authenticated identity from T06 and
|
||||
note the effect on decision `5f3680fc`.
|
||||
- Anonymous probe of the server: no repositories or packages are visible.
|
||||
Record the evidence under `inventory/`.
|
||||
- Verify ORGREF-WP-0001's collector still enumerates private metadata with the
|
||||
identity proven in T06; reconcile completeness and note the effect on decision
|
||||
`5f3680fc`. Do not postpone collector migration until after closure.
|
||||
- Add a row to the-custodian `docs/security-close-down-checklist.md`
|
||||
recording that the forge is closed by default, plus anything relaxed along the
|
||||
way that must be re-armed.
|
||||
- Record any consumer still on a temporary credential as live owner work, not as
|
||||
prose in this file.
|
||||
|
||||
## Open questions for review
|
||||
## Review — 2026-10-09
|
||||
|
||||
- Owner: is the founder the right owner, or should an agent own the driver with
|
||||
the founder holding T01/T08?
|
||||
- Should T03 (history review) block T08, or run in parallel and only gate
|
||||
rotations?
|
||||
- Is an interim lockdown (T01 point 5) worth the temporary-token churn, given how
|
||||
long T04–T07 will take?
|
||||
T01–T03 are done; T04–T09 remain waiting on owner implementation and proof.
|
||||
The October 8 policy settles driver ownership, package treatment, interim
|
||||
lockdown and parallel exposure review. No new production wave is authorized by
|
||||
this review. The interim route must satisfy its own recorded guardrails; the
|
||||
normal closure route retains T06/T07 and founder wave approval.
|
||||
|
||||
Collector schema 0.2 fixes package-index classification, separates legacy hosts,
|
||||
records scan exclusions/errors and treats missing pull secrets as unknown access.
|
||||
October 8 founder checks remain historical proof for that runtime snapshot;
|
||||
new runtime records require current owner confirmation. This review does not
|
||||
reopen T02 or replace its accepted evidence.
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue