coulomb/railiance-infra
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

SCOPE: record RAIL-HO-WP-0014 restricted agent host account
All checks were successful
CI Smoke / source-contract (push) Successful in 14s
Details
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 605711@bnt-lap001
Assistant-Session: 1f5e2256-181f-49ed-b7b1-a1c34bf37a61
This commit is contained in:
codex 2026-10-21 00:01:07 +02:00
parent 37ed8b012b
commit 969d42088d
1 changed files with 15 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

15
SCOPE.md
View file

@ -41,6 +41,8 @@ entries do not contain.
retired public grants
- Grant validation before opening public web ports 80/443 for a reef
- Installation of OpenBao SSH user-CA trust and per-user principals
- Restricted host accounts for supervised agents (principal, sshd `Match`
policy, allowed supplementary groups, Goss posture)
- Installation of SOPS/age tooling and SOPS-encrypted storage of the Hetzner
provider token
- Goss host checks, TAP evidence, and an hourly on-host pass/fail signal
@ -124,6 +126,12 @@ maintenance, evidence collection, and drift checks are ongoing S1 work.
age key on a host
- Evidence: the latest committed `Railiance01` capacity observation is a
point-in-time record, not continuous resource telemetry
- Restricted agent account (RAIL-HO-WP-0014): `custodian-agt` on
`Railiance01`, principal `agt-custodian`, sshd `Match` allowing certificate
login only and no forwarding, Goss posture spec. Supplementary groups are
an explicit allow-list (`gexec-review`) set through `ssh_principals`
`restricted_account_groups` (`37ed8b0`). T02 was applied 2026-10-20. T03, which
retires `agt-task-bridge`/`agt-interhub-bootstrap` from `tegwick`, is open
---
@ -210,6 +218,13 @@ description: Install automation public keys and OpenBao SSH user-CA trust with h
keywords: [ssh, certificate-authority, openbao, principals, access]
```
```capability
type: security
title: Restricted agent host account
description: Converge a certificate-only host account for a supervised agent (custodian-agt, principal agt-custodian on Railiance01) with an sshd Match block that disables forwarding, an explicit supplementary-group allow-list via ssh_principals restricted_account_groups, and a Goss posture spec.
keywords: [ssh, restricted-account, supervised-agents, sshd-match, goss, principals]
```
```capability
type: infrastructure
title: Host capacity evidence interface