diff --git a/WORK-RECORDS.md b/WORK-RECORDS.md index e31767e..22e6308 100644 --- a/WORK-RECORDS.md +++ b/WORK-RECORDS.md @@ -24,6 +24,7 @@ | workplan | RAILIANCE-WP-0023 | finished | — | workplans/RAILIANCE-WP-0023-hub-core-candidate-credential-lanes.md | | workplan | RAILIANCE-WP-0024 | active | — | workplans/RAILIANCE-WP-0024-audit-core-custody-and-recovery-coordination.md | | workplan | RAILIANCE-WP-0025 | finished | — | workplans/RAILIANCE-WP-0025-versioned-ephemeral-custody-lifecycle.md | +| workplan | RAILIANCE-WP-0026 | ready | — | workplans/RAILIANCE-WP-0026-attended-login-output-containment.md | | workplan | RPF-WP-0018 | finished | — | workplans/RPF-WP-0018-policy-surface-alignment.md | | workplan | RPF-WP-0019 | finished | — | workplans/RPF-WP-0019-apps-pg-recoverability-and-controls.md | | workplan | RPF-WP-0020 | finished | — | workplans/RPF-WP-0020-ccr-schema-drift.md | @@ -108,6 +109,7 @@ | task | RAILIANCE-WP-0025-T04 | done | — | workplans/RAILIANCE-WP-0025-versioned-ephemeral-custody-lifecycle.md | | task | RAILIANCE-WP-0025-T05 | done | — | workplans/RAILIANCE-WP-0025-versioned-ephemeral-custody-lifecycle.md | | task | RAILIANCE-WP-0025-T06 | done | — | workplans/RAILIANCE-WP-0025-versioned-ephemeral-custody-lifecycle.md | +| task | RAILIANCE-WP-0026-T01 | todo | — | workplans/RAILIANCE-WP-0026-attended-login-output-containment.md | | task | RPF-WP-0018-T01 | done | — | workplans/RPF-WP-0018-policy-surface-alignment.md | | task | RPF-WP-0018-T02 | done | — | workplans/RPF-WP-0018-policy-surface-alignment.md | | task | RPF-WP-0018-T03 | done | — | workplans/RPF-WP-0018-policy-surface-alignment.md | diff --git a/workplans/RAILIANCE-WP-0026-attended-login-output-containment.md b/workplans/RAILIANCE-WP-0026-attended-login-output-containment.md new file mode 100644 index 0000000..cf34a86 --- /dev/null +++ b/workplans/RAILIANCE-WP-0026-attended-login-output-containment.md @@ -0,0 +1,99 @@ +--- +id: RAILIANCE-WP-0026 +type: workplan +title: "Contain attended OpenBao login output before authentication" +domain: financials +repo: railiance-platform +status: ready +owner: codex +topic_slug: railiance +created: "2026-08-23" +updated: "2026-08-23" +related: + - RAILIANCE-WP-0024 + - WARDEN-WP-0027 + - WARDEN-WP-0027-T02-DRILL-20260822-01 +origin: routed +origin_ref: "State Hub message b3f34c2d-941f-4ddd-b15d-e28075446021" +--- + +# RAILIANCE-WP-0026 — attended OpenBao login output containment + +## Goal + +Make the governed `openbao-platform-admin-login` path fail before OIDC unless +it can guarantee isolated private token-helper storage and contain every byte +emitted by the underlying client. A persistence or output-contract failure must +revoke any issued credential without placing its value, accessor, fingerprint, +or derived material in agent-visible output, Git, State Hub, evidence, or logs. + +This workplan records the direct fix interface requested by `railiance-infra`. +It does not authorize OIDC authentication, minting, OpenBao administration, a +seal/unseal ceremony, or reuse of the terminal drill scenario. + +## Ownership and fixed boundaries + +- `railiance-platform` owns the login lane, acceptance contract, and any future + production rehearsal. +- `ops-warden` owns the current proxy implementation in `src/warden/cli.py`, + `src/warden/proxy.py`, and its focused tests. +- key-cape remains the OIDC/MFA identity provider; this task does not weaken or + replace MFA, change the OpenBao role, or introduce root/workload fallback. +- `railiance-infra` is the requesting reviewer and independent abort owner. +- Risk Nexus owns grading of State Hub filing request + `5a344f53-14e9-4230-8874-2f01b0a85700`. +- State Hub GO decision `449a697a-5303-4582-aa9e-b0bc8b35ab2d` was consumed by + NO-GO decision `85724c0c-e70f-4e2f-a8c6-a9cb1ea6331b`. Neither decision nor + scenario `WARDEN-WP-0027-T02-DRILL-20260822-01` may be reused. + +## T01 — Harden the attended-login adapter and prove failure containment + +```task +id: RAILIANCE-WP-0026-T01 +status: todo +priority: high +``` + +Implement the fix in `ops-warden` and return one value-safe owner receipt to +`railiance-platform` and `railiance-infra` naming the source revision, focused +test command/result, and the five acceptance outcomes below. The receipt must +contain no credential, accessor, fingerprint, output excerpt, callback code, +or token-helper contents. + +Acceptance is all of the following: + +1. An isolated writable token-helper location is created before authentication, + has mode `0600` (with private parent directories), and is removed or revoked + through a deterministic cleanup path. +2. A read-only or otherwise unusable default home fails before OIDC begins; the + adapter never discovers persistence failure only after credential issuance. +3. Adapter-owned stdout and stderr containment guarantees that no credential + reaches agent-visible output even if the underlying CLI violates + `-no-print`. Inherited agent-visible stdio is not permitted for this lane. +4. Unexpected credential-bearing or otherwise non-allowlisted output fails + closed and, whenever issuance may have occurred, triggers immediate + self-revocation through the contained process without logging, returning, + hashing, or fingerprinting the value. +5. Focused tests cover successful attended-login handoff, unwritable/default + home refusal before authentication, helper persistence failure, unexpected + stdout, unexpected stderr, immediate revocation, cleanup, and value absence + from captured test and audit output. + +The implementation must also update the `openbao-platform-admin-login` worker +playbook and catalog comment so they no longer claim safety from `-no-print` +alone. A non-production test double must prove the complete failure path before +any new live OIDC rehearsal is proposed. + +Done when the implementation is committed and pushed in `ops-warden`, the +focused suite passes, the value-safe owner receipt is delivered directly to +both reviewers, and `railiance-platform` accepts the exact revision. Completion +of this task still does not authorize a live drill; that requires fresh owner +receipts, current preflight, and a new human decision under a new scenario id. + +## Acceptance + +- [ ] The adapter refuses unsafe storage before OIDC. +- [ ] No underlying login output can reach the agent transcript. +- [ ] Any issued credential is contained and revoked on failure. +- [ ] Focused success and failure-path tests pass without credential material. +- [ ] Both direct reviewers receive and accept the value-safe fix receipt.