coulomb/railiance-platform
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

RPF-WP-0035-T02: CCR-2026-0038 service-JWT login lane for secrets-engine-openbao
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
Package the reviewed keycape-services JWT mount, secrets-engine-openbao role
and secrets-engine-login-self policy as CCR-2026-0038 and teach the delegated
applier a narrow service-jwt-login request type: fixed mount, generated
login-self policy, allow-listed role/config keys, bounded TTL/uses, refusal on
a foreign mount type and a value-free readback compare. The policy now denies
the client-secret data/metadata paths explicitly (MASON-WP-0009 invariant ii).
Proposed only; founder approval and delegated apply pending.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 327203@bnt-lap001
Assistant-Session: 55028ae3-4914-4bd1-8f5c-815f3527aef0
This commit is contained in:
codex 2026-10-09 00:31:47 +02:00
parent 2e7701f155
commit 0b2e7ddb5f
8 changed files with 680 additions and 15 deletions
Download patch file Download diff file Expand all files Collapse all files

13
docs/credential-lane-designs/secrets-engine-service-jwt.md
View file

@ -1,6 +1,6 @@
# Secrets-engine service JWT login
Status: proposed, not provisioned. Owner: railiance-platform, RPF-WP-0035-T02 (design origin RPF-WP-0032).
Status: source complete as CCR-2026-0038 (proposed), not provisioned. Owner: railiance-platform, RPF-WP-0035-T02 (design origin RPF-WP-0032).
Demand: State Hub message `38b47122-07eb-4a7f-a5df-13a38f50e110`.
## Contract and ownership
@ -150,3 +150,14 @@ its source contract or local managed IDs.
`docs/provisioning-windows/2026-10-04-1000/dependency-requirements.md` names all
source/acceptance/reopen boundaries. RPF-WP-0035-T02 remains wait; its workplan
is blocked on those real dependencies and separate attended execution approval.
## Source complete — 2026-10-09
KEY-WP-0037 finished 2026-10-07 and CCR-2026-0033/0034 are applied, so the
"before writing" preconditions are met. The reviewed bundle is now packaged as
CCR-2026-0038 (`request_type: service-jwt-login`), applied by the delegated
applier (`scripts/service_jwt_lane.py`): policy, `auth enable` of
`keycape-services` only if absent (refuses a foreign type), config, role, then
a value-free readback compare. The self policy gained explicit denies on the
client-secret data/metadata paths (ops-mason MASON-WP-0009 invariant (ii)).
The founder command is recorded in RPF-WP-0035-T02.