From 0f012dbe280c641b834c5aebe9ba81cdacee72c1 Mon Sep 17 00:00:00 2001 From: codex Date: Sat, 31 Oct 2026 12:42:33 +0100 Subject: [PATCH] CCR-2026-0057 (proposed): NetKingdom synthetic journey identity custody syn-journey password and TOTP seed in platform custody, attended delivery into LLDAP and privacyIDEA by net-kingdom sso-mfa/k8s/synthetic-journey/lane.py (NK-WP-0056-T09). No workload reader. Co-Authored-By: Claude Opus 5.5 Assistant: claude-code Assistant-Model: opus Assistant-Process: 994874@bnt-lap001 Assistant-Session: 6017c416-d619-47eb-bd1a-f670a02d7d87 --- ...et-kingdom-synthetic-journey-identity.yaml | 99 +++++++++++++++++++ 1 file changed, 99 insertions(+) create mode 100644 credential-change-requests/CCR-2026-0057-net-kingdom-synthetic-journey-identity.yaml diff --git a/credential-change-requests/CCR-2026-0057-net-kingdom-synthetic-journey-identity.yaml b/credential-change-requests/CCR-2026-0057-net-kingdom-synthetic-journey-identity.yaml new file mode 100644 index 0000000..8e7028c --- /dev/null +++ b/credential-change-requests/CCR-2026-0057-net-kingdom-synthetic-journey-identity.yaml @@ -0,0 +1,99 @@ +id: CCR-2026-0057 +kind: credential-change-request +schema_version: 1 +request_type: attended-service-credential-delivery +title: NetKingdom synthetic journey identity (syn-journey) password and TOTP seed custody +status: proposed +created: '2026-10-31' +updated: '2026-10-31' +requester: + agent: claude-code + reason: 'NK-WP-0056-T09: a synthetic, unprivileged sign-in identity whose MFA journey through + KeyCape, Authelia and privacyIDEA replaces the founder''s sign-in as the check between + consumers in a bounded bind rotation (NK-WP-0056-T06). Its password and TOTP seed are + generated in memory and held only in OpenBao; LLDAP and privacyIDEA receive them through + one attended procedure. No workload reads them until the executor identity exists (T03/T10), + which needs its own request.' +review: + required: true + required_approvers: + - platform-owner + - net-kingdom-owner + comments: [] +target: + domain: infotech + tenant: platform + workload: net-kingdom-synthetic-journey + environment: production + purpose: Hold the password and TOTP seed of the LLDAP user syn-journey (no groups, no rights) + so that a synthetic journey can prove sign-in with MFA without a person. No other identity, + directory, privacyIDEA or service credential. +openbao: + mount: platform + kv_path: platform/workloads/net-kingdom/synthetic-journey/syn-journey + fields: + - PASSWORD + - TOTP_SEED + auth: + method: attended-oidc + mount: netkingdom + role: platform-admin + runtime_access: false + initial_cas: 0 +access_frontdoor: + type: attended-service-config + catalog_id: openbao-platform-admin-login + readiness: pending-review + resolvable: false +lifecycle: + deactivate: lane.py teardown deletes the privacyIDEA token SYNJOURNEY01, the LLDAP user + syn-journey (refused if it has gained any group) and the KV entry with all versions; + the KeyCape client nk-synthetic-journey is removed with keycape-client.py --operation + remove. The coding-agent fence stays. + rotate: Tear down and set up again (new password and seed, CAS=0 on the fresh path). + No in-place rotation path in this request. + compromised: Delete the privacyIDEA token first (the account then cannot pass MFA), + then tear down. The identity has no groups, so a leak grants a sign-in that reaches + no protected service. +delivery: + surface: attended-service-config + service: LLDAP (sso) user syn-journey; privacyIDEA (mfa) TOTP token SYNJOURNEY01 in realm + coulomb + target: the LLDAP user's password (set with the pinned lldap_set_password, OPAQUE) and the + privacyIDEA token's OTP key (stored encrypted in the privacyIDEA database) + procedure: net-kingdom sso-mfa/k8s/synthetic-journey/lane.py setup + gate: attended platform-admin (aal2) OpenBao session, the human admin's LLDAP password, the + attended pi-admin password, and a passing synthetic journey (lane.py verify) against + the live issuer +risk: + classification: medium + notes: + - 'The identity is new and holds no group. Authelia admits it (it is not svc-* or ld-admin), + KeyCape issues it tokens, but no consuming service grants it anything. KeyCape has no + per-client group gate, so every client that admits any authenticated user would admit it + too; none of the registered clients grants rights without a group.' + - KeyCape marks its tokens principal_type human (key-cape token.go); the account is + declared SERVICE in the service-identity declarations. Recorded, not changed here. + - Values are generated in memory by lane.py and written CAS=0; neither is printed, + logged or written to disk. The journey's receipts are value-free. + - Coding agents are fenced from the data and metadata paths in agent-high-risk-boundary + before the first write. + - No workload, Kubernetes or ESO reader exists; T10 needs a separate workload-kv-read request + for the executor identity. +verification: + positive: + - The KV password signs in to LLDAP as syn-journey (compared without display) + - The synthetic journey passes against https://kc.coulomb.social at aal2 with the KV + values (lane.py verify), with a value-free receipt + negative: + - Coding-agent boundary denies data and metadata of the path + - No auth role or policy grants the path to a workload + - setup refuses if the KV path, the LLDAP user or the privacyIDEA token already exist + activation_conditions: + - Explicit platform-owner and net-kingdom-owner approval of this exact request (sha256-bound + by lane.py). + - The KeyCape client nk-synthetic-journey registered through security-cases/nk-synthetic-journey.yaml + before lane.py verify. + - Attended platform-admin (aal2) session; the founder runs setup and verify. + - Positive and negative results recorded in value-free receipts. + evidence: []