coulomb/railiance-platform
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Record founder approval of the MAS backup reader.
All checks were successful
CCR intake gate / gate (push) Successful in 3m13s
Details
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
CCR-2026-0062 is approved with the live delivery account confirmed.
The OpenBao policy is not installed and no provider key was created.

Assistant: grok
Assistant-Session: 01a198fa-fd27-7e41-a0a2-57355c3e4efd
This commit is contained in:
codex 2026-11-02 02:37:01 +01:00
parent a274938232
commit 0fb2305def
4 changed files with 184 additions and 34 deletions
Download patch file Download diff file Expand all files Collapse all files

47
docs/credential-lane-designs/mas-evidence-backup-grant-2026-11-02.md
View file

@ -1,9 +1,10 @@
# MAS evidence publisher grant — 2026-11-02
Prepared for RPF-WP-0070. CCR-2026-0062 is a **draft**. Its Kubernetes binding
is unconfirmed and its delivery admission is false. This packet creates no
provider identity, OpenBao policy, role, or value, ServiceAccount, node file,
offsite upload, or timer.
Prepared for RPF-WP-0070. The founder approved CCR-2026-0062 on 2026-11-02
as platform-owner and mas-owner. The Kubernetes binding is confirmed against
ServiceAccount `backup-primary-delivery` in namespace `mas`, which exists with
automount disabled. Delivery admission is still false. No provider identity,
OpenBao policy, role, or value, node file, offsite upload, or timer exists yet.
The accepted shape is the email-connect ledger reader, CCR-2026-0037. The MAS
prefix is `platform-pg/application-archives/mas/` in bucket
@ -13,14 +14,14 @@ local. It is not an offsite object.
| Item | Prepared value | Live state |
| --- | --- | --- |
| Reader request | CCR-2026-0062 | draft, not approved |
| Reader request | CCR-2026-0062 | approved; not applied |
| KV path | platform/workloads/mas/backup-primary | no value written |
| Fields | AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY | absent |
| Policy | workload-kv-read-mas-backup-primary | source only |
| Policy | workload-kv-read-mas-backup-primary | source only; install is silent and attended |
| Role | mas-backup-primary-workload-kv-read | not created |
| ServiceAccount | backup-primary-delivery in namespace mas | source list only; automount false; no RoleBinding |
| ServiceAccount | backup-primary-delivery in namespace mas | live, automount false, uid c0e5867b-b4be-49b7-94db-6aae0a6e566e; no RoleBinding |
| Node file | /etc/mas-backup/primary.env, root:root 0600, directory 0700 | not created |
| Provider identity | proposed application mas-evidence-backup-primary | not created |
| Provider identity | proposed application mas-evidence-backup-primary | not created; this workstation has no Scaleway credential |
Do not reuse the email-connect publisher or its node file. Object-storage IAM
is not prefix-scoped inside a project, so a later admission needs its own IAM
@ -30,19 +31,23 @@ and is not created here.
## Still required before any offsite copy
1. Founder reviews as platform-owner and mas-owner, with the namespace,
ServiceAccount, and audience confirmed.
2. Create the separate IAM application and prove the prefix boundary, including
denial of sibling prefixes, retained delete, and IAM or bucket administration.
3. Apply the policy and role through the delegated metadata applier. Ops-mason
remains survey-only.
4. Provision the pair atomically with KV CAS=0 under an explicit platform
custody act. The single-field paste desk is unsuitable. Pair-custody and
slot-preparation lists stay closed to coulomb-social and email-connect until
that act.
5. Record positive reader proof and negative denials, then set delivery
admission. Export the admitted CCR and pin its SHA256 before creating the
node file.
1. Founder review is recorded: platform-owner and mas-owner, source
`founder-approval-2026-11-02`. The live account matches the binding.
2. Apply the policy and role with the attended platform-admin login:
`BAO_ADDR=http://127.0.0.1:18200 VAULT_ADDR=http://127.0.0.1:18200 warden access openbao-platform-admin-login --exec -- /home/worsch/railiance-platform/scripts/install-mas-backup-primary-reader.sh`
Sign in as platform-root. The helper is silent and writes only a receipt.
3. In the Scaleway console, create a new IAM application named
`mas-evidence-backup-primary`. Do not add a key to email-connect or to a
broad application. Then say that the application exists. This workstation
has no Scaleway credential, so it cannot create the application or its key.
4. Add three bucket-policy statements for that application, limited to
`platform-pg/application-archives/mas/`, with no object delete. Prove sibling
denial, retained-delete denial, and no IAM or bucket administration.
5. Provision the pair atomically with KV CAS=0 under the pair-writer policy
extended to this one path. The single-field paste desk is unsuitable.
6. Record positive reader proof and negative denials, then set delivery
admission. Export the admitted CCR and pin its SHA256 before creating
`/etc/mas-backup/primary.env`.
Age-identity escrow is a separate custody act. This grant does not move the
workstation private key, and the node must not hold it. TEM and SMTP