From 22651d851f071b92ab316f82eca8aef949f5aba1 Mon Sep 17 00:00:00 2001 From: codex Date: Wed, 7 Oct 2026 15:12:35 +0200 Subject: [PATCH] Record the callback-amendment re-applies of CCR-2026-0004/0019/0034 (decision 73fff3d3) --- ...26-0004-railiance-backup-offsite-lane.yaml | 57 ++++++++++++------- ...9-secrets-engine-approval-client-read.yaml | 17 ++++-- credential-change-requests/CCR-2026-0034.yaml | 15 ++++- 3 files changed, 61 insertions(+), 28 deletions(-) diff --git a/credential-change-requests/CCR-2026-0004-railiance-backup-offsite-lane.yaml b/credential-change-requests/CCR-2026-0004-railiance-backup-offsite-lane.yaml index cdc0a01..68da1a1 100644 --- a/credential-change-requests/CCR-2026-0004-railiance-backup-offsite-lane.yaml +++ b/credential-change-requests/CCR-2026-0004-railiance-backup-offsite-lane.yaml @@ -5,7 +5,7 @@ request_type: workload-kv-read title: Railiance offsite backup lane (Nextcloud WebDAV + age recovery) status: active created: '2026-07-07' -updated: '2026-09-05' +updated: '2026-10-07' requester: agent: grok reason: Move railiance-backup / forgejo-backup credentials from hardcoded script @@ -23,9 +23,9 @@ review: - at: '2026-10-07' reviewer: platform-operator (founder Bernd Worsch) decision: approved - comment: Founder decision 73fff3d3-49fd-4535-9040-b2754a3e2024 approves removing the retired bao.coulomb.social - OIDC callback from allowed_redirect_uris and one delegated re-apply. Nothing else - changes. + comment: Founder decision 73fff3d3-49fd-4535-9040-b2754a3e2024 approves removing + the retired bao.coulomb.social OIDC callback from allowed_redirect_uris and + one delegated re-apply. Nothing else changes. target: domain: financials tenant: railiance @@ -77,13 +77,13 @@ risk: classification: high notes: - NC_WEBDAV_TOKEN grants upload to the offsite backup file drop. - - Since 2026-09-05 the file drop belongs to Backup, folder /railiance-backups, - with create-only permissions and a server-enforced 10 GiB account quota. - - Operator credentials remain in KVv2 operators/nextcloud/backup, fields - BACKUP_USERNAME and BACKUP_PASSWORD; never deliver them to production. - - Existing Bernd-owned retained backups and recovery access remain separate; - predecessor file-drop unshared 2026-09-15 by operator attestation; age-key - exposure remains open. + - Since 2026-09-05 the file drop belongs to Backup, folder /railiance-backups, with + create-only permissions and a server-enforced 10 GiB account quota. + - Operator credentials remain in KVv2 operators/nextcloud/backup, fields BACKUP_USERNAME + and BACKUP_PASSWORD; never deliver them to production. + - Existing Bernd-owned retained backups and recovery access remain separate; predecessor + file-drop unshared 2026-09-15 by operator attestation; age-key exposure remains + open. - "AGE_PRIVATE_KEY decrypts all age-encrypted backup artifacts \u2014 recovery escrow\ \ only." - Credentials must not be stored on production hosts with delete permission. @@ -122,13 +122,20 @@ verification: kind: capabilities_safe_verify result: passed details: - - 'WP-0026 T07: capabilities-safe re-verify on bao.coulomb.social (no secret values read).' - - 'Positive: token with policy workload-kv-read-railiance-backup-offsite-lane → capabilities read on platform/data/workloads/railiance/backup/offsite-lane.' - - 'Negative: default-policy token → deny on the same data path; token revoked after check.' - - 'Agent boundary: policy agent-high-risk-boundary → deny on data path, read on metadata path.' - - 'Field presence via JSON key inventory only (NC_WEBDAV_TOKEN, NC_WEBDAV_URL, AGE_PRIVATE_KEY); lengths recorded, values not printed.' - - 'EXPOSED taint set: custom_metadata exposed_at=2026-07-16T00:00:00Z exposed_version=2 (WP-0026 T05).' - - 'ops-warden catalog promoted draft→active; fetch_command pinned to NC_WEBDAV_TOKEN; resolvable=true; risk=high.' + - 'WP-0026 T07: capabilities-safe re-verify on bao.coulomb.social (no secret values + read).' + - "Positive: token with policy workload-kv-read-railiance-backup-offsite-lane\ + \ \u2192 capabilities read on platform/data/workloads/railiance/backup/offsite-lane." + - "Negative: default-policy token \u2192 deny on the same data path; token revoked\ + \ after check." + - "Agent boundary: policy agent-high-risk-boundary \u2192 deny on data path, read\ + \ on metadata path." + - Field presence via JSON key inventory only (NC_WEBDAV_TOKEN, NC_WEBDAV_URL, + AGE_PRIVATE_KEY); lengths recorded, values not printed. + - 'EXPOSED taint set: custom_metadata exposed_at=2026-07-16T00:00:00Z exposed_version=2 + (WP-0026 T05).' + - "ops-warden catalog promoted draft\u2192active; fetch_command pinned to NC_WEBDAV_TOKEN;\ + \ resolvable=true; risk=high." - at: '2026-09-05' actor: codex kind: dedicated_backup_account_cutover @@ -136,8 +143,8 @@ verification: details: - User authorized dedicated Backup account and operator custody coordinates. - Verified 10737418240-byte quota and Backup-owned create-only share. - - Encrypted fixture PUT 201, owner download and escrow decryption passed; - runtime GET and DELETE returned 405 on the actual upload endpoint. + - Encrypted fixture PUT 201, owner download and escrow decryption passed; runtime + GET and DELETE returned 405 on the actual upload endpoint. - CAS advanced workload KV version 2 to 3, preserving age escrow and other fields. - Evidence docs/evidence/RPF-WP-0029-backup-account-2026-09-05.json. - at: '2026-09-15' @@ -149,7 +156,15 @@ verification: - No predecessor value, fingerprint, length or shape was recorded. - HTTP 401/403 probe not run; predecessor must not be reconstructed. - Evidence docs/evidence/2026-09-15-rpf-wp-0029-predecessor-share-invalidated.json. - + - at: '2026-10-07T13:10:39+00:00' + actor: founder + kind: delegated_metadata_apply + result: passed + details: + - Delegated metadata applier ran as founder using local bao CLI ambient authority. + - 'Policy metadata write: sys/policies/acl/workload-kv-read-railiance-backup-offsite-lane' + - 'Auth role metadata write: auth/netkingdom/role/railiance-backup-workload-kv-read' + - No secret values were read, written, printed, or accepted in argv. lifecycle: deactivate: Disable ops-warden catalog entry and detach OIDC role policy; rotate Nextcloud file-drop token at provider. diff --git a/credential-change-requests/CCR-2026-0019-secrets-engine-approval-client-read.yaml b/credential-change-requests/CCR-2026-0019-secrets-engine-approval-client-read.yaml index 42e5e8d..0bef3f0 100644 --- a/credential-change-requests/CCR-2026-0019-secrets-engine-approval-client-read.yaml +++ b/credential-change-requests/CCR-2026-0019-secrets-engine-approval-client-read.yaml @@ -5,7 +5,7 @@ request_type: workload-kv-read title: secrets-engine client-side read of its approval client secret status: applied created: '2026-09-09' -updated: '2026-09-13' +updated: '2026-10-07' requester: agent: claude reason: RPF-WP-0035-T06 residual from the completed verifier custody (CCR-2026-0017). @@ -58,9 +58,9 @@ review: - at: '2026-10-07' reviewer: platform-operator, secrets-engine-owner (founder Bernd Worsch) decision: approved - comment: Founder decision 73fff3d3-49fd-4535-9040-b2754a3e2024 approves removing the retired bao.coulomb.social - OIDC callback from allowed_redirect_uris and one delegated re-apply. Nothing else - changes. + comment: Founder decision 73fff3d3-49fd-4535-9040-b2754a3e2024 approves removing + the retired bao.coulomb.social OIDC callback from allowed_redirect_uris and + one delegated re-apply. Nothing else changes. target: domain: financials tenant: platform @@ -162,6 +162,15 @@ verification: - 'Policy metadata write: sys/policies/acl/workload-kv-read-secrets-engine-approval-client' - 'Auth role metadata write: auth/netkingdom/role/secrets-engine-approval-client-workload-kv-read' - No secret values were read, written, printed, or accepted in argv. + - at: '2026-10-07T13:10:43+00:00' + actor: founder + kind: delegated_metadata_apply + result: passed + details: + - Delegated metadata applier ran as founder using local bao CLI ambient authority. + - 'Policy metadata write: sys/policies/acl/workload-kv-read-secrets-engine-approval-client' + - 'Auth role metadata write: auth/netkingdom/role/secrets-engine-approval-client-workload-kv-read' + - No secret values were read, written, printed, or accepted in argv. lifecycle: deactivate: Detach the policy from role secrets-engine-approval-client-workload-kv-read and disable the ops-warden catalog entry. The KeyCape verifier lane and its delivery diff --git a/credential-change-requests/CCR-2026-0034.yaml b/credential-change-requests/CCR-2026-0034.yaml index 548dc72..f20d722 100644 --- a/credential-change-requests/CCR-2026-0034.yaml +++ b/credential-change-requests/CCR-2026-0034.yaml @@ -53,9 +53,9 @@ review: - at: '2026-10-07' reviewer: platform-owner, key-cape-owner, net-kingdom-owner (founder Bernd Worsch) decision: approved - comment: Founder decision 73fff3d3-49fd-4535-9040-b2754a3e2024 approves removing the retired bao.coulomb.social - OIDC callback from allowed_redirect_uris and one delegated re-apply. Nothing else - changes. + comment: Founder decision 73fff3d3-49fd-4535-9040-b2754a3e2024 approves removing + the retired bao.coulomb.social OIDC callback from allowed_redirect_uris and + one delegated re-apply. Nothing else changes. target: domain: infotech tenant: platform @@ -155,6 +155,15 @@ verification: - 'Policy metadata write: sys/policies/acl/workload-kv-read-keycape-secrets-engine-openbao-operator' - 'Auth role metadata write: auth/netkingdom/role/keycape-secrets-engine-openbao-operator-workload-kv-read' - No secret values were read, written, printed, or accepted in argv. + - at: '2026-10-07T13:10:47+00:00' + actor: founder + kind: delegated_metadata_apply + result: passed + details: + - Delegated metadata applier ran as founder using local bao CLI ambient authority. + - 'Policy metadata write: sys/policies/acl/workload-kv-read-keycape-secrets-engine-openbao-operator' + - 'Auth role metadata write: auth/netkingdom/role/keycape-secrets-engine-openbao-operator-workload-kv-read' + - No secret values were read, written, printed, or accepted in argv. lifecycle: deactivate: Delete the OIDC role first, then the policy; value-free receipt. rotate: Not applicable to the reader; the value rotates through the CCR-2026-0033