From 2951b69fc5bee8a748165a56d1a73d17abc40cb7 Mon Sep 17 00:00:00 2001 From: codex Date: Thu, 15 Oct 2026 05:09:43 +0200 Subject: [PATCH] Record verified seven-source reader custody and rotation deadline Assistant: codex Assistant-Model: gpt-6.1-sol Assistant-Session: 01a137ca-5c77-7a71-b9ae-23ad9b0b5684 --- ...046-reuse-surface-forgejo-source-read.yaml | 4 +- ...10-15-reuse-private-reader-custody-r1.json | 36 +++++++++++++++ ...RPF-WP-0058-reuse-private-source-reader.md | 46 ++++++++++++------- 3 files changed, 67 insertions(+), 19 deletions(-) create mode 100644 docs/evidence/2026-10-15-reuse-private-reader-custody-r1.json diff --git a/credential-change-requests/CCR-2026-0046-reuse-surface-forgejo-source-read.yaml b/credential-change-requests/CCR-2026-0046-reuse-surface-forgejo-source-read.yaml index 42078fe..4a5a4dc 100644 --- a/credential-change-requests/CCR-2026-0046-reuse-surface-forgejo-source-read.yaml +++ b/credential-change-requests/CCR-2026-0046-reuse-surface-forgejo-source-read.yaml @@ -3,7 +3,7 @@ kind: credential-change-request schema_version: 1 request_type: workload-kv-read title: Reuse Surface exact seven private-source repository reader -status: proposed +status: approved created: '2026-10-15' updated: '2026-10-15' requester: @@ -47,7 +47,7 @@ openbao: - reuse-surface-eso service_account_namespaces: - reuse - bound_claims_confirmed: false + bound_claims_confirmed: true policies: - workload-kv-read-reuse-surface-runtime-eso ttl: 15m diff --git a/docs/evidence/2026-10-15-reuse-private-reader-custody-r1.json b/docs/evidence/2026-10-15-reuse-private-reader-custody-r1.json new file mode 100644 index 0000000..c63e763 --- /dev/null +++ b/docs/evidence/2026-10-15-reuse-private-reader-custody-r1.json @@ -0,0 +1,36 @@ +{ + "id": "RPF-WP-0058-CUSTODY-VERIFICATION-R1", + "ccr_id": "CCR-2026-0046", + "decision_ref": "9833715e-a22a-45c0-ab6c-881f0f4f1a0e", + "decision_status": "resolved/made observed from primary State Hub", + "approval_receipt_sha256": "ce11b56faa51cb0912c6bdd228a10d0e5dec5a93f295410eaaf370399e7abd85", + "approved_executed_ccr_sha256": "23039fae6137e7bdd71de0ed3278596b1ed60ae636018eb4bfcc83e53c4ada02", + "policy_receipt_sha256": "01d417a09d547b88a792fbc00bcc1502f1235da2d666196632a71d7f1c11bdbd", + "policy_attempt": "93578ba93d6153fdb07c65db", + "policy_terminal_at": "2026-10-15T03:06:13.283133+00:00", + "policy_outcome": "policy_and_custody_verified_delivery_pending", + "bootstrap_receipt_sha256": "f5ddd86299cdf31ca895f76b84d7fc14d2ac791e5982632c5c989a32221a0171", + "bootstrap_attempt": "bb2693a7640f00b4e401467e", + "bootstrap_terminal_at": "2026-10-15T03:06:12.816932+00:00", + "bootstrap_outcome": "provisioned_verified_delivery_pending", + "forgejo_identity": "reuse-surface-source", + "forgejo_team_id": 5, + "forgejo_pat_id": 72, + "token_scope": "read:repository", + "repository_scope": "Exactly seven approved private repositories, complete grant preflight and seven pinned index hashes verified by bounded bootstrap.", + "custody_activation_at": "2026-10-15T03:06:09.579844+00:00", + "manual_rotation_due_at": "2027-01-13T03:06:09.579844+00:00", + "manual_rotation_due_date": "2027-01-13", + "maintenance_task": "RPF-WP-0058-T05", + "maintenance_task_uuid": "f0780e75-b0bd-5bf5-b926-c8413abb885c", + "expiry_enforced_automatically": false, + "warden_terminal_audit": { + "access_audit_at": "2026-10-15T03:06:13.494014+00:00", + "unified_audit_at": "2026-10-15T03:06:13.495110+00:00", + "outcome": "ok", + "exit_code": 0, + "meaning": "Installed owner envelope confirms silent child success, self-revocation and helper cleanup; no token/helper was read." + }, + "delivery_status": "pending_apps_phase_b_and_native_proof", + "no_reexecution_or_remint": true +} diff --git a/workplans/RPF-WP-0058-reuse-private-source-reader.md b/workplans/RPF-WP-0058-reuse-private-source-reader.md index cfd3809..cb6332c 100644 --- a/workplans/RPF-WP-0058-reuse-private-source-reader.md +++ b/workplans/RPF-WP-0058-reuse-private-source-reader.md @@ -4,7 +4,7 @@ type: workplan title: Prepare the exact seven private-source reader for reuse-surface domain: financials repo: railiance-platform -status: proposed +status: active owner: codex topic_slug: platform created: '2026-10-15' @@ -34,14 +34,14 @@ state_hub_task_id: "f9b738e1-6d88-5dde-9fc5-b05b3adf2549" ``` Prepare CCR-2026-0046, exact seven-source bootstrap contract, silent bounded -provisioner, tests and exact ESO policy delta. No provisioner invocation against -live service, token read, policy apply, or cluster change has occurred. +provisioner, tests and exact ESO policy delta. Preparation itself performed no live action; the separately founder-attended +credential execution is now verified in T03 and its dated custody evidence. ## Independent owner review and founder disposition ```task id: RPF-WP-0058-T02 -status: wait +status: done priority: high state_hub_task_id: "41d16c6e-9e0b-543b-b600-9288d5762879" ``` @@ -50,9 +50,11 @@ Independent preparation reviews are recorded within their owner scopes: platform custody and attended-runner R3; Forge restricted-reader R2 and attended-runner R3; reuse consumer CCR boundary R2 and hardened native consumer; apps release contract R2. These approve preparation/integration, not live action. -Founder credential provisioning and rollout decisions remain pending and must -bind exact artifacts and actual installed-role proof. No approval is inferred -from metadata disclosure. CCR remains proposed and its claims unconfirmed. +Founder execution decision 9833715e-a22a-45c0-ab6c-881f0f4f1a0e is resolved; +the approved exact credential revision executed through the attended owner lane. +Installed-role proof preceded conditional state transition, and CCR is approved +with confirmed claims at the exact prebound SHA256 23039fae6137e7bdd71de0ed3278596b1ed60ae636018eb4bfcc83e53c4ada02. +This authority is separate from the earlier metadata disclosure consent. The published hardened image digest is sha256:2364b7e7859daccf9340a063654e2b09eed1bc27e0adf7b23cbb4b30135a7db0; actual deployment of that reviewed image plus the exact URL allowlist and native @@ -63,7 +65,7 @@ runtime cannot receive this credential. ```task id: RPF-WP-0058-T03 -status: wait +status: done priority: high state_hub_task_id: "58caf089-9af1-51fd-a94d-aba9abf14a53" ``` @@ -98,8 +100,10 @@ empty, duplicate IDs and supplied total-count consistency prevent silent short page acceptance. No live complete-grant proof is claimed by these mocks. -Attended execution preparation R3 is complete, while T03 stays `wait` because no -founder credential decision, login, installed-claim proof or live write has run. +Attended execution preparation R3 was followed by actual founder execution. +T03 is now done: policy attempt 93578ba93d6153fdb07c65db ended successfully +at 2026-10-15T03:06:13.283133Z; bootstrap attempt bb2693a7640f00b4e401467e +ended provisioned/verified with delivery pending at 03:06:12.816932Z. The quiet owner runner captures hash-verified policy bytes for stdin, preserves the existing ESO role, and verifies the actual immutable role/desired ACL before and after bootstrap, including idempotent runs. A conditional CCR candidate binds @@ -109,7 +113,11 @@ Independent Forge preparation review R3 approved the exact runner; its receipt SHA256 is e4a17ee59fb1691f7b99a09d2473178740721aad0c1394cae79b503118c97040. Forty-five targeted reader tests passed (17 attended-runner boundary cases). The handoff binds the owner-prepared task-local WSL opener and existing sanctioned -OpenBao/Forgejo routes. No secret value or live state has been acquired or changed. +OpenBao/Forgejo routes. Actual silent founder execution verified exact seven-source +reader scope, created PAT metadata ID72/team5, and stored the reader at its separate +KV path. Credentials stayed inside the reviewed process; no value was printed. +Warden audits at03:06:13Z report outcome ok/exit0, including session revocation +and helper cleanup. See docs/evidence/2026-10-15-reuse-private-reader-custody-r1.json. ## Rotate or revoke dedicated seven-source reader within 90 days @@ -129,12 +137,16 @@ OpenBao KV `platform/workloads/reuse/reuse-surface/forgejo-source-read`, field is a human-attended rotation/revocation obligation, not an expiry mechanism or scheduled automation. -The recorded date is provisional operational planning: 2027-01-13 is 90 days -after an assumed activation on 2026-10-15, and no activation has occurred. -Before delivering the credential, record the actual activation receipt/date, -reset this task's due date to that actual date plus 90 days, and retain the -owner/due-date binding in the activation receipt. If the actual deadline cannot -be bound, do not activate delivery. +The deadline is now bound to actual verified custody activation, not an assumed +date: 2026-10-15T03:06:09.579844+00:00. The manual deadline is exactly +2027-01-13T03:06:09.579844+00:00 (task due_date 2027-01-13), actual activation plus 90 days. +Activation proof is bootstrap attempt bb2693a7640f00b4e401467e, verified kv_create; +receipt SHA256 f5ddd86299cdf31ca895f76b84d7fc14d2ac791e5982632c5c989a32221a0171. +The owner/task binding is RPF-WP-0058-T05, UUID +f0780e75-b0bd-5bf5-b926-c8413abb885c, and is retained in the dated custody receipt. +Source and indexed task description must carry this actual date before delivery. +The structured Hub due_date cache remains a documented limitation; no automatic +reminder or server-side expiry is claimed. At maintenance time prepare a separately approved bounded rotation/CAS plan, including expected existing KV version, sibling preservation, exact dedicated