From 2a338f06b9ab02d7dfc2af6b504ae3e0930f3361 Mon Sep 17 00:00:00 2001 From: codex Date: Thu, 8 Oct 2026 21:28:23 +0200 Subject: [PATCH] Record the draft backup reader contracts the pair preview checks. Both CCRs stay draft and contain field names only. No provider key is included. Assistant: grok Assistant-Session: 01a11cdb-f9fe-7011-947c-936e72007e54 --- ...26-0036-coulomb-social-backup-primary.yaml | 136 ++++++++++++++++++ ...026-0037-email-connect-backup-primary.yaml | 136 ++++++++++++++++++ 2 files changed, 272 insertions(+) create mode 100644 credential-change-requests/CCR-2026-0036-coulomb-social-backup-primary.yaml create mode 100644 credential-change-requests/CCR-2026-0037-email-connect-backup-primary.yaml diff --git a/credential-change-requests/CCR-2026-0036-coulomb-social-backup-primary.yaml b/credential-change-requests/CCR-2026-0036-coulomb-social-backup-primary.yaml new file mode 100644 index 0000000..80e869b --- /dev/null +++ b/credential-change-requests/CCR-2026-0036-coulomb-social-backup-primary.yaml @@ -0,0 +1,136 @@ +{ + "id": "CCR-2026-0036", + "kind": "credential-change-request", + "schema_version": 1, + "request_type": "workload-kv-read", + "title": "coulomb-social primary archive node-delivery reader", + "status": "draft", + "created": "2026-10-08", + "updated": "2026-10-08", + "requester": { + "agent": "codex", + "reason": "User asked to arrange platform credential delivery; preparation under RPF-WP-0053, no live grant inferred." + }, + "review": { + "required": true, + "required_approvers": [ + "platform-owner", + "coulomb-social-owner" + ], + "comments": [] + }, + "target": { + "domain": "communication", + "tenant": "platform", + "workload": "coulomb-social", + "environment": "production", + "purpose": "Read this application backup publisher key pair into the admitted node delivery process; no other workload credential or escrow." + }, + "openbao": { + "mount": "platform", + "kv_path": "platform/workloads/coulomb-social/backup-primary", + "fields": [ + "AWS_ACCESS_KEY_ID", + "AWS_SECRET_ACCESS_KEY" + ], + "policy_name": "workload-kv-read-coulomb-social-backup-primary", + "policy_file": "openbao/policies/workload-kv-read-coulomb-social-backup-primary.hcl", + "metadata_read": false, + "token_self_lifecycle": true, + "auth": { + "method": "kubernetes", + "mount": "kubernetes", + "role": "coulomb-social-backup-primary-workload-kv-read", + "audience": "openbao", + "ttl": "5m", + "token_max_ttl": "5m", + "token_explicit_max_ttl": "5m", + "token_no_default_policy": true, + "token_num_uses": 4, + "token_type": "service", + "policies": [ + "workload-kv-read-coulomb-social-backup-primary" + ], + "bound_claims": { + "service_account_names": [ + "backup-primary-delivery" + ], + "service_account_namespaces": [ + "coulomb-social" + ] + }, + "bound_claims_confirmed": false + } + }, + "access_frontdoor": { + "type": "platform-owner", + "catalog_id": "coulomb-social-backup-primary-delivery", + "readiness": "pending-review", + "resolvable": false + }, + "delivery": { + "surface": "node-private-file", + "host": "railiance01", + "cluster_uid": "a553c742-0115-43d4-99a4-a5ca56fe0786", + "target": "/etc/coulomb-social-backup/primary.env", + "owner": "root:root", + "mode": "0600", + "directory_mode": "0700", + "procedure": "scripts/application_backup_credentials.py", + "admission": { + "node_executor_approved": false, + "provider_scope_verified": false, + "reader_boundary_verified": false, + "source_ref": null + } + }, + "provider": { + "endpoint": "https://s3.nl-ams.scw.cloud", + "bucket": "railiance-platform-pg-backup", + "prefix": "platform-pg/application-archives/coulomb-social/", + "identity": "separate IAM application and key; provider identity not created", + "retained_delete": false + }, + "risk": { + "classification": "high", + "notes": [ + "Admitted node root may request the dedicated ServiceAccount JWT; no RBAC grant or mounted token for this account. Namespace writers and node administrators are inside this credential boundary.", + "TokenRequest JWT and five-minute, four-use OpenBao token stay in process memory; only the provider pair is delivered at rest.", + "No worker receives IAM/bucket administration, native Barman access, sibling archive access or decryption identity.", + "Policy/role construction does not seed values or activate capture, timers, retention, deletion or a production restore." + ] + }, + "verification": { + "positive": [ + "Exact namespace/ServiceAccount/audience authenticates with this one policy, no default/identity policy, five-minute maximum TTL and four-use bound.", + "One own-path KV read followed by self-revocation yields only these two fields at a positive pinned KV version.", + "Node delivery produces root-owned 0600 file in 0700 directory; contained readback equality and metadata-only receipt; no secrets in outputs/argv.", + "Provider caller conditional multipart publication and version-pinned readback within exact archive prefix work." + ], + "negative": [ + "Wrong namespace, ServiceAccount and audience cannot log in.", + "Sibling application data GET, parent LIST, metadata GET, any KV write and platform admin endpoints are denied.", + "Provider denies sibling/native prefixes, retained object/version deletion and IAM/bucket administration.", + "Draft/unconfirmed/source-changed contract, wrong cluster, symlinks, hard links, insecure modes, changed KV version, unconfirmed token revocation and different existing file refuse delivery." + ], + "activation_conditions": [ + "Named owner reviews and confirmed native reader bindings, applied policy/role with live positive/negative evidence, provider prefix boundary proof and explicit node execution admission.", + "Separate platform-owned attended pair provision with initial KV CAS=0, no partial/second single-field PUT; retain only version metadata. Current reader does not create or rotate values.", + "Pin the final reviewed CCR SHA256 and expected KV version; initialise designated root directory only after admission. Initial delivery may resume identical bytes but cannot rotate.", + "Independent age escrow and metadata receipt custody, retention/lifecycle/capacity, first capture/recovery and timer activation remain separate RPF-WP-0053 gates." + ] + }, + "lifecycle": { + "deactivate": "Owner detaches this Kubernetes role first, revokes tokens, and removes only admitted local delivery through an explicit withdrawal record. Do not delete retained archives.", + "rotate": "Separate owner-approved CAS rotation and atomic host replacement contract required. This helper refuses different existing bytes; retain old provider identity until new publication/recovery acceptance, then revoke predecessor at provider.", + "compromised": "Fence this worker and disable its provider identity first. Owner revokes reader tokens, withdraws reader, rotates pair and reviews retained-object access under incident authority; no automated archive deletion." + }, + "state_hub": { + "workplan_id": "RPF-WP-0053", + "task_id": "RPF-WP-0053-T02" + }, + "related": { + "consumer_workplan": "CSOC-WP-0008", + "design": "docs/credential-lane-designs/application-backup-delivery-2026-10-08.md" + } +} diff --git a/credential-change-requests/CCR-2026-0037-email-connect-backup-primary.yaml b/credential-change-requests/CCR-2026-0037-email-connect-backup-primary.yaml new file mode 100644 index 0000000..f40a54a --- /dev/null +++ b/credential-change-requests/CCR-2026-0037-email-connect-backup-primary.yaml @@ -0,0 +1,136 @@ +{ + "id": "CCR-2026-0037", + "kind": "credential-change-request", + "schema_version": 1, + "request_type": "workload-kv-read", + "title": "email-connect primary archive node-delivery reader", + "status": "draft", + "created": "2026-10-08", + "updated": "2026-10-08", + "requester": { + "agent": "codex", + "reason": "User asked to arrange platform credential delivery; preparation under RPF-WP-0053, no live grant inferred." + }, + "review": { + "required": true, + "required_approvers": [ + "platform-owner", + "email-connect-owner" + ], + "comments": [] + }, + "target": { + "domain": "communication", + "tenant": "platform", + "workload": "email-connect", + "environment": "production", + "purpose": "Read this application backup publisher key pair into the admitted node delivery process; no other workload credential or escrow." + }, + "openbao": { + "mount": "platform", + "kv_path": "platform/workloads/email-connect/backup-primary", + "fields": [ + "AWS_ACCESS_KEY_ID", + "AWS_SECRET_ACCESS_KEY" + ], + "policy_name": "workload-kv-read-email-connect-backup-primary", + "policy_file": "openbao/policies/workload-kv-read-email-connect-backup-primary.hcl", + "metadata_read": false, + "token_self_lifecycle": true, + "auth": { + "method": "kubernetes", + "mount": "kubernetes", + "role": "email-connect-backup-primary-workload-kv-read", + "audience": "openbao", + "ttl": "5m", + "token_max_ttl": "5m", + "token_explicit_max_ttl": "5m", + "token_no_default_policy": true, + "token_num_uses": 4, + "token_type": "service", + "policies": [ + "workload-kv-read-email-connect-backup-primary" + ], + "bound_claims": { + "service_account_names": [ + "backup-primary-delivery" + ], + "service_account_namespaces": [ + "email-connect" + ] + }, + "bound_claims_confirmed": false + } + }, + "access_frontdoor": { + "type": "platform-owner", + "catalog_id": "email-connect-backup-primary-delivery", + "readiness": "pending-review", + "resolvable": false + }, + "delivery": { + "surface": "node-private-file", + "host": "railiance01", + "cluster_uid": "a553c742-0115-43d4-99a4-a5ca56fe0786", + "target": "/etc/email-connect-backup/primary.env", + "owner": "root:root", + "mode": "0600", + "directory_mode": "0700", + "procedure": "scripts/application_backup_credentials.py", + "admission": { + "node_executor_approved": false, + "provider_scope_verified": false, + "reader_boundary_verified": false, + "source_ref": null + } + }, + "provider": { + "endpoint": "https://s3.nl-ams.scw.cloud", + "bucket": "railiance-platform-pg-backup", + "prefix": "platform-pg/application-archives/email-connect/", + "identity": "separate IAM application and key; provider identity not created", + "retained_delete": false + }, + "risk": { + "classification": "high", + "notes": [ + "Admitted node root may request the dedicated ServiceAccount JWT; no RBAC grant or mounted token for this account. Namespace writers and node administrators are inside this credential boundary.", + "TokenRequest JWT and five-minute, four-use OpenBao token stay in process memory; only the provider pair is delivered at rest.", + "No worker receives IAM/bucket administration, native Barman access, sibling archive access or decryption identity.", + "Policy/role construction does not seed values or activate capture, timers, retention, deletion or a production restore." + ] + }, + "verification": { + "positive": [ + "Exact namespace/ServiceAccount/audience authenticates with this one policy, no default/identity policy, five-minute maximum TTL and four-use bound.", + "One own-path KV read followed by self-revocation yields only these two fields at a positive pinned KV version.", + "Node delivery produces root-owned 0600 file in 0700 directory; contained readback equality and metadata-only receipt; no secrets in outputs/argv.", + "Provider caller conditional multipart publication and version-pinned readback within exact archive prefix work." + ], + "negative": [ + "Wrong namespace, ServiceAccount and audience cannot log in.", + "Sibling application data GET, parent LIST, metadata GET, any KV write and platform admin endpoints are denied.", + "Provider denies sibling/native prefixes, retained object/version deletion and IAM/bucket administration.", + "Draft/unconfirmed/source-changed contract, wrong cluster, symlinks, hard links, insecure modes, changed KV version, unconfirmed token revocation and different existing file refuse delivery." + ], + "activation_conditions": [ + "Named owner reviews and confirmed native reader bindings, applied policy/role with live positive/negative evidence, provider prefix boundary proof and explicit node execution admission.", + "Separate platform-owned attended pair provision with initial KV CAS=0, no partial/second single-field PUT; retain only version metadata. Current reader does not create or rotate values.", + "Pin the final reviewed CCR SHA256 and expected KV version; initialise designated root directory only after admission. Initial delivery may resume identical bytes but cannot rotate.", + "Independent age escrow and metadata receipt custody, retention/lifecycle/capacity, first capture/recovery and timer activation remain separate RPF-WP-0053 gates." + ] + }, + "lifecycle": { + "deactivate": "Owner detaches this Kubernetes role first, revokes tokens, and removes only admitted local delivery through an explicit withdrawal record. Do not delete retained archives.", + "rotate": "Separate owner-approved CAS rotation and atomic host replacement contract required. This helper refuses different existing bytes; retain old provider identity until new publication/recovery acceptance, then revoke predecessor at provider.", + "compromised": "Fence this worker and disable its provider identity first. Owner revokes reader tokens, withdraws reader, rotates pair and reviews retained-object access under incident authority; no automated archive deletion." + }, + "state_hub": { + "workplan_id": "RPF-WP-0053", + "task_id": "RPF-WP-0053-T05" + }, + "related": { + "consumer_workplan": "EMAIL-WP-0007", + "design": "docs/credential-lane-designs/application-backup-delivery-2026-10-08.md" + } +}