diff --git a/credential-change-requests/CCR-2026-0062-mas-backup-primary.yaml b/credential-change-requests/CCR-2026-0062-mas-backup-primary.yaml index 9bac3f1..44974ed 100644 --- a/credential-change-requests/CCR-2026-0062-mas-backup-primary.yaml +++ b/credential-change-requests/CCR-2026-0062-mas-backup-primary.yaml @@ -4,7 +4,7 @@ "schema_version": 1, "request_type": "workload-kv-read", "title": "MAS evidence archive node-delivery reader", - "status": "approved", + "status": "applied", "created": "2026-11-02", "updated": "2026-11-02", "requester": { @@ -80,7 +80,7 @@ "access_frontdoor": { "type": "platform-owner", "catalog_id": "mas-backup-primary-delivery", - "readiness": "approved-pending-apply", + "readiness": "applied-pending-verify", "resolvable": false }, "delivery": { @@ -128,7 +128,18 @@ "The provider denies sibling and native prefixes, retained object or version deletion, and IAM or bucket administration.", "Draft, unconfirmed, or source-changed contracts, the wrong cluster, symlinks, hard links, insecure modes, a changed KV version, unconfirmed token revocation, and a different existing file refuse delivery." ], - "evidence": [], + "evidence": [ + { + "at": "2026-11-02T09:02:50Z", + "actor": "grok", + "kind": "metadata_apply", + "result": "passed", + "details": [ + "Attended platform-admin login ran scripts/install-mas-backup-primary-reader.sh. The local receipt status is installed and the stage file is empty.", + "Readback bound backup-primary-delivery in namespace mas, one policy workload-kv-read-mas-backup-primary, role mas-backup-primary-workload-kv-read, ttl 300, token_max_ttl 300, token_explicit_max_ttl 300, token_num_uses 4, token_no_default_policy true, token_type service." + ] + } + ], "activation_conditions": [ "Platform-owner and mas-owner reviews, confirmed native reader bindings, and an applied policy and role with live positive and negative evidence.", "A separate IAM application limited to platform-pg/application-archives/mas/, with a bucket policy that denies sibling prefixes. Project-wide object-storage IAM is not a prefix grant. An independent mirror project remains a founder choice and is not created by this draft.", diff --git a/docs/credential-lane-designs/mas-evidence-backup-grant-2026-11-02.md b/docs/credential-lane-designs/mas-evidence-backup-grant-2026-11-02.md index 2cefff9..a1ff30a 100644 --- a/docs/credential-lane-designs/mas-evidence-backup-grant-2026-11-02.md +++ b/docs/credential-lane-designs/mas-evidence-backup-grant-2026-11-02.md @@ -3,8 +3,9 @@ Prepared for RPF-WP-0070. The founder approved CCR-2026-0062 on 2026-11-02 as platform-owner and mas-owner. The Kubernetes binding is confirmed against ServiceAccount `backup-primary-delivery` in namespace `mas`, which exists with -automount disabled. Delivery admission is still false. No provider identity, -OpenBao policy, role, or value, node file, offsite upload, or timer exists yet. +automount disabled. Delivery admission is still false. The OpenBao policy +and role were installed at 2026-11-02T09:02:50Z. No provider identity, value, +node file, offsite upload, or timer exists yet. The accepted shape is the email-connect ledger reader, CCR-2026-0037. The MAS prefix is `platform-pg/application-archives/mas/` in bucket @@ -14,11 +15,11 @@ local. It is not an offsite object. | Item | Prepared value | Live state | | --- | --- | --- | -| Reader request | CCR-2026-0062 | approved; not applied | +| Reader request | CCR-2026-0062 | applied; delivery admission false | | KV path | platform/workloads/mas/backup-primary | no value written | | Fields | AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY | absent | -| Policy | workload-kv-read-mas-backup-primary | source only; install is silent and attended | -| Role | mas-backup-primary-workload-kv-read | not created | +| Policy | workload-kv-read-mas-backup-primary | installed; receipt status installed | +| Role | mas-backup-primary-workload-kv-read | installed for backup-primary-delivery in namespace mas | | ServiceAccount | backup-primary-delivery in namespace mas | live, automount false, uid c0e5867b-b4be-49b7-94db-6aae0a6e566e; no RoleBinding | | Node file | /etc/mas-backup/primary.env, root:root 0600, directory 0700 | not created | | Provider identity | proposed application mas-evidence-backup-primary | not created; this workstation has no Scaleway credential | @@ -33,10 +34,9 @@ and is not created here. 1. Founder review is recorded: platform-owner and mas-owner, source `founder-approval-2026-11-02`. The live account matches the binding. -2. Apply the policy and role with the attended platform-admin login: - `python3 scripts/openbao-attended-exec.py -- /home/worsch/railiance-platform/scripts/install-mas-backup-primary-reader.sh` - The window is a new empty Playwright Chromium profile. Sign in as - platform-root. The helper is silent and writes only a receipt. +2. The policy and role are installed. The attended command finished at + 2026-11-02T09:02:50Z and wrote a metadata receipt. Delivery admission + stays false. 3. In the Scaleway console, create a new IAM application named `mas-evidence-backup-primary`. Do not add a key to email-connect or to a broad application. Then say that the application exists. This workstation diff --git a/workplans/RPF-WP-0070-mas-evidence-recovery.md b/workplans/RPF-WP-0070-mas-evidence-recovery.md index 017821e..1b75d46 100644 --- a/workplans/RPF-WP-0070-mas-evidence-recovery.md +++ b/workplans/RPF-WP-0070-mas-evidence-recovery.md @@ -40,7 +40,7 @@ status: progress priority: medium needs_human: true depends_on: [RPF-WP-0053-T05] -intervention_note: "Founder approved CCR-2026-0062. The delivery account exists. OpenBao policy/role install still needs the attended platform-admin login in the empty Playwright Chromium profile. The IAM application is not created. Age-identity escrow remains separate." +intervention_note: "CCR-2026-0062 is applied. The OpenBao policy and role were installed at 2026-11-02T09:02:50Z. Delivery admission stays false. The next founder act is to create IAM application mas-evidence-backup-primary in the Scaleway console. Age-identity escrow remains separate." state_hub_task_id: "4f6484fb-8303-5dd5-94cb-b2622e1322c8" ``` @@ -65,10 +65,9 @@ The profile is accepted by `scripts/primary_application_archive.py`. mas-owner. ServiceAccount `backup-primary-delivery` now exists in namespace `mas` with automount disabled and no RoleBinding. The binding is confirmed. Delivery admission stays false. The OpenBao policy and -role are not installed: the local token is denied, so the install waits -for `warden access openbao-platform-admin-login --exec` running -`scripts/install-mas-backup-primary-reader.sh`. No Scaleway credential -is configured here, so IAM application `mas-evidence-backup-primary` -is not created. The KV pair and `/etc/mas-backup/primary.env` do not -exist. Pair-custody lists still name only coulomb-social and email-connect. +role were installed at 2026-11-02T09:02:50Z by the silent reader script. +No Scaleway credential is configured here, so IAM application +`mas-evidence-backup-primary` is not created. The KV pair and +`/etc/mas-backup/primary.env` do not exist. Pair-custody lists still +name only coulomb-social and email-connect. Design: `docs/credential-lane-designs/mas-evidence-backup-grant-2026-11-02.md`.