From 2ac97865dabde736d79284f9aa5ba02efa3c64eb Mon Sep 17 00:00:00 2001 From: codex Date: Sat, 31 Oct 2026 12:50:43 +0100 Subject: [PATCH] CCR-2026-0057: approved (platform-owner, net-kingdom-owner) Founder approval in session 2026-10-31 for NK-WP-0056-T09. Co-Authored-By: Claude Opus 5.5 Assistant: claude-code Assistant-Model: opus Assistant-Process: 994874@bnt-lap001 Assistant-Session: 6017c416-d619-47eb-bd1a-f670a02d7d87 --- ...et-kingdom-synthetic-journey-identity.yaml | 82 +++++++++++-------- 1 file changed, 48 insertions(+), 34 deletions(-) diff --git a/credential-change-requests/CCR-2026-0057-net-kingdom-synthetic-journey-identity.yaml b/credential-change-requests/CCR-2026-0057-net-kingdom-synthetic-journey-identity.yaml index 8e7028c..3be7878 100644 --- a/credential-change-requests/CCR-2026-0057-net-kingdom-synthetic-journey-identity.yaml +++ b/credential-change-requests/CCR-2026-0057-net-kingdom-synthetic-journey-identity.yaml @@ -2,32 +2,43 @@ id: CCR-2026-0057 kind: credential-change-request schema_version: 1 request_type: attended-service-credential-delivery -title: NetKingdom synthetic journey identity (syn-journey) password and TOTP seed custody -status: proposed +title: NetKingdom synthetic journey identity (syn-journey) password and TOTP seed + custody +status: approved created: '2026-10-31' updated: '2026-10-31' requester: agent: claude-code - reason: 'NK-WP-0056-T09: a synthetic, unprivileged sign-in identity whose MFA journey through - KeyCape, Authelia and privacyIDEA replaces the founder''s sign-in as the check between - consumers in a bounded bind rotation (NK-WP-0056-T06). Its password and TOTP seed are - generated in memory and held only in OpenBao; LLDAP and privacyIDEA receive them through - one attended procedure. No workload reads them until the executor identity exists (T03/T10), - which needs its own request.' + reason: 'NK-WP-0056-T09: a synthetic, unprivileged sign-in identity whose MFA journey + through KeyCape, Authelia and privacyIDEA replaces the founder''s sign-in as the + check between consumers in a bounded bind rotation (NK-WP-0056-T06). Its password + and TOTP seed are generated in memory and held only in OpenBao; LLDAP and privacyIDEA + receive them through one attended procedure. No workload reads them until the + executor identity exists (T03/T10), which needs its own request.' review: required: true required_approvers: - platform-owner - net-kingdom-owner - comments: [] + comments: + - at: '2026-10-31T11:50:37+00:00' + reviewer: platform-owner + decision: approved + comment: Approved by the founder in session 2026-10-31 ('i accept the ccr') for + NK-WP-0056-T09. + - at: '2026-10-31T11:50:37+00:00' + reviewer: net-kingdom-owner + decision: approved + comment: Approved by the founder in session 2026-10-31 ('i accept the ccr') for + NK-WP-0056-T09. target: domain: infotech tenant: platform workload: net-kingdom-synthetic-journey environment: production - purpose: Hold the password and TOTP seed of the LLDAP user syn-journey (no groups, no rights) - so that a synthetic journey can prove sign-in with MFA without a person. No other identity, - directory, privacyIDEA or service credential. + purpose: Hold the password and TOTP seed of the LLDAP user syn-journey (no groups, + no rights) so that a synthetic journey can prove sign-in with MFA without a person. + No other identity, directory, privacyIDEA or service credential. openbao: mount: platform kv_path: platform/workloads/net-kingdom/synthetic-journey/syn-journey @@ -46,10 +57,10 @@ access_frontdoor: readiness: pending-review resolvable: false lifecycle: - deactivate: lane.py teardown deletes the privacyIDEA token SYNJOURNEY01, the LLDAP user - syn-journey (refused if it has gained any group) and the KV entry with all versions; - the KeyCape client nk-synthetic-journey is removed with keycape-client.py --operation - remove. The coding-agent fence stays. + deactivate: lane.py teardown deletes the privacyIDEA token SYNJOURNEY01, the LLDAP + user syn-journey (refused if it has gained any group) and the KV entry with all + versions; the KeyCape client nk-synthetic-journey is removed with keycape-client.py + --operation remove. The coding-agent fence stays. rotate: Tear down and set up again (new password and seed, CAS=0 on the fresh path). No in-place rotation path in this request. compromised: Delete the privacyIDEA token first (the account then cannot pass MFA), @@ -57,38 +68,41 @@ lifecycle: no protected service. delivery: surface: attended-service-config - service: LLDAP (sso) user syn-journey; privacyIDEA (mfa) TOTP token SYNJOURNEY01 in realm - coulomb - target: the LLDAP user's password (set with the pinned lldap_set_password, OPAQUE) and the - privacyIDEA token's OTP key (stored encrypted in the privacyIDEA database) + service: LLDAP (sso) user syn-journey; privacyIDEA (mfa) TOTP token SYNJOURNEY01 + in realm coulomb + target: the LLDAP user's password (set with the pinned lldap_set_password, OPAQUE) + and the privacyIDEA token's OTP key (stored encrypted in the privacyIDEA database) procedure: net-kingdom sso-mfa/k8s/synthetic-journey/lane.py setup - gate: attended platform-admin (aal2) OpenBao session, the human admin's LLDAP password, the - attended pi-admin password, and a passing synthetic journey (lane.py verify) against - the live issuer + gate: attended platform-admin (aal2) OpenBao session, the human admin's LLDAP password, + the attended pi-admin password, and a passing synthetic journey (lane.py verify) + against the live issuer risk: classification: medium notes: - - 'The identity is new and holds no group. Authelia admits it (it is not svc-* or ld-admin), - KeyCape issues it tokens, but no consuming service grants it anything. KeyCape has no - per-client group gate, so every client that admits any authenticated user would admit it - too; none of the registered clients grants rights without a group.' - - KeyCape marks its tokens principal_type human (key-cape token.go); the account is - declared SERVICE in the service-identity declarations. Recorded, not changed here. + - The identity is new and holds no group. Authelia admits it (it is not svc-* or + ld-admin), KeyCape issues it tokens, but no consuming service grants it anything. + KeyCape has no per-client group gate, so every client that admits any authenticated + user would admit it too; none of the registered clients grants rights without + a group. + - KeyCape marks its tokens principal_type human (key-cape token.go); the account + is declared SERVICE in the service-identity declarations. Recorded, not changed + here. - Values are generated in memory by lane.py and written CAS=0; neither is printed, logged or written to disk. The journey's receipts are value-free. - Coding agents are fenced from the data and metadata paths in agent-high-risk-boundary before the first write. - - No workload, Kubernetes or ESO reader exists; T10 needs a separate workload-kv-read request - for the executor identity. + - No workload, Kubernetes or ESO reader exists; T10 needs a separate workload-kv-read + request for the executor identity. verification: positive: - The KV password signs in to LLDAP as syn-journey (compared without display) - - The synthetic journey passes against https://kc.coulomb.social at aal2 with the KV - values (lane.py verify), with a value-free receipt + - The synthetic journey passes against https://kc.coulomb.social at aal2 with the + KV values (lane.py verify), with a value-free receipt negative: - Coding-agent boundary denies data and metadata of the path - No auth role or policy grants the path to a workload - - setup refuses if the KV path, the LLDAP user or the privacyIDEA token already exist + - setup refuses if the KV path, the LLDAP user or the privacyIDEA token already + exist activation_conditions: - Explicit platform-owner and net-kingdom-owner approval of this exact request (sha256-bound by lane.py).