coulomb/railiance-platform
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Establish scoped KeyCape factor custody and verified automatic renewal
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 2s
Details
KeyCape factor custody acceptance / acceptance (push) Successful in 7s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a092fe-13b1-7f12-ac74-7d258af4d79c
This commit is contained in:
codex 2026-09-13 16:25:33 +02:00
parent b75729b799
commit 2e2c31d237
22 changed files with 1169 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

64
workplans/RPF-WP-0040-keycape-factor-credential-custody.md Normal file
View file

@ -0,0 +1,64 @@
---
id: RPF-WP-0040
type: workplan
title: "Establish KeyCape factor credential custody and renewal"
domain: financials
repo: railiance-platform
status: active
owner: codex
topic_slug: financials
created: "2026-09-13"
updated: "2026-09-13"
---
User authorized establishing custody/delivery on 2026-09-13 and offered attended administrative authentication. Supports USER-WP-0030-T03 and KEY-WP-0035-T02. Existing incident lanes are not silently repurposed.
## Establish exact-path custody and workload delivery metadata
```task
id: RPF-WP-0040-T01
status: done
priority: high
```
New KV v2 path platform/workloads/net-kingdom/keycape-factor-read, field TOKEN, provider expiry metadata. Reader role binds only sso/keycape-factor-eso, audience openbao, exact-path read policy and fifteen-minute OpenBao tokens. Attended admin metadata apply, exact readback and capability checks. No wildcard secret access or secret value in output.
## Provision a bounded provider identity and renewable credential
```task
id: RPF-WP-0040-T02
status: done
priority: high
```
Create dedicated privacyIDEA keycape-factor-reader with coulomb tokenlist permission. Preserve existing admin rights; baseline has no admin policies. Store renewable issuer credential separately from the delivered JWT. Use protected stdin and in-memory handling, provider-issued JWT with expiry, positive cross-user scope and negative admin policy-read checks. No personal admin password in runtime.
## Activate and verify renewal and consumer delivery
```task
id: RPF-WP-0040-T03
status: done
priority: high
```
Deliver via namespace-scoped ESO, activate KeyCape adminTokenFile with byte-preserving config CAS, schedule renewal before expiry and verify mounted reload and native scope. Predecessor expiry/revocation and recovery drills remain T04. Verify effective scope and real factor acceptance before optional client policy. Preserve existing incident residuals in NK-WP-0033.
Live implementation and evidence: docs/evidence/2026-09-13-keycape-factor-custody.md.
Fourteen offline tests pass; native renewal, exact-path ESO delivery, negative
scope checks, provider per-user lookup and mounted rotation passed. KeyCape
rolled out Ready 1/1 without changing MFA policy or signing/client secrets.
## Verify provider expiry and revocation recovery
```task
id: RPF-WP-0040-T04
status: todo
priority: high
```
Exercise genuine JWT expiry, provider-side permission withdrawal and recovery
with an isolated fixture, preserving real users' factors and admin access.
Verify rejected predecessor handling independently of OpenBao token revocation.
Include provider interruption/retry evidence and maintain visible failed-Job /
ExternalSecret failure signals. This is remaining acceptance, not another owner
handoff. Historical resolver incident NK-WP-0033 remains separately open.