coulomb/railiance-platform
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Prepare the two approval client-side reader admissions
Some checks are pending
CI Smoke / host-smoke (push) Waiting to run
Details
CI Smoke / container-smoke (push) Waiting to run
Details

Browse source 
RPF-WP-0035-T06. Adds CCR-2026-0019 (secrets-engine) and CCR-2026-0020
(approval-engine-operator) with their exact-path read policies, reusing the
existing version-1 custody from the verifier activation. No reseed, rotation,
shared reader or verifier Secret reuse; both requests are in_flight and nothing
is applied.

The two shapes were decided by read-only survey rather than assumed.
secrets-engine consumes its client secret through an operator-run CLI reading a
protected file, and its namespace holds no workload, so reader 1 is an attended
operator-workstation OIDC lane rather than an ESO lane; its one missing input is
the operator group claim, which NetKingdom and KeyCape own. approval-engine is
not deployed and no owner source names who presents the operator client, so
reader 2 records the undetermined actor instead of guessing one for the widest
approval scope in the pair. Both declare openbao.auth missing rather than
carrying a placeholder binding.

T06 moves to wait on those two owner inputs.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WLUjpv3ssxNRAEPPgLFnEB

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 1275505@bnt-lap001
Assistant-Session: 97265baa-f08f-4032-b290-a1e2965a69c5
This commit is contained in:
codex 2026-09-09 14:41:01 +02:00
parent 5507fac156
commit 32d5cf0211
7 changed files with 431 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

35
workplans/RPF-WP-0035-credential-lane-implementation.md
View file

@ -246,7 +246,7 @@ Rotation is a distinct, version-guarded operation.
```task
id: RPF-WP-0035-T06
status: todo
status: wait
priority: high
needs_human: false
intervention_note: ""
@ -265,6 +265,39 @@ consumer delivery, cleanup/revocation and rollback, then obtain the required
owner reviews for those concrete requests. No reseeding, rotation, shared reader,
reuse of the sso verifier Secret, or implicit operator consume grant.
2026-09-09 preparation return: both exact-reader admissions are prepared as
`CCR-2026-0019` (secrets-engine) and `CCR-2026-0020` (approval-engine-operator),
with their exact-path read policies written and committed. Design:
`docs/credential-lane-designs/keycape-approval-client-side-readers.md`. Both
reuse existing version-1 custody; no reseed, rotation, shared reader or verifier
Secret reuse. Both are `in_flight` and unapproved; nothing is applied.
Read-only survey findings that decided the two shapes. Namespace
`secrets-engine` holds only ServiceAccount `secrets-engine` with no workload,
and `flex-auth/flex-auth-secrets-engine` is that consumer's PDP, not the
service; secrets-engine consumes the client secret through an operator-run CLI
reading `SECRETS_ENGINE_APPROVAL_CLIENT_SECRET_FILE` (SECRETS-WP-0009-T03,
revision `9eb07fd`). So reader 1 is an attended operator-workstation OIDC lane,
not an ESO lane. approval-engine has no namespace, workload or Service; its
manifest is unapplied, and no owner source names who presents the operator
client — approval-engine verifies these tokens and never holds them.
**Unblock:** reader 1 needs the exact NetKingdom/KeyCape group claim for the
authorized operator, plus secrets-engine confirming the file mode and removal
step; `openbao.auth` is declared missing rather than filled with a placeholder
that would later read as a confirmed binding. Reader 2 needs its owner to name
the presenting actor and placement, or to record that no client-side reader is
wanted so the request is cancelled. Naming a reader for the widest approval
scope without that decision is the failure this task exists to avoid.
**Done when:** each reader has a named actor and placement, a completed and
reviewed auth binding, admitted delivery, and its owner approvals; positive and
negative checks pass, including cross-path, wrong-identity and parent-list
denial and operator `consume` denial; or the request is explicitly cancelled by
its owner. Rotation stays a distinct version-guarded operation shared with
CCR-2026-0017/0018.
Consumer input supplied 2026-09-09: secrets-engine now implements per-request
`secrets-engine-approval` exchange from a protected temporary client-secret file,
with exact approval-engine / tenant:platform / read-or-consume scope, no token