From 363e63562bd4f884cc9a7080379f231ba3f4fcac Mon Sep 17 00:00:00 2001 From: codex Date: Mon, 2 Nov 2026 10:46:30 +0100 Subject: [PATCH] Name the MAS backup application in the source bucket policy. The founder supplied application id 25a4cbca-220e-40c0-9af5-6c7713000174. Three statements allow only platform-pg/application-archives/mas/ and do not grant object delete. The live policy was not changed. Assistant: grok Assistant-Session: 01a198fa-fd27-7e41-a0a2-57355c3e4efd --- .../CCR-2026-0062-mas-backup-primary.yaml | 2 +- .../mas-evidence-backup-grant-2026-11-02.md | 23 ++++++++++--------- .../railiance-platform-pg-backup-policy.json | 23 +++++++++++++++++++ .../RPF-WP-0070-mas-evidence-recovery.md | 9 ++++---- 4 files changed, 41 insertions(+), 16 deletions(-) diff --git a/credential-change-requests/CCR-2026-0062-mas-backup-primary.yaml b/credential-change-requests/CCR-2026-0062-mas-backup-primary.yaml index 4a6290c..4da91c6 100644 --- a/credential-change-requests/CCR-2026-0062-mas-backup-primary.yaml +++ b/credential-change-requests/CCR-2026-0062-mas-backup-primary.yaml @@ -103,7 +103,7 @@ "endpoint": "https://s3.nl-ams.scw.cloud", "bucket": "railiance-platform-pg-backup", "prefix": "platform-pg/application-archives/mas/", - "identity": "founder created IAM application mas-evidence-backup-primary in the console; application id is not recorded because this workstation has no Scaleway credential", + "identity": "IAM application mas-evidence-backup-primary 25a4cbca-220e-40c0-9af5-6c7713000174; no key stored; bucket policy source allows only platform-pg/application-archives/mas/ and withholds object delete", "retained_delete": false }, "risk": { diff --git a/docs/credential-lane-designs/mas-evidence-backup-grant-2026-11-02.md b/docs/credential-lane-designs/mas-evidence-backup-grant-2026-11-02.md index 46b7a18..c93afc3 100644 --- a/docs/credential-lane-designs/mas-evidence-backup-grant-2026-11-02.md +++ b/docs/credential-lane-designs/mas-evidence-backup-grant-2026-11-02.md @@ -4,8 +4,9 @@ Prepared for RPF-WP-0070. The founder approved CCR-2026-0062 on 2026-11-02 as platform-owner and mas-owner. The Kubernetes binding is confirmed against ServiceAccount `backup-primary-delivery` in namespace `mas`, which exists with automount disabled. Delivery admission is still false. The OpenBao policy -and role were installed at 2026-11-02T09:02:50Z. No provider identity, value, -node file, offsite upload, or timer exists yet. +and role were installed at 2026-11-02T09:02:50Z. IAM application +`mas-evidence-backup-primary` is `25a4cbca-220e-40c0-9af5-6c7713000174`. +No key, value, node file, offsite upload, or timer exists yet. The accepted shape is the email-connect ledger reader, CCR-2026-0037. The MAS prefix is `platform-pg/application-archives/mas/` in bucket @@ -22,7 +23,7 @@ local. It is not an offsite object. | Role | mas-backup-primary-workload-kv-read | installed for backup-primary-delivery in namespace mas | | ServiceAccount | backup-primary-delivery in namespace mas | live, automount false, uid c0e5867b-b4be-49b7-94db-6aae0a6e566e; no RoleBinding | | Node file | /etc/mas-backup/primary.env, root:root 0600, directory 0700 | not created | -| Provider identity | application mas-evidence-backup-primary | founder created it in the console; this workstation still cannot list it, so its id is not recorded | +| Provider identity | application mas-evidence-backup-primary `25a4cbca-220e-40c0-9af5-6c7713000174` | id recorded; no API key stored | Do not reuse the email-connect publisher or its node file. Object-storage IAM is not prefix-scoped inside a project, so a later admission needs its own IAM @@ -37,14 +38,14 @@ and is not created here. 2. The policy and role are installed. The attended command finished at 2026-11-02T09:02:50Z and wrote a metadata receipt. Delivery admission stays false. -3. The founder created IAM application `mas-evidence-backup-primary` in the - console. Its id is not recorded yet: `scw iam application list` still - reports no credentials on this workstation. The next record is that id, - then the three prefix statements. Do not add a key to email-connect or to - a broad application. -4. Add three bucket-policy statements for that application, limited to - `platform-pg/application-archives/mas/`, with no object delete. Prove sibling - denial, retained-delete denial, and no IAM or bucket administration. +3. IAM application `mas-evidence-backup-primary` is + `25a4cbca-220e-40c0-9af5-6c7713000174`. Do not add a key to email-connect + or to a broad application. +4. The source bucket policy has three statements for that application, + limited to `platform-pg/application-archives/mas/`, with no object delete. + The live merge did not run: the local OpenBao token cannot read the + backup or bootstrap paths. Sibling, retained-delete, and administration + denials still require this application's own key. 5. Provision the pair atomically with KV CAS=0 under the pair-writer policy extended to this one path. The single-field paste desk is unsuitable. 6. Record positive reader proof and negative denials, then set delivery diff --git a/docs/object-storage/railiance-platform-pg-backup-policy.json b/docs/object-storage/railiance-platform-pg-backup-policy.json index fe804bd..19b3aa0 100644 --- a/docs/object-storage/railiance-platform-pg-backup-policy.json +++ b/docs/object-storage/railiance-platform-pg-backup-policy.json @@ -70,6 +70,29 @@ "Principal": {"SCW": "application_id:0eb0f958-77a4-4c70-9aa7-14ba46411415"}, "Action": ["s3:AbortMultipartUpload", "s3:GetObject", "s3:GetObjectVersion", "s3:ListMultipartUploadParts", "s3:PutObject"], "Resource": "railiance-platform-pg-backup/platform-pg/application-archives/email-connect/*" + }, + { + "Sid": "MasEvidenceBackupProbe", + "Effect": "Allow", + "Principal": {"SCW": "application_id:25a4cbca-220e-40c0-9af5-6c7713000174"}, + "Action": ["s3:GetBucketLocation", "s3:GetBucketVersioning", "s3:GetLifecycleConfiguration"], + "Resource": "railiance-platform-pg-backup", + "Condition": {"Bool": {"aws:SecureTransport": "true"}} + }, + { + "Sid": "MasEvidenceBackupList", + "Effect": "Allow", + "Principal": {"SCW": "application_id:25a4cbca-220e-40c0-9af5-6c7713000174"}, + "Action": ["s3:ListBucket", "s3:ListBucketMultipartUploads", "s3:ListBucketVersions"], + "Resource": "railiance-platform-pg-backup", + "Condition": {"StringLike": {"s3:prefix": ["platform-pg/application-archives/mas/", "platform-pg/application-archives/mas/*"]}} + }, + { + "Sid": "MasEvidenceBackupObjects", + "Effect": "Allow", + "Principal": {"SCW": "application_id:25a4cbca-220e-40c0-9af5-6c7713000174"}, + "Action": ["s3:AbortMultipartUpload", "s3:GetObject", "s3:GetObjectVersion", "s3:ListMultipartUploadParts", "s3:PutObject"], + "Resource": "railiance-platform-pg-backup/platform-pg/application-archives/mas/*" } ] } diff --git a/workplans/RPF-WP-0070-mas-evidence-recovery.md b/workplans/RPF-WP-0070-mas-evidence-recovery.md index 9538917..8a80887 100644 --- a/workplans/RPF-WP-0070-mas-evidence-recovery.md +++ b/workplans/RPF-WP-0070-mas-evidence-recovery.md @@ -40,7 +40,7 @@ status: progress priority: medium needs_human: true depends_on: [RPF-WP-0053-T05] -intervention_note: "CCR-2026-0062 is applied. The founder created IAM application mas-evidence-backup-primary. Its id is not recorded because this workstation has no Scaleway credential. Delivery admission stays false. Age-identity escrow remains separate." +intervention_note: "CCR-2026-0062 is applied. IAM application mas-evidence-backup-primary is 25a4cbca-220e-40c0-9af5-6c7713000174. The source bucket policy names that id under platform-pg/application-archives/mas/ with no object delete. No API key is stored. Delivery admission stays false. Age-identity escrow remains separate." state_hub_task_id: "4f6484fb-8303-5dd5-94cb-b2622e1322c8" ``` @@ -66,9 +66,10 @@ mas-owner. ServiceAccount `backup-primary-delivery` now exists in namespace `mas` with automount disabled and no RoleBinding. The binding is confirmed. Delivery admission stays false. The OpenBao policy and role were installed at 2026-11-02T09:02:50Z by the silent reader script. -The founder created IAM application `mas-evidence-backup-primary` in the -console. This workstation still has no Scaleway credential, so the -application id is not recorded here. The KV pair and +IAM application `mas-evidence-backup-primary` is +`25a4cbca-220e-40c0-9af5-6c7713000174`. The source bucket policy allows +that id only under `platform-pg/application-archives/mas/` and does not +grant object delete. No API key is stored. The KV pair and `/etc/mas-backup/primary.env` do not exist. Pair-custody lists still name only coulomb-social and email-connect. Design: `docs/credential-lane-designs/mas-evidence-backup-grant-2026-11-02.md`.