Accept native requester delivery proofs and preserve final cutover gate
Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a10780-6d41-7952-9718-dfbc1f41236f
This commit is contained in:
parent
f3dbff6a77
commit
4ed39d91d0
7 changed files with 94 additions and 56 deletions
|
|
@ -3,7 +3,7 @@ kind: credential-change-request
|
|||
schema_version: 1
|
||||
request_type: workload-kv-read
|
||||
title: Informed Decision create-only requester workload read
|
||||
status: approved
|
||||
status: applied
|
||||
created: '2026-10-04'
|
||||
updated: '2026-10-04'
|
||||
requester:
|
||||
|
|
@ -64,6 +64,16 @@ review:
|
|||
amendment of the already applied reader policy through fresh attended OpenBao
|
||||
login. Exact credential path, bound account/namespace/audience, 900-second limits,
|
||||
no-default-policy and create-only requester scopes remain unchanged.'
|
||||
- at: '2026-10-04T21:48:43.216200+00:00'
|
||||
reviewer: codex
|
||||
decision: native_delivery_proven
|
||||
comment: Founder attended amendment exited 0 with metadata_verified receipt. ArgoCD
|
||||
delivery is Synced; store Valid and ExternalSecret SecretSynced. Candidate image
|
||||
804d89fb proved exact reader policy/TTL, wrong SA/namespace/audience and sibling/LIST
|
||||
denials, mounted file equality/mode, signed create-only exchange and excess-scope
|
||||
denials. Reader revoked and post-revoke lookup denied; temporary proofs removed.
|
||||
Verification workload only; production service mount/cutover acceptance remains
|
||||
pending. No issuer rotation performed.
|
||||
target:
|
||||
domain: financials
|
||||
tenant: platform
|
||||
|
|
|
|||
|
|
@ -1,3 +1,20 @@
|
|||
# Current delivery state — 2026-10-04
|
||||
|
||||
CCR-2026-0032 is applied. The exact self-token amendment was approved and applied
|
||||
through attended Warden login. Dedicated manual ArgoCD application
|
||||
informed-decision-requester owns SA/store/ExternalSecret at 4332c39. Store Valid
|
||||
and ExternalSecret SecretSynced; native bounded proofs pass against candidate
|
||||
804d89fb. See docs/evidence/2026-10-04-requester-delivery.json and
|
||||
docs/evidence/infd-requester-proof*.json. Final receiving review-pod projection
|
||||
and service cutover acceptance remain under INFD-WP-0007. Issuer rotation is a
|
||||
separate approved operation; none was performed for this delivery.
|
||||
|
||||
The original design record below describes preparation history. Current policy
|
||||
adds only self lookup/revoke; the updated helper accepts the exact legacy policy
|
||||
or final policy and refuses all other drift. Its receipts contain fixed phases
|
||||
and booleans, never CLI bytes. The earlier execution digest is superseded: CCR
|
||||
is now applied, so the metadata child deliberately refuses replay.
|
||||
|
||||
# Informed-decision requester workload delivery
|
||||
|
||||
Status: founder-approved design for owner integration; execution pending,
|
||||
|
|
@ -17,8 +34,9 @@ and auth claims unconfirmed while the implementation gates are open.
|
|||
The existing KV-v2 path `platform/workloads/informed-decision/sitting-requester`
|
||||
and field `CLIENT_SECRET` remain issuer custody. New policy
|
||||
`workload-kv-read-informed-decision-sitting-requester-eso` reads only its exact
|
||||
data path. It grants no KV write, metadata read/list, wildcard, self-lifecycle
|
||||
or sibling access. KV ACLs apply to the entire path, not individual fields;
|
||||
data path. The founder-approved amendment also grants auth/token/lookup-self
|
||||
read and auth/token/revoke-self update. It grants no KV write, metadata read/list,
|
||||
wildcard or sibling access. KV ACLs apply to the entire path, not individual fields;
|
||||
future fields at this path require review of the reader's risk.
|
||||
|
||||
The prospective auth role `informed-decision-sitting-requester-eso` binds only
|
||||
|
|
|
|||
|
|
@ -1,5 +1,5 @@
|
|||
{
|
||||
"at": "2026-10-04T21:21:12.710394+00:00",
|
||||
"at": "2026-10-04T21:48:43.201341+00:00",
|
||||
"authority": "ADMINISTER @ realm:kubernetes/railiance01",
|
||||
"activation": "APPROVED",
|
||||
"ccr": "CCR-2026-0032",
|
||||
|
|
@ -13,13 +13,15 @@
|
|||
"manifest_revision": "4332c391ea7f66479f67968222a45be4fc6e2f90",
|
||||
"sync": "Succeeded",
|
||||
"automated_sync": false,
|
||||
"store_ready": false,
|
||||
"eso_ready": false,
|
||||
"native_failure": {
|
||||
"lookup_self_failed": true,
|
||||
"http_403": true
|
||||
},
|
||||
"store_ready": true,
|
||||
"eso_ready": true,
|
||||
"service_rollout_performed": false,
|
||||
"credential_values_output": false,
|
||||
"amendment_pending": "token self lookup/read and revoke/update only"
|
||||
"verification_image": "forgejo.coulomb.social/coulomb/informed-decision@sha256:804d89fb0bb3d691720380eedde4f361133bada717d1773c2eb349004346ebf1",
|
||||
"native_proofs_passed": true,
|
||||
"temporary_proof_objects_removed": true,
|
||||
"secret_duplicate_annotation_present": false,
|
||||
"source_fix": "informed-decision 03f18d8: KeyCape requires client_secret_basic",
|
||||
"service_projection_acceptance_pending": true,
|
||||
"issuer_rotation_performed": false
|
||||
}
|
||||
|
|
|
|||
20
docs/evidence/infd-requester-proof.json
Normal file
20
docs/evidence/infd-requester-proof.json
Normal file
|
|
@ -0,0 +1,20 @@
|
|||
{
|
||||
"approval_approve_refused": true,
|
||||
"approval_consume_refused": true,
|
||||
"approval_read_refused": true,
|
||||
"complete": true,
|
||||
"exact_identity": true,
|
||||
"exact_path_projection_matches": true,
|
||||
"exact_policy_and_ttl": true,
|
||||
"issuer_jwks_request_ok": true,
|
||||
"issuer_token_request_ok": true,
|
||||
"negative_identity": false,
|
||||
"parent_list_refused": true,
|
||||
"phase": "approval_consume_refused",
|
||||
"projection_mode": true,
|
||||
"reader_revoked": true,
|
||||
"revoked_lookup_refused": true,
|
||||
"sibling_get_refused": true,
|
||||
"signed_create_only_exchange": true,
|
||||
"wrong_audience_refused": true
|
||||
}
|
||||
|
|
@ -0,0 +1 @@
|
|||
{"at": "2026-10-04T21:28:24.477320+00:00", "ccr": "CCR-2026-0032", "exit_code": 0, "native_delivery_verified": false, "phase": "metadata_verified", "schema": "requester-metadata-attempt.v1"}
|
||||
|
|
@ -1,45 +1,13 @@
|
|||
# Requester delivery: ESO amendment approved, attended execution pending
|
||||
# Requester delivery: native proofs passed
|
||||
|
||||
The founder completed the attended metadata child with exit zero. Receipt:
|
||||
`docs/evidence/requester-metadata/626537db6f7e45788bc0538054225ae5.json`.
|
||||
ArgoCD application informed-decision-requester successfully synced manifest
|
||||
revision 4332c391ea7f66479f67968222a45be4fc6e2f90. It has no automated sync or
|
||||
pruning. The decision service deployment was not changed.
|
||||
The attended policy amendment completed with exit 0 and metadata_verified.
|
||||
CCR-2026-0032 is applied; do not replay its superseded command/digest.
|
||||
ArgoCD is Synced; store Valid and ExternalSecret SecretSynced.
|
||||
|
||||
Native validation exposed a missing prerequisite: ESO calls
|
||||
`auth/token/lookup-self`, which the approved exact-path-only policy denies (403).
|
||||
The amendment adds exactly these capabilities to the same reader policy:
|
||||
|
||||
```hcl
|
||||
path "auth/token/lookup-self" { capabilities = ["read"] }
|
||||
path "auth/token/revoke-self" { capabilities = ["update"] }
|
||||
```
|
||||
|
||||
No new data paths, metadata listing, default policy, TTL, account, namespace,
|
||||
audience or approval scopes are proposed. These are self-token operations only.
|
||||
CCR-2026-0032 is proposed for this amendment; previous approval/application
|
||||
remain in its review history. Do not rerun the superseded command/digest.
|
||||
|
||||
After founder approval, record the amended approved CCR digest. The updated
|
||||
contained helper compares both objects before replacing only the exact previous
|
||||
policy with the exact amended policy, preserves the role and refuses any other
|
||||
drift. Fourteen helper tests pass, including predecessor upgrade and conflict
|
||||
refusal. Run through the same attended platform-admin lane; it remains silent
|
||||
and records fixed phase/exit metadata. Then verify ESO readiness and native scope,
|
||||
projection/exchange and cleanup receipts. Checklist complete: false.
|
||||
|
||||
## Amendment approval
|
||||
|
||||
Founder explicitly approved both self-token permissions in the session. The
|
||||
approved amended CCR supersedes the earlier command digest. Run from the founder
|
||||
terminal; the child refuses any policy other than the exact predecessor or final
|
||||
policy, checks the role first, and retains only fixed phase/exit metadata.
|
||||
|
||||
```sh
|
||||
BAO_ADDR=http://127.0.0.1:18200 VAULT_ADDR=http://127.0.0.1:18200 \
|
||||
warden access openbao-platform-admin-login --exec -- \
|
||||
python3 /home/worsch/railiance-platform/scripts/informed_decision_requester_metadata.py \
|
||||
--expected-ccr-sha256 5fe17507fd7db8956d4c71467be2b876ef9998b4a4211754f20559eec04c5cc5
|
||||
```
|
||||
|
||||
Report only the Warden exit code. Native delivery checks remain pending.
|
||||
Native proof receipts: docs/evidence/infd-requester-proof.json,
|
||||
infd-requester-proof-wrong-sa.json and infd-requester-proof-wrong-ns.json.
|
||||
Exact identity/policy/TTL, mounted file equality/mode, scope and identity refusals,
|
||||
RS256 create-only exchange and reader revocation pass. Temporary resources removed.
|
||||
No credential bytes were output. Production review-pod mount/cutover acceptance
|
||||
remains under INFD-WP-0007 and RPF-WP-0051-T03. Issuer rotation is separately
|
||||
governed and was not performed. No further metadata approval is pending.
|
||||
|
|
|
|||
|
|
@ -86,12 +86,12 @@ are in this window's `dependency-requirements.md`.
|
|||
|
||||
```task
|
||||
id: RPF-WP-0051-T03
|
||||
status: wait
|
||||
status: progress
|
||||
priority: high
|
||||
depends_on: [RPF-WP-0051-T02]
|
||||
needs_human: true
|
||||
decision_id: "0d6792b6-59e4-4fa0-887a-c4e51ea8e131"
|
||||
blocking_reason: "Approved metadata applied; ESO validation fails on token lookup-self. Exact self-token lookup/revoke amendment approved; awaits attended execution; broader cutover remains separate."
|
||||
blocking_reason: "Metadata amendment and native delivery proofs passed. Final receiving service mount/cutover acceptance awaits INFD-WP-0007 rollout go; no further requester metadata approval is needed."
|
||||
state_hub_task_id: "abbe62c9-8520-563a-9f8a-e12b5209af77"
|
||||
```
|
||||
|
||||
|
|
@ -159,3 +159,22 @@ Founder explicitly approved lookup-self/read and revoke-self/update. Amended
|
|||
CCR approved and exact helper source/digest validated offline. Only fresh attended
|
||||
execution and native delivery proofs remain for this amendment; no renewed
|
||||
permission request is needed within this scope.
|
||||
|
||||
## Native scoped delivery proven — 2026-10-04
|
||||
|
||||
Attended amendment exit 0 and metadata_verified receipt retained. After refresh,
|
||||
ArgoCD Synced, ClusterSecretStore Valid and ExternalSecret SecretSynced. Safe
|
||||
annotation helper confirms no duplicate credential annotation. Temporary native
|
||||
workloads proved exact identity/policy and TTL/max bounds; wrong namespace,
|
||||
ServiceAccount and audience refused; sibling GET and parent LIST refused.
|
||||
Projection is 0440 and equals the exact authorized KV field without emitting it.
|
||||
|
||||
Native exchange exposed requester client_secret_post incompatibility. Fixed
|
||||
informed-decision at 03f18d8 to use KeyCape client_secret_basic with form-encoded
|
||||
credential halves; image 804d89fb passes 664 tests/1 skipped, 13 container checks
|
||||
and zero HIGH/CRITICAL scan findings. With the service's exact Traefik HTTPS peer,
|
||||
native signed create-only exchange and approve/read/consume refusals all pass.
|
||||
The test reader self-revoked and post-revoke lookup fails; all eight temporary
|
||||
verification objects are removed. CCR is applied; actual review Deployment mount
|
||||
and cutover acceptance remain T03. Issuer rotation stays separately governed,
|
||||
not inferred from unchanged-file projection or callback unit tests.
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue