diff --git a/credential-change-requests/CCR-2026-0032.yaml b/credential-change-requests/CCR-2026-0032.yaml index cd6ddf5..c8395e9 100644 --- a/credential-change-requests/CCR-2026-0032.yaml +++ b/credential-change-requests/CCR-2026-0032.yaml @@ -3,7 +3,7 @@ kind: credential-change-request schema_version: 1 request_type: workload-kv-read title: Informed Decision create-only requester workload read -status: approved +status: applied created: '2026-10-04' updated: '2026-10-04' requester: @@ -64,6 +64,16 @@ review: amendment of the already applied reader policy through fresh attended OpenBao login. Exact credential path, bound account/namespace/audience, 900-second limits, no-default-policy and create-only requester scopes remain unchanged.' + - at: '2026-10-04T21:48:43.216200+00:00' + reviewer: codex + decision: native_delivery_proven + comment: Founder attended amendment exited 0 with metadata_verified receipt. ArgoCD + delivery is Synced; store Valid and ExternalSecret SecretSynced. Candidate image + 804d89fb proved exact reader policy/TTL, wrong SA/namespace/audience and sibling/LIST + denials, mounted file equality/mode, signed create-only exchange and excess-scope + denials. Reader revoked and post-revoke lookup denied; temporary proofs removed. + Verification workload only; production service mount/cutover acceptance remains + pending. No issuer rotation performed. target: domain: financials tenant: platform diff --git a/docs/credential-lane-designs/informed-decision-requester-workload.md b/docs/credential-lane-designs/informed-decision-requester-workload.md index a78057d..1ce61dd 100644 --- a/docs/credential-lane-designs/informed-decision-requester-workload.md +++ b/docs/credential-lane-designs/informed-decision-requester-workload.md @@ -1,3 +1,20 @@ +# Current delivery state — 2026-10-04 + +CCR-2026-0032 is applied. The exact self-token amendment was approved and applied +through attended Warden login. Dedicated manual ArgoCD application +informed-decision-requester owns SA/store/ExternalSecret at 4332c39. Store Valid +and ExternalSecret SecretSynced; native bounded proofs pass against candidate +804d89fb. See docs/evidence/2026-10-04-requester-delivery.json and +docs/evidence/infd-requester-proof*.json. Final receiving review-pod projection +and service cutover acceptance remain under INFD-WP-0007. Issuer rotation is a +separate approved operation; none was performed for this delivery. + +The original design record below describes preparation history. Current policy +adds only self lookup/revoke; the updated helper accepts the exact legacy policy +or final policy and refuses all other drift. Its receipts contain fixed phases +and booleans, never CLI bytes. The earlier execution digest is superseded: CCR +is now applied, so the metadata child deliberately refuses replay. + # Informed-decision requester workload delivery Status: founder-approved design for owner integration; execution pending, @@ -17,8 +34,9 @@ and auth claims unconfirmed while the implementation gates are open. The existing KV-v2 path `platform/workloads/informed-decision/sitting-requester` and field `CLIENT_SECRET` remain issuer custody. New policy `workload-kv-read-informed-decision-sitting-requester-eso` reads only its exact -data path. It grants no KV write, metadata read/list, wildcard, self-lifecycle -or sibling access. KV ACLs apply to the entire path, not individual fields; +data path. The founder-approved amendment also grants auth/token/lookup-self +read and auth/token/revoke-self update. It grants no KV write, metadata read/list, +wildcard or sibling access. KV ACLs apply to the entire path, not individual fields; future fields at this path require review of the reader's risk. The prospective auth role `informed-decision-sitting-requester-eso` binds only diff --git a/docs/evidence/2026-10-04-requester-delivery.json b/docs/evidence/2026-10-04-requester-delivery.json index d2638ff..69744ad 100644 --- a/docs/evidence/2026-10-04-requester-delivery.json +++ b/docs/evidence/2026-10-04-requester-delivery.json @@ -1,5 +1,5 @@ { - "at": "2026-10-04T21:21:12.710394+00:00", + "at": "2026-10-04T21:48:43.201341+00:00", "authority": "ADMINISTER @ realm:kubernetes/railiance01", "activation": "APPROVED", "ccr": "CCR-2026-0032", @@ -13,13 +13,15 @@ "manifest_revision": "4332c391ea7f66479f67968222a45be4fc6e2f90", "sync": "Succeeded", "automated_sync": false, - "store_ready": false, - "eso_ready": false, - "native_failure": { - "lookup_self_failed": true, - "http_403": true - }, + "store_ready": true, + "eso_ready": true, "service_rollout_performed": false, "credential_values_output": false, - "amendment_pending": "token self lookup/read and revoke/update only" + "verification_image": "forgejo.coulomb.social/coulomb/informed-decision@sha256:804d89fb0bb3d691720380eedde4f361133bada717d1773c2eb349004346ebf1", + "native_proofs_passed": true, + "temporary_proof_objects_removed": true, + "secret_duplicate_annotation_present": false, + "source_fix": "informed-decision 03f18d8: KeyCape requires client_secret_basic", + "service_projection_acceptance_pending": true, + "issuer_rotation_performed": false } diff --git a/docs/evidence/infd-requester-proof.json b/docs/evidence/infd-requester-proof.json new file mode 100644 index 0000000..cc1f70f --- /dev/null +++ b/docs/evidence/infd-requester-proof.json @@ -0,0 +1,20 @@ +{ + "approval_approve_refused": true, + "approval_consume_refused": true, + "approval_read_refused": true, + "complete": true, + "exact_identity": true, + "exact_path_projection_matches": true, + "exact_policy_and_ttl": true, + "issuer_jwks_request_ok": true, + "issuer_token_request_ok": true, + "negative_identity": false, + "parent_list_refused": true, + "phase": "approval_consume_refused", + "projection_mode": true, + "reader_revoked": true, + "revoked_lookup_refused": true, + "sibling_get_refused": true, + "signed_create_only_exchange": true, + "wrong_audience_refused": true +} diff --git a/docs/evidence/requester-metadata/bc39733aa4014352b79ba2b007e585af.json b/docs/evidence/requester-metadata/bc39733aa4014352b79ba2b007e585af.json new file mode 100644 index 0000000..33e8903 --- /dev/null +++ b/docs/evidence/requester-metadata/bc39733aa4014352b79ba2b007e585af.json @@ -0,0 +1 @@ +{"at": "2026-10-04T21:28:24.477320+00:00", "ccr": "CCR-2026-0032", "exit_code": 0, "native_delivery_verified": false, "phase": "metadata_verified", "schema": "requester-metadata-attempt.v1"} diff --git a/docs/provisioning-windows/2026-10-04-1000/informed-decision/checklist.md b/docs/provisioning-windows/2026-10-04-1000/informed-decision/checklist.md index ea42e12..67323ec 100644 --- a/docs/provisioning-windows/2026-10-04-1000/informed-decision/checklist.md +++ b/docs/provisioning-windows/2026-10-04-1000/informed-decision/checklist.md @@ -1,45 +1,13 @@ -# Requester delivery: ESO amendment approved, attended execution pending +# Requester delivery: native proofs passed -The founder completed the attended metadata child with exit zero. Receipt: -`docs/evidence/requester-metadata/626537db6f7e45788bc0538054225ae5.json`. -ArgoCD application informed-decision-requester successfully synced manifest -revision 4332c391ea7f66479f67968222a45be4fc6e2f90. It has no automated sync or -pruning. The decision service deployment was not changed. +The attended policy amendment completed with exit 0 and metadata_verified. +CCR-2026-0032 is applied; do not replay its superseded command/digest. +ArgoCD is Synced; store Valid and ExternalSecret SecretSynced. -Native validation exposed a missing prerequisite: ESO calls -`auth/token/lookup-self`, which the approved exact-path-only policy denies (403). -The amendment adds exactly these capabilities to the same reader policy: - -```hcl -path "auth/token/lookup-self" { capabilities = ["read"] } -path "auth/token/revoke-self" { capabilities = ["update"] } -``` - -No new data paths, metadata listing, default policy, TTL, account, namespace, -audience or approval scopes are proposed. These are self-token operations only. -CCR-2026-0032 is proposed for this amendment; previous approval/application -remain in its review history. Do not rerun the superseded command/digest. - -After founder approval, record the amended approved CCR digest. The updated -contained helper compares both objects before replacing only the exact previous -policy with the exact amended policy, preserves the role and refuses any other -drift. Fourteen helper tests pass, including predecessor upgrade and conflict -refusal. Run through the same attended platform-admin lane; it remains silent -and records fixed phase/exit metadata. Then verify ESO readiness and native scope, -projection/exchange and cleanup receipts. Checklist complete: false. - -## Amendment approval - -Founder explicitly approved both self-token permissions in the session. The -approved amended CCR supersedes the earlier command digest. Run from the founder -terminal; the child refuses any policy other than the exact predecessor or final -policy, checks the role first, and retains only fixed phase/exit metadata. - -```sh -BAO_ADDR=http://127.0.0.1:18200 VAULT_ADDR=http://127.0.0.1:18200 \ - warden access openbao-platform-admin-login --exec -- \ - python3 /home/worsch/railiance-platform/scripts/informed_decision_requester_metadata.py \ - --expected-ccr-sha256 5fe17507fd7db8956d4c71467be2b876ef9998b4a4211754f20559eec04c5cc5 -``` - -Report only the Warden exit code. Native delivery checks remain pending. +Native proof receipts: docs/evidence/infd-requester-proof.json, +infd-requester-proof-wrong-sa.json and infd-requester-proof-wrong-ns.json. +Exact identity/policy/TTL, mounted file equality/mode, scope and identity refusals, +RS256 create-only exchange and reader revocation pass. Temporary resources removed. +No credential bytes were output. Production review-pod mount/cutover acceptance +remains under INFD-WP-0007 and RPF-WP-0051-T03. Issuer rotation is separately +governed and was not performed. No further metadata approval is pending. diff --git a/workplans/RPF-WP-0051-informed-decision-requester-workload-delivery.md b/workplans/RPF-WP-0051-informed-decision-requester-workload-delivery.md index 5257ee1..5bdecf0 100644 --- a/workplans/RPF-WP-0051-informed-decision-requester-workload-delivery.md +++ b/workplans/RPF-WP-0051-informed-decision-requester-workload-delivery.md @@ -86,12 +86,12 @@ are in this window's `dependency-requirements.md`. ```task id: RPF-WP-0051-T03 -status: wait +status: progress priority: high depends_on: [RPF-WP-0051-T02] needs_human: true decision_id: "0d6792b6-59e4-4fa0-887a-c4e51ea8e131" -blocking_reason: "Approved metadata applied; ESO validation fails on token lookup-self. Exact self-token lookup/revoke amendment approved; awaits attended execution; broader cutover remains separate." +blocking_reason: "Metadata amendment and native delivery proofs passed. Final receiving service mount/cutover acceptance awaits INFD-WP-0007 rollout go; no further requester metadata approval is needed." state_hub_task_id: "abbe62c9-8520-563a-9f8a-e12b5209af77" ``` @@ -159,3 +159,22 @@ Founder explicitly approved lookup-self/read and revoke-self/update. Amended CCR approved and exact helper source/digest validated offline. Only fresh attended execution and native delivery proofs remain for this amendment; no renewed permission request is needed within this scope. + +## Native scoped delivery proven — 2026-10-04 + +Attended amendment exit 0 and metadata_verified receipt retained. After refresh, +ArgoCD Synced, ClusterSecretStore Valid and ExternalSecret SecretSynced. Safe +annotation helper confirms no duplicate credential annotation. Temporary native +workloads proved exact identity/policy and TTL/max bounds; wrong namespace, +ServiceAccount and audience refused; sibling GET and parent LIST refused. +Projection is 0440 and equals the exact authorized KV field without emitting it. + +Native exchange exposed requester client_secret_post incompatibility. Fixed +informed-decision at 03f18d8 to use KeyCape client_secret_basic with form-encoded +credential halves; image 804d89fb passes 664 tests/1 skipped, 13 container checks +and zero HIGH/CRITICAL scan findings. With the service's exact Traefik HTTPS peer, +native signed create-only exchange and approve/read/consume refusals all pass. +The test reader self-revoked and post-revoke lookup fails; all eight temporary +verification objects are removed. CCR is applied; actual review Deployment mount +and cutover acceptance remain T03. Issuer rotation stays separately governed, +not inferred from unchanged-file projection or callback unit tests.