Close issuer pin prerequisite and prepare named custody review decisions
Assistant: codex Assistant-Model: gpt-5.6-luna Assistant-Session: 01a07ff8-19d0-7820-b4d0-1353833cb7fc
This commit is contained in:
codex
parent
e06d7fc390
commit
52b24eab9a
6 changed files with 166 additions and 5 deletions
|
|
@ -5,7 +5,7 @@ request_type: workload-kv-read
|
|||
title: KeyCape verifier custody for the secrets-engine-approval confidential client
|
||||
status: proposed
|
||||
created: '2026-09-08'
|
||||
updated: '2026-09-08'
|
||||
updated: '2026-09-09'
|
||||
requester:
|
||||
agent: claude
|
||||
reason: >-
|
||||
|
|
@ -165,6 +165,8 @@ lifecycle:
|
|||
Disable the registration at KeyCape first (that is what stops token issuance),
|
||||
then rotate the KV version and confirm no other namespace consumed the store.
|
||||
state_hub:
|
||||
decision_id: b533a271-b704-4c5c-98a2-9a5951aadfb6
|
||||
decision_api_url: http://127.0.0.1:8000/decisions/b533a271-b704-4c5c-98a2-9a5951aadfb6
|
||||
workplan_id: RPF-WP-0035
|
||||
task_id: RPF-WP-0035-T05
|
||||
related_message: 278a3ebe-b529-49f6-bd1a-e3ebcf318260
|
||||
|
|
|
|||
|
|
@ -5,7 +5,7 @@ request_type: workload-kv-read
|
|||
title: KeyCape verifier custody for the approval-engine-operator confidential client
|
||||
status: proposed
|
||||
created: '2026-09-08'
|
||||
updated: '2026-09-08'
|
||||
updated: '2026-09-09'
|
||||
requester:
|
||||
agent: claude
|
||||
reason: >-
|
||||
|
|
@ -142,6 +142,8 @@ lifecycle:
|
|||
Disable the registration at KeyCape, rotate the KV version, and refer emitted
|
||||
approval actions to approval-engine for audit review.
|
||||
state_hub:
|
||||
decision_id: efa90517-0cae-4eb6-a68d-5b0489c84d65
|
||||
decision_api_url: http://127.0.0.1:8000/decisions/efa90517-0cae-4eb6-a68d-5b0489c84d65
|
||||
workplan_id: RPF-WP-0035
|
||||
task_id: RPF-WP-0035-T05
|
||||
related_message: 278a3ebe-b529-49f6-bd1a-e3ebcf318260
|
||||
|
|
|
|||
|
|
@ -0,0 +1,42 @@
|
|||
# KeyCape approval-client custody: review packet
|
||||
|
||||
Prepared 2026-09-09 by the-custodian. Both requests are **proposed**; no named
|
||||
approval or custody mutation has been recorded. This is the review gate for
|
||||
RPF-WP-0035-T05, consumed by HFACT-WP-0001-T03.
|
||||
|
||||
| Request | Secret path and field | Client authority | Pending decision |
|
||||
| --- | --- | --- | --- |
|
||||
| [CCR-2026-0017](../../credential-change-requests/CCR-2026-0017-keycape-secrets-engine-approval-client.yaml) | `platform/workloads/secrets-engine/approval-client`, `CLIENT_SECRET` | `approval:read`, `approval:consume` | `b533a271-b704-4c5c-98a2-9a5951aadfb6` |
|
||||
| [CCR-2026-0018](../../credential-change-requests/CCR-2026-0018-keycape-approval-engine-operator-client.yaml) | `platform/workloads/approval-engine/operator-client`, `CLIENT_SECRET` | create/read/approve/revoke/supersede/observe/emit; no consume | `efa90517-0cae-4eb6-a68d-5b0489c84d65` |
|
||||
|
||||
Both require **platform-operator and key-cape-owner** review. Each has its own
|
||||
exact-path policy, Kubernetes auth role and ClusterSecretStore, bound to
|
||||
`external-secrets/external-secrets`, limited to `sso`. ESO owns the resulting
|
||||
Secret; authentication tokens have a 15-minute TTL. Client secrets require
|
||||
explicit rotation or registration disablement; token expiry does not revoke them.
|
||||
|
||||
The approved object would authorize verifier-side custody only. Client-side
|
||||
retrieval, audit sender/receiver custody, operator `approval:consume`, adoption
|
||||
of the Qonto Secret and factory spending remain outside these two requests.
|
||||
|
||||
Technical review completed: both CCRs validate, their generated policies match
|
||||
the two source HCL files, and the delivery manifests map exactly to the declared
|
||||
paths and fields. The signed upstream issuer is verified; NetKingdom's exact live
|
||||
pin is independently read back at Secret revision `58713343`. The compatible
|
||||
KeyCape image and rollout patch are prepared. These checks are evidence for the
|
||||
review, not substitutes for either named approval.
|
||||
|
||||
Execution still follows the [owner rollout sequence](keycape-approval-clients.md)
|
||||
through the founder-attended Warden/OpenBao envelope: policy/roles, CAS=0 initial
|
||||
custody, Valid stores, SecretSynced delivery, compatible config/image replacement,
|
||||
then positive and negative acceptance and metadata-only receipts. The generated
|
||||
plan leaves initial secret provisioning to the contained owner procedure; it is
|
||||
not an already exercised end-to-end activation command. Finish and exercise that
|
||||
procedure before opening the activation window. Current proposed requests refuse
|
||||
`apply-plan`; no status has been changed to get around that refusal.
|
||||
|
||||
Review outcome: approve, deny or needs changes, naming the reviewer and the role
|
||||
they are accepting. Both required role confirmations must be recorded for each
|
||||
CCR before execution. A generic CLI status change alone is insufficient evidence
|
||||
that both reviews occurred. No owner messages or browser login were triggered
|
||||
by preparation of this packet.
|
||||
|
|
@ -117,9 +117,11 @@ Prerequisites before the window opens:
|
|||
The admitted probe passed signature/audience/time/nonce verification on
|
||||
2026-09-08 at 21:44:44 UTC, exited 0 and removed every temporary resource.
|
||||
[Receipt](../evidence/2026-09-08-keycape-upstream-issuer-proof.json).
|
||||
The configuration owner must still ensure `authelia.issuer` is pinned to
|
||||
that exact value before this window. The probe left normal configuration
|
||||
unchanged. Keep the existing-human-login regression in the rollout checks.
|
||||
NetKingdom completed the exact `authelia.issuer` pin on 2026-09-09,
|
||||
with unchanged signing key and unrelated configuration; Secret revision
|
||||
`58713343`. [Pin receipt](../evidence/2026-09-09-keycape-upstream-issuer-pin.json).
|
||||
This prerequisite is closed. Keep the existing-human-login regression in
|
||||
the separately admitted image/configuration rollout checks.
|
||||
|
||||
In-window order:
|
||||
|
||||
|
|
@ -178,3 +180,8 @@ Use an absolute path to the owner command if invoking from another directory.
|
|||
It emits no output or values; inspect its allowlisted capability metadata only
|
||||
after Warden has completed revocation and cleanup. No custody activation or
|
||||
approval is performed by this preflight.
|
||||
|
||||
|
||||
2026-09-09: the live issuer pin is complete. The next review is captured in
|
||||
[keycape-approval-clients-review.md](keycape-approval-clients-review.md), with
|
||||
one pending Hub decision per existing CCR and both required reviewer roles.
|
||||
|
|
|
|||
93
docs/evidence/2026-09-09-keycape-upstream-issuer-pin.json
Normal file
93
docs/evidence/2026-09-09-keycape-upstream-issuer-pin.json
Normal file
|
|
@ -0,0 +1,93 @@
|
|||
{
|
||||
"schema": "netkingdom.keycape-issuer-pin-live-evidence.v1",
|
||||
"recorded_at": "2026-09-08T22:24:00.262369+00:00",
|
||||
"authorization": "User continuation: good, go on, after the explicit next step to ensure the verified issuer configuration pin.",
|
||||
"source_commit": "ad9979b159f56a5d77004031dea4a897e61751dc",
|
||||
"signed_issuer_proof_ref": "key-cape/docs/evidence/2026-09-08-upstream-issuer-live-proof.json",
|
||||
"check_before": {
|
||||
"before": {
|
||||
"resource_version": "51346058",
|
||||
"uid": "2e94519d-1550-41c7-9701-2efe47fe1fd3"
|
||||
},
|
||||
"config_changed": false,
|
||||
"deployment_changed": false,
|
||||
"issuer_matches": false,
|
||||
"mode": "issuer-check-live",
|
||||
"observed_at": "2026-09-08T22:23:58.199881+00:00",
|
||||
"prior_pin_state": "absent",
|
||||
"schema": "netkingdom.keycape-issuer-pin.v1",
|
||||
"secret_values_emitted": false,
|
||||
"target": "sso/keycape-config",
|
||||
"verified_issuer": "https://auth.coulomb.social"
|
||||
},
|
||||
"pin": {
|
||||
"after": {
|
||||
"resource_version": "58713343",
|
||||
"uid": "2e94519d-1550-41c7-9701-2efe47fe1fd3"
|
||||
},
|
||||
"before": {
|
||||
"resource_version": "51346058",
|
||||
"uid": "2e94519d-1550-41c7-9701-2efe47fe1fd3"
|
||||
},
|
||||
"config_changed": true,
|
||||
"deployment_changed": false,
|
||||
"issuer_matches": true,
|
||||
"mode": "issuer-pin-live",
|
||||
"observed_at": "2026-09-08T22:23:58.727554+00:00",
|
||||
"other_secret_data_unchanged": true,
|
||||
"prior_pin_state": "absent",
|
||||
"schema": "netkingdom.keycape-issuer-pin.v1",
|
||||
"secret_values_emitted": false,
|
||||
"target": "sso/keycape-config",
|
||||
"unrelated_config_bytes_preserved": true,
|
||||
"verified_issuer": "https://auth.coulomb.social"
|
||||
},
|
||||
"check_after": {
|
||||
"before": {
|
||||
"resource_version": "58713343",
|
||||
"uid": "2e94519d-1550-41c7-9701-2efe47fe1fd3"
|
||||
},
|
||||
"config_changed": false,
|
||||
"deployment_changed": false,
|
||||
"issuer_matches": true,
|
||||
"mode": "issuer-check-live",
|
||||
"observed_at": "2026-09-08T22:23:59.920100+00:00",
|
||||
"prior_pin_state": "matching",
|
||||
"schema": "netkingdom.keycape-issuer-pin.v1",
|
||||
"secret_values_emitted": false,
|
||||
"target": "sso/keycape-config",
|
||||
"verified_issuer": "https://auth.coulomb.social"
|
||||
},
|
||||
"deployment_before": {
|
||||
"uid": "99ddd83c-cb3f-4847-bcf8-35f1aa87627f",
|
||||
"resource_version": "55113259",
|
||||
"generation": 29,
|
||||
"images": [
|
||||
{
|
||||
"name": "keycape",
|
||||
"image": "forgejo.coulomb.social/coulomb/key-cape:main-153258b"
|
||||
}
|
||||
],
|
||||
"ready_replicas": 1,
|
||||
"available_replicas": 1
|
||||
},
|
||||
"deployment_after": {
|
||||
"uid": "99ddd83c-cb3f-4847-bcf8-35f1aa87627f",
|
||||
"resource_version": "55113259",
|
||||
"generation": 29,
|
||||
"images": [
|
||||
{
|
||||
"name": "keycape",
|
||||
"image": "forgejo.coulomb.social/coulomb/key-cape:main-153258b"
|
||||
}
|
||||
],
|
||||
"ready_replicas": 1,
|
||||
"available_replicas": 1
|
||||
},
|
||||
"deployment_unchanged": true,
|
||||
"tests_passed": 13,
|
||||
"credential_values_emitted": false,
|
||||
"custody_activated": false,
|
||||
"ccr_reviews_completed": false,
|
||||
"process_reload_or_new_image_proved": false
|
||||
}
|
||||
|
|
@ -146,6 +146,8 @@ closure: `history/2026-09-05-preflight-signing-activation-complete.md`.
|
|||
```task
|
||||
id: RPF-WP-0035-T05
|
||||
status: wait
|
||||
needs_human: true
|
||||
intervention_note: "Review CCR-2026-0017 and CCR-2026-0018 as platform-operator and key-cape-owner; both pending decisions are linked from the CCRs and the review packet. Signed issuer and exact configuration pin are proved."
|
||||
priority: high
|
||||
state_hub_task_id: "e15d62c9-e5da-5721-a135-87c050f7851c"
|
||||
```
|
||||
|
|
@ -203,6 +205,19 @@ custody mutation or client-side read. Keep the current authority preflight and
|
|||
this signed-token proof as separate receipts. Live ESO/client/approval and
|
||||
separate audit/client-side custody acceptance remain open.
|
||||
|
||||
|
||||
2026-09-09 configuration and review-queue return: NetKingdom pinned the verified
|
||||
HTTPS issuer, using an atomic UID/resourceVersion test and independent readback.
|
||||
Secret revision `58713343`; unrelated configuration and signing key unchanged;
|
||||
no Deployment rollout. Receipt: `docs/evidence/2026-09-09-keycape-upstream-issuer-pin.json`.
|
||||
|
||||
The two existing CCRs remain proposed. They now link to concrete pending review
|
||||
decisions, with platform-operator and key-cape-owner named explicitly. See
|
||||
`docs/credential-lane-designs/keycape-approval-clients-review.md`. T05 owns this
|
||||
human dependency; HFACT consumes it without a duplicate approval request.
|
||||
Custody/ESO activation, client verification and the separate client-side/audit
|
||||
lanes remain open. Current CLI apply plans refuse the proposed requests.
|
||||
|
||||
## Dependency review — 2026-09-06
|
||||
|
||||
SECRETS-WP-0008-T02 now records the local PIP claim/validation join implemented
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue