From 52b24eab9a8aff3396e71b2296d0240a44f3b0db Mon Sep 17 00:00:00 2001 From: codex Date: Wed, 9 Sep 2026 00:40:23 +0200 Subject: [PATCH] Close issuer pin prerequisite and prepare named custody review decisions Assistant: codex Assistant-Model: gpt-5.6-luna Assistant-Session: 01a07ff8-19d0-7820-b4d0-1353833cb7fc --- ...eycape-secrets-engine-approval-client.yaml | 4 +- ...ycape-approval-engine-operator-client.yaml | 4 +- .../keycape-approval-clients-review.md | 42 +++++++++ .../keycape-approval-clients.md | 13 ++- ...026-09-09-keycape-upstream-issuer-pin.json | 93 +++++++++++++++++++ ...-WP-0035-credential-lane-implementation.md | 15 +++ 6 files changed, 166 insertions(+), 5 deletions(-) create mode 100644 docs/credential-lane-designs/keycape-approval-clients-review.md create mode 100644 docs/evidence/2026-09-09-keycape-upstream-issuer-pin.json diff --git a/credential-change-requests/CCR-2026-0017-keycape-secrets-engine-approval-client.yaml b/credential-change-requests/CCR-2026-0017-keycape-secrets-engine-approval-client.yaml index 363f079..997e06a 100644 --- a/credential-change-requests/CCR-2026-0017-keycape-secrets-engine-approval-client.yaml +++ b/credential-change-requests/CCR-2026-0017-keycape-secrets-engine-approval-client.yaml @@ -5,7 +5,7 @@ request_type: workload-kv-read title: KeyCape verifier custody for the secrets-engine-approval confidential client status: proposed created: '2026-09-08' -updated: '2026-09-08' +updated: '2026-09-09' requester: agent: claude reason: >- @@ -165,6 +165,8 @@ lifecycle: Disable the registration at KeyCape first (that is what stops token issuance), then rotate the KV version and confirm no other namespace consumed the store. state_hub: + decision_id: b533a271-b704-4c5c-98a2-9a5951aadfb6 + decision_api_url: http://127.0.0.1:8000/decisions/b533a271-b704-4c5c-98a2-9a5951aadfb6 workplan_id: RPF-WP-0035 task_id: RPF-WP-0035-T05 related_message: 278a3ebe-b529-49f6-bd1a-e3ebcf318260 diff --git a/credential-change-requests/CCR-2026-0018-keycape-approval-engine-operator-client.yaml b/credential-change-requests/CCR-2026-0018-keycape-approval-engine-operator-client.yaml index ec2662a..3acc0a6 100644 --- a/credential-change-requests/CCR-2026-0018-keycape-approval-engine-operator-client.yaml +++ b/credential-change-requests/CCR-2026-0018-keycape-approval-engine-operator-client.yaml @@ -5,7 +5,7 @@ request_type: workload-kv-read title: KeyCape verifier custody for the approval-engine-operator confidential client status: proposed created: '2026-09-08' -updated: '2026-09-08' +updated: '2026-09-09' requester: agent: claude reason: >- @@ -142,6 +142,8 @@ lifecycle: Disable the registration at KeyCape, rotate the KV version, and refer emitted approval actions to approval-engine for audit review. state_hub: + decision_id: efa90517-0cae-4eb6-a68d-5b0489c84d65 + decision_api_url: http://127.0.0.1:8000/decisions/efa90517-0cae-4eb6-a68d-5b0489c84d65 workplan_id: RPF-WP-0035 task_id: RPF-WP-0035-T05 related_message: 278a3ebe-b529-49f6-bd1a-e3ebcf318260 diff --git a/docs/credential-lane-designs/keycape-approval-clients-review.md b/docs/credential-lane-designs/keycape-approval-clients-review.md new file mode 100644 index 0000000..9124d9d --- /dev/null +++ b/docs/credential-lane-designs/keycape-approval-clients-review.md @@ -0,0 +1,42 @@ +# KeyCape approval-client custody: review packet + +Prepared 2026-09-09 by the-custodian. Both requests are **proposed**; no named +approval or custody mutation has been recorded. This is the review gate for +RPF-WP-0035-T05, consumed by HFACT-WP-0001-T03. + +| Request | Secret path and field | Client authority | Pending decision | +| --- | --- | --- | --- | +| [CCR-2026-0017](../../credential-change-requests/CCR-2026-0017-keycape-secrets-engine-approval-client.yaml) | `platform/workloads/secrets-engine/approval-client`, `CLIENT_SECRET` | `approval:read`, `approval:consume` | `b533a271-b704-4c5c-98a2-9a5951aadfb6` | +| [CCR-2026-0018](../../credential-change-requests/CCR-2026-0018-keycape-approval-engine-operator-client.yaml) | `platform/workloads/approval-engine/operator-client`, `CLIENT_SECRET` | create/read/approve/revoke/supersede/observe/emit; no consume | `efa90517-0cae-4eb6-a68d-5b0489c84d65` | + +Both require **platform-operator and key-cape-owner** review. Each has its own +exact-path policy, Kubernetes auth role and ClusterSecretStore, bound to +`external-secrets/external-secrets`, limited to `sso`. ESO owns the resulting +Secret; authentication tokens have a 15-minute TTL. Client secrets require +explicit rotation or registration disablement; token expiry does not revoke them. + +The approved object would authorize verifier-side custody only. Client-side +retrieval, audit sender/receiver custody, operator `approval:consume`, adoption +of the Qonto Secret and factory spending remain outside these two requests. + +Technical review completed: both CCRs validate, their generated policies match +the two source HCL files, and the delivery manifests map exactly to the declared +paths and fields. The signed upstream issuer is verified; NetKingdom's exact live +pin is independently read back at Secret revision `58713343`. The compatible +KeyCape image and rollout patch are prepared. These checks are evidence for the +review, not substitutes for either named approval. + +Execution still follows the [owner rollout sequence](keycape-approval-clients.md) +through the founder-attended Warden/OpenBao envelope: policy/roles, CAS=0 initial +custody, Valid stores, SecretSynced delivery, compatible config/image replacement, +then positive and negative acceptance and metadata-only receipts. The generated +plan leaves initial secret provisioning to the contained owner procedure; it is +not an already exercised end-to-end activation command. Finish and exercise that +procedure before opening the activation window. Current proposed requests refuse +`apply-plan`; no status has been changed to get around that refusal. + +Review outcome: approve, deny or needs changes, naming the reviewer and the role +they are accepting. Both required role confirmations must be recorded for each +CCR before execution. A generic CLI status change alone is insufficient evidence +that both reviews occurred. No owner messages or browser login were triggered +by preparation of this packet. diff --git a/docs/credential-lane-designs/keycape-approval-clients.md b/docs/credential-lane-designs/keycape-approval-clients.md index 75f94e0..e6c1080 100644 --- a/docs/credential-lane-designs/keycape-approval-clients.md +++ b/docs/credential-lane-designs/keycape-approval-clients.md @@ -117,9 +117,11 @@ Prerequisites before the window opens: The admitted probe passed signature/audience/time/nonce verification on 2026-09-08 at 21:44:44 UTC, exited 0 and removed every temporary resource. [Receipt](../evidence/2026-09-08-keycape-upstream-issuer-proof.json). - The configuration owner must still ensure `authelia.issuer` is pinned to - that exact value before this window. The probe left normal configuration - unchanged. Keep the existing-human-login regression in the rollout checks. + NetKingdom completed the exact `authelia.issuer` pin on 2026-09-09, + with unchanged signing key and unrelated configuration; Secret revision + `58713343`. [Pin receipt](../evidence/2026-09-09-keycape-upstream-issuer-pin.json). + This prerequisite is closed. Keep the existing-human-login regression in + the separately admitted image/configuration rollout checks. In-window order: @@ -178,3 +180,8 @@ Use an absolute path to the owner command if invoking from another directory. It emits no output or values; inspect its allowlisted capability metadata only after Warden has completed revocation and cleanup. No custody activation or approval is performed by this preflight. + + +2026-09-09: the live issuer pin is complete. The next review is captured in +[keycape-approval-clients-review.md](keycape-approval-clients-review.md), with +one pending Hub decision per existing CCR and both required reviewer roles. diff --git a/docs/evidence/2026-09-09-keycape-upstream-issuer-pin.json b/docs/evidence/2026-09-09-keycape-upstream-issuer-pin.json new file mode 100644 index 0000000..62fe341 --- /dev/null +++ b/docs/evidence/2026-09-09-keycape-upstream-issuer-pin.json @@ -0,0 +1,93 @@ +{ + "schema": "netkingdom.keycape-issuer-pin-live-evidence.v1", + "recorded_at": "2026-09-08T22:24:00.262369+00:00", + "authorization": "User continuation: good, go on, after the explicit next step to ensure the verified issuer configuration pin.", + "source_commit": "ad9979b159f56a5d77004031dea4a897e61751dc", + "signed_issuer_proof_ref": "key-cape/docs/evidence/2026-09-08-upstream-issuer-live-proof.json", + "check_before": { + "before": { + "resource_version": "51346058", + "uid": "2e94519d-1550-41c7-9701-2efe47fe1fd3" + }, + "config_changed": false, + "deployment_changed": false, + "issuer_matches": false, + "mode": "issuer-check-live", + "observed_at": "2026-09-08T22:23:58.199881+00:00", + "prior_pin_state": "absent", + "schema": "netkingdom.keycape-issuer-pin.v1", + "secret_values_emitted": false, + "target": "sso/keycape-config", + "verified_issuer": "https://auth.coulomb.social" + }, + "pin": { + "after": { + "resource_version": "58713343", + "uid": "2e94519d-1550-41c7-9701-2efe47fe1fd3" + }, + "before": { + "resource_version": "51346058", + "uid": "2e94519d-1550-41c7-9701-2efe47fe1fd3" + }, + "config_changed": true, + "deployment_changed": false, + "issuer_matches": true, + "mode": "issuer-pin-live", + "observed_at": "2026-09-08T22:23:58.727554+00:00", + "other_secret_data_unchanged": true, + "prior_pin_state": "absent", + "schema": "netkingdom.keycape-issuer-pin.v1", + "secret_values_emitted": false, + "target": "sso/keycape-config", + "unrelated_config_bytes_preserved": true, + "verified_issuer": "https://auth.coulomb.social" + }, + "check_after": { + "before": { + "resource_version": "58713343", + "uid": "2e94519d-1550-41c7-9701-2efe47fe1fd3" + }, + "config_changed": false, + "deployment_changed": false, + "issuer_matches": true, + "mode": "issuer-check-live", + "observed_at": "2026-09-08T22:23:59.920100+00:00", + "prior_pin_state": "matching", + "schema": "netkingdom.keycape-issuer-pin.v1", + "secret_values_emitted": false, + "target": "sso/keycape-config", + "verified_issuer": "https://auth.coulomb.social" + }, + "deployment_before": { + "uid": "99ddd83c-cb3f-4847-bcf8-35f1aa87627f", + "resource_version": "55113259", + "generation": 29, + "images": [ + { + "name": "keycape", + "image": "forgejo.coulomb.social/coulomb/key-cape:main-153258b" + } + ], + "ready_replicas": 1, + "available_replicas": 1 + }, + "deployment_after": { + "uid": "99ddd83c-cb3f-4847-bcf8-35f1aa87627f", + "resource_version": "55113259", + "generation": 29, + "images": [ + { + "name": "keycape", + "image": "forgejo.coulomb.social/coulomb/key-cape:main-153258b" + } + ], + "ready_replicas": 1, + "available_replicas": 1 + }, + "deployment_unchanged": true, + "tests_passed": 13, + "credential_values_emitted": false, + "custody_activated": false, + "ccr_reviews_completed": false, + "process_reload_or_new_image_proved": false +} diff --git a/workplans/RPF-WP-0035-credential-lane-implementation.md b/workplans/RPF-WP-0035-credential-lane-implementation.md index 6adf481..d71f800 100644 --- a/workplans/RPF-WP-0035-credential-lane-implementation.md +++ b/workplans/RPF-WP-0035-credential-lane-implementation.md @@ -146,6 +146,8 @@ closure: `history/2026-09-05-preflight-signing-activation-complete.md`. ```task id: RPF-WP-0035-T05 status: wait +needs_human: true +intervention_note: "Review CCR-2026-0017 and CCR-2026-0018 as platform-operator and key-cape-owner; both pending decisions are linked from the CCRs and the review packet. Signed issuer and exact configuration pin are proved." priority: high state_hub_task_id: "e15d62c9-e5da-5721-a135-87c050f7851c" ``` @@ -203,6 +205,19 @@ custody mutation or client-side read. Keep the current authority preflight and this signed-token proof as separate receipts. Live ESO/client/approval and separate audit/client-side custody acceptance remain open. + +2026-09-09 configuration and review-queue return: NetKingdom pinned the verified +HTTPS issuer, using an atomic UID/resourceVersion test and independent readback. +Secret revision `58713343`; unrelated configuration and signing key unchanged; +no Deployment rollout. Receipt: `docs/evidence/2026-09-09-keycape-upstream-issuer-pin.json`. + +The two existing CCRs remain proposed. They now link to concrete pending review +decisions, with platform-operator and key-cape-owner named explicitly. See +`docs/credential-lane-designs/keycape-approval-clients-review.md`. T05 owns this +human dependency; HFACT consumes it without a duplicate approval request. +Custody/ESO activation, client verification and the separate client-side/audit +lanes remain open. Current CLI apply plans refuse the proposed requests. + ## Dependency review — 2026-09-06 SECRETS-WP-0008-T02 now records the local PIP claim/validation join implemented