diff --git a/docs/credential-lane-designs/t03-renewed-execution.md b/docs/credential-lane-designs/t03-renewed-execution.md new file mode 100644 index 0000000..fd5526a --- /dev/null +++ b/docs/credential-lane-designs/t03-renewed-execution.md @@ -0,0 +1,25 @@ +# T03 continuation after Railiance Clock deployment + +The original requests expired unconsumed. Replacement request IDs and immutable +memo version 2 are recorded in the creation receipt and Secrets Engine workplan. +The exact apply/verify/exec action requests and checker pins are unchanged. + +Run the requester and execution worker with +`/home/worsch/secrets-engine/.venv/bin/python`; this environment includes Clock, +JSON Schema, JWT, and YAML dependencies. The requester requires +`--clock-trust-file` and validates full token validity against that interval. +The native execution worker requires `SECRETS_ENGINE_CLOCK_TRUST_FILE`. +Refresh the boot-bound admission via the independently verified Clock public key +and SSH owner epoch readback immediately before attended execution. An expired +trust file fails closed; never extend it or use workstation wall-time fallback. + +Use `http://127.0.0.1:18200` for the admitted OpenBao relay and the existing +`operator-browser` PATH helper on WSL when no browser launcher is installed. +The outer lane remains secrets-engine-approval-client-login; its reviewed +`t03-attended-delivery.py` invokes the separate contained platform-admin lane. +Both retain their own self-revocation and private runtime cleanup. + +Human review: https://decisions.coulomb.social/review?memo_id=SECRETS-WP-0010-T03-apply +(and identifiers ending -verify and -exec). Version 2 is required. The requester +has no approval or consume scope; no human entries are copied from version 1. +No execution may begin before the new approvals pass native claim/PDP checks. diff --git a/docs/evidence/2026-09-15-t03-renewed-approval-requests.json b/docs/evidence/2026-09-15-t03-renewed-approval-requests.json new file mode 100644 index 0000000..c627f11 --- /dev/null +++ b/docs/evidence/2026-09-15-t03-renewed-approval-requests.json @@ -0,0 +1,147 @@ +{ + "observed_at": "2026-09-15T22:28:23.009075+00:00", + "status": "created", + "phase": "three_unapproved_requests_created", + "requests": [ + { + "memo_id": "SECRETS-WP-0010-T03-apply", + "memo_version": 2, + "action": "apply", + "approval": { + "binding": { + "action": "apply", + "actor": "secrets-engine", + "digest": "sha256:03cc5b37437f14e86b686ce4054f976556334eff3fa260b03e8014ed3d9217e5", + "human_control": true, + "pdp_digest": "sha256:933427642c58c54f65dd4781b8e4c8e2f358eb96497ae35870fff4bd593d2b84", + "pdp_path": true, + "principal": "secrets-engine", + "purpose": "IR-WP-0004 read-only OpenRouter key authentication check; no inference", + "target": { + "attributes": { + "auth_targets": [ + "se-prod-openrouter-llm-connect" + ], + "fields": [], + "policy_targets": [ + "se-prod-openrouter-llm-connect" + ], + "stage": "prod" + }, + "id": "catalog:openrouter-llm-connect", + "system": "secrets-engine", + "type": "secret-catalog-lane" + } + }, + "created_at": "2026-09-15T22:28:26+00:00", + "entries": [], + "id": "9935335c-8e9a-566e-a48e-6a5b5f4882eb", + "required_count": 1, + "status": "requested", + "superseded_by": null, + "updated_at": "2026-09-15T22:28:26+00:00", + "validity": { + "expires_at": "2026-09-16T22:28:26.260445+00:00", + "not_before": "2026-09-15T22:28:26.260445+00:00" + } + } + }, + { + "memo_id": "SECRETS-WP-0010-T03-verify", + "memo_version": 2, + "action": "verify", + "approval": { + "binding": { + "action": "verify", + "actor": "secrets-engine", + "digest": "sha256:72d9267d038c17107c880ffc9009793ce9c70defbddfe2219628854b811a04b2", + "human_control": true, + "pdp_digest": "sha256:9e36cdbf3890cc5a7e550fd57191f9c0f2a6b2180909aac302aa3b999e7e6b25", + "pdp_path": true, + "principal": "secrets-engine", + "purpose": "IR-WP-0004 read-only OpenRouter key authentication check; no inference", + "target": { + "attributes": { + "auth_targets": [ + "se-prod-openrouter-llm-connect" + ], + "fields": [ + "OPENROUTER_API_KEY" + ], + "policy_targets": [ + "se-prod-openrouter-llm-connect" + ], + "stage": "prod" + }, + "id": "catalog:openrouter-llm-connect", + "system": "secrets-engine", + "type": "secret-catalog-lane" + } + }, + "created_at": "2026-09-15T22:28:26+00:00", + "entries": [], + "id": "273d6882-6253-5dc9-ac54-544f92ef5e56", + "required_count": 1, + "status": "requested", + "superseded_by": null, + "updated_at": "2026-09-15T22:28:26+00:00", + "validity": { + "expires_at": "2026-09-16T22:28:26.464110+00:00", + "not_before": "2026-09-15T22:28:26.464110+00:00" + } + } + }, + { + "memo_id": "SECRETS-WP-0010-T03-exec", + "memo_version": 2, + "action": "exec", + "approval": { + "binding": { + "action": "exec", + "actor": "secrets-engine", + "digest": "sha256:f2cf0fb53b740900756ccde5587c3578fcff44beef2f1edab17b9a198a4033d8", + "human_control": true, + "pdp_digest": "sha256:9f17812750fc8962b0fc58fc09df136850c9935a864fafa998a1c030dfb75bd9", + "pdp_path": true, + "principal": "secrets-engine", + "purpose": "IR-WP-0004 read-only OpenRouter key authentication check; no inference", + "target": { + "attributes": { + "auth_targets": [ + "se-prod-openrouter-llm-connect" + ], + "fields": [ + "OPENROUTER_API_KEY" + ], + "policy_targets": [ + "se-prod-openrouter-llm-connect" + ], + "stage": "prod" + }, + "id": "catalog:openrouter-llm-connect", + "system": "secrets-engine", + "type": "secret-catalog-lane" + } + }, + "created_at": "2026-09-15T22:28:26+00:00", + "entries": [], + "id": "7ba0c13b-68cd-5b3e-9481-42ba9e385e68", + "required_count": 1, + "status": "requested", + "superseded_by": null, + "updated_at": "2026-09-15T22:28:26+00:00", + "validity": { + "expires_at": "2026-09-16T22:28:26.786252+00:00", + "not_before": "2026-09-15T22:28:26.786252+00:00" + } + } + } + ], + "credential_values_emitted": false, + "signature_verified": true, + "excess_scopes_refused": true, + "wrong_secret_refused": true, + "reader_scope_verified": true, + "human_entries_created": false, + "approvals_consumed": false +} diff --git a/scripts/create-t03-approval-requests.py b/scripts/create-t03-approval-requests.py index c894070..ec3d867 100644 --- a/scripts/create-t03-approval-requests.py +++ b/scripts/create-t03-approval-requests.py @@ -1,5 +1,5 @@ """Silent, single-attempt creation of the three operator-reviewed T03 requests.""" -import base64,json,os,stat,subprocess,time +import argparse,base64,json,os,stat,subprocess,time,sys from pathlib import Path from datetime import datetime,timezone,timedelta from urllib.request import Request,build_opener,ProxyHandler,HTTPRedirectHandler @@ -7,7 +7,7 @@ from urllib.parse import urlencode from urllib.error import HTTPError import jwt ROOT=Path('/home/worsch/railiance-platform') -RECEIPT=ROOT/'docs/evidence/2026-09-14-t03-native-approval-requests.json' +RECEIPT=ROOT/'docs/evidence/2026-09-15-t03-renewed-approval-requests.json' POLICY='workload-kv-read-secrets-engine-requester-client' KV='platform/data/workloads/secrets-engine/approval-requester' ISSUER='https://kc.coulomb.social' @@ -55,7 +55,7 @@ def main(receipt): if bao('token','capabilities','-format=json',path)!=expected:raise ValueError('reader_scope_failed') helper=Path.home()/'.vault-token';info=helper.lstat() if not stat.S_ISREG(info.st_mode) or stat.S_IMODE(info.st_mode)!=0o600 or info.st_uid!=os.getuid():raise ValueError('private_helper_required') - status,data=http('https://bao.coulomb.social/v1/'+KV+'?version=1',headers={'X-Vault-Token':helper.read_text().strip()}) + status,data=http('http://127.0.0.1:18200/v1/'+KV+'?version=1',headers={'X-Vault-Token':helper.read_text().strip()}) if status!=200 or data['data']['metadata']['version']!=1:raise ValueError('requester_delivery_failed') secret=data['data']['data']['CLIENT_SECRET'];del data def exchange(scope,credential=secret): @@ -68,7 +68,9 @@ def main(receipt): header=jwt.get_unverified_header(token) keys=[key for key in jwks['keys'] if key['kid']==header.get('kid')] if header.get('alg')!='RS256' or len(keys)!=1:raise ValueError('signing_key_failed') - claims=jwt.decode(token,jwt.PyJWK.from_dict(keys[0]).key,algorithms=['RS256'],issuer=ISSUER,audience='approval-engine',options={'strict_aud':True,'require':['sub','iat','exp','iss','aud']}) + claims=jwt.decode(token,jwt.PyJWK.from_dict(keys[0]).key,algorithms=['RS256'],issuer=ISSUER,audience='approval-engine',options={'strict_aud':True,'require':['sub','iat','exp','iss','aud'],'verify_iat':False,'verify_exp':False,'verify_nbf':False}) + from t03_request_time import validate_token_time + validate_token_time(claims, CLOCK.read()) expected={'sub':'secrets-engine','tenant':'tenant:platform','principal_type':'service','scope':'approval:create','roles':['secrets-engine-requester'],'groups':[]} if any(claims.get(k)!=v for k,v in expected.items()) or claims['exp']-claims['iat']!=900:raise ValueError('requester_claims_failed') for scope in ('approval:approve','approval:consume','approval:read'): @@ -76,16 +78,20 @@ def main(receipt): if exchange('approval:create','invalid-synthetic-credential')[0]!=401:raise ValueError('wrong_secret_not_refused') receipt.update(phase='requester_verified',signature_verified=True,excess_scopes_refused=True,wrong_secret_refused=True,reader_scope_verified=True) for memo,record,pdp_digest in prepared: - now=datetime.now(timezone.utc) + now=datetime.fromtimestamp(CLOCK.read().lower_ns/1e9,timezone.utc) body={'id':record['approval_id'],'binding':record['binding'],'validity':{'not_before':now.isoformat(),'expires_at':(now+timedelta(hours=24)).isoformat()},'required_count':1,'human_control':True,'pdp_path':True,'pdp_digest':pdp_digest} receipt['phase']='create_attempt:'+record['action'];RECEIPT.write_text(json.dumps(receipt,indent=2)+'\n') status,result=http('http://127.0.0.1:18281/v1/approvals',body=json.dumps(body).encode(),headers={'Authorization':'Bearer '+token,'Content-Type':'application/json'}) if status!=201 or result['status']!='requested' or result['entries'] or result['binding']['digest']!=record['binding_digest'] or result['binding']['human_control'] is not True or result['binding']['pdp_digest']!=pdp_digest:raise ValueError('request_creation_requires_reconciliation') - receipt['requests'].append({'memo_id':memo.removeprefix('memo:'),'action':record['action'],'approval':result}) + receipt['requests'].append({'memo_id':memo.removeprefix('memo:'),'memo_version':record['memo_version'],'action':record['action'],'approval':result}) RECEIPT.write_text(json.dumps(receipt,indent=2)+'\n') receipt.update(status='created',phase='three_unapproved_requests_created',human_entries_created=False,approvals_consumed=False) if __name__=='__main__': + p=argparse.ArgumentParser();p.add_argument('--clock-trust-file',type=Path,required=True);a=p.parse_args() + sys.path.insert(0,'/home/worsch/railiance-clock/src') + from railiance_clock.client import Clock,FileTrust + CLOCK=Clock(FileTrust(a.clock_trust_file));CLOCK.read() if RECEIPT.exists():raise SystemExit(1) receipt={'observed_at':datetime.now(timezone.utc).isoformat(),'status':'failed','phase':'preflight','requests':[],'credential_values_emitted':False} try:main(receipt) diff --git a/scripts/t03-attended-delivery.py b/scripts/t03-attended-delivery.py index 007b00a..2105a61 100644 --- a/scripts/t03-attended-delivery.py +++ b/scripts/t03-attended-delivery.py @@ -5,7 +5,7 @@ from datetime import datetime,timezone from urllib.request import Request,build_opener,ProxyHandler,HTTPRedirectHandler ROOT=Path('/home/worsch/railiance-platform') spec=importlib.util.spec_from_file_location('preflight',ROOT/'scripts/approval-client-reader-preflight.py');pre=importlib.util.module_from_spec(spec);spec.loader.exec_module(pre) -RECEIPT=ROOT/'docs/evidence/2026-09-14-t03-attended-delivery.json' +RECEIPT=ROOT/'docs/evidence/2026-09-15-t03-attended-delivery.json' class NoRedirect(HTTPRedirectHandler): def redirect_request(self,*args,**kwargs):return None @@ -15,7 +15,7 @@ def private(path,directory=False): st=path.lstat();require(st.st_uid==os.getuid() and stat.S_IMODE(st.st_mode)==(0o700 if directory else 0o600) and (stat.S_ISDIR(st.st_mode) if directory else stat.S_ISREG(st.st_mode)),'private_path_required') def main(receipt): require(Path.home().parent.name=='.warden-attended-login' and not os.getenv('BAO_TOKEN') and not os.getenv('VAULT_TOKEN'),'attended_reader_required') - require(not Path('/home/worsch/secrets-engine/docs/evidence/2026-09-14-t03-native-execution.json').exists(),'execution_receipt_requires_reconciliation') + require(not Path('/home/worsch/secrets-engine/docs/evidence/2026-09-15-t03-native-execution.json').exists(),'execution_receipt_requires_reconciliation') identity=pre.bao('token','lookup','-format=json')['data'];pre.validate_identity(identity) for path,expected in pre.EXPECTED.items():require(sorted(pre.bao('token','capabilities','-format=json',path))==expected,'reader_scope_failed') runtime=Path('/run/user')/str(os.getuid());private(runtime,True) @@ -24,7 +24,7 @@ def main(receipt): helper=Path.home()/'.vault-token';private(helper) with tempfile.TemporaryDirectory(prefix='t03-native-',dir=runtime) as name: directory=Path(name);private(directory,True) - req=Request('https://bao.coulomb.social/v1/platform/data/workloads/secrets-engine/approval-client?version=1',headers={'X-Vault-Token':helper.read_text().strip()}) + req=Request('http://127.0.0.1:18200/v1/platform/data/workloads/secrets-engine/approval-client?version=1',headers={'X-Vault-Token':helper.read_text().strip()}) with build_opener(ProxyHandler({}),NoRedirect()).open(req,timeout=20) as response: data=response.read(65537);require(len(data)<=65536,'response_bound_exceeded') data=json.loads(data);require(data['data']['metadata']['version']==1,'custody_version_mismatch') @@ -34,7 +34,7 @@ def main(receipt): del value,data,req receipt.update(phase='scoped_reader_delivered',reader_effective_policy_verified=True,existing_kv_version=1) RECEIPT.write_text(json.dumps(receipt,indent=2)+'\n') - p=subprocess.run(['python3',str(ROOT/'scripts/openbao-attended-exec.py'),'--','python3','-B',str(ROOT/'scripts/t03-native-execution.py'),'admin','--directory',str(directory),'--negative-token-file',str(helper)],capture_output=True,timeout=780) + p=subprocess.run(['python3',str(ROOT/'scripts/openbao-attended-exec.py'),'--','/home/worsch/secrets-engine/.venv/bin/python','-B',str(ROOT/'scripts/t03-native-execution.py'),'admin','--directory',str(directory),'--negative-token-file',str(helper)],capture_output=True,timeout=780) # Warden's output remains inside this envelope, never forwarded or stored. require(p.returncode==0,'attended_admin_failed') receipt.update(status='passed',phase='native_actions_completed',admin_warden_exited_0=True) diff --git a/scripts/t03-native-execution.py b/scripts/t03-native-execution.py index 0ba329c..4feac8f 100644 --- a/scripts/t03-native-execution.py +++ b/scripts/t03-native-execution.py @@ -6,6 +6,7 @@ from dataclasses import replace import yaml ROOT=Path('/home/worsch/secrets-engine') sys.path.insert(0,str(ROOT/'src')) +sys.path.insert(0,'/home/worsch/railiance-clock/src') from secrets_engine.config import Config from secrets_engine.catalog import get_entry from secrets_engine.authorization import build_action_request,digest_material @@ -15,10 +16,10 @@ from secrets_engine.decisions import resolve_decision,require_approved from secrets_engine.openbao import OpenBaoClient from secrets_engine.exec_owner import validate_delivery_target from secrets_engine.plan import build_plan -RECEIPT=ROOT/'docs/evidence/2026-09-14-t03-native-execution.json' +RECEIPT=ROOT/'docs/evidence/2026-09-15-t03-native-execution.json' KUBE=['kubectl','--kubeconfig','/home/worsch/.kube/config-railiance01'] ROLE='se-prod-openrouter-llm-connect'; LANE='openrouter-llm-connect' -IDS={'apply':'09592588-ab15-53e7-89b8-c4e9f29aaacf','verify':'9416fa31-fa9e-5603-8289-f35bc9625409','exec':'da678b61-35be-598e-8d95-a7aefa2fdc73'} +IDS={'apply':'9935335c-8e9a-566e-a48e-6a5b5f4882eb','verify':'273d6882-6253-5dc9-ac54-544f92ef5e56','exec':'7ba0c13b-68cd-5b3e-9481-42ba9e385e68'} def require(value,code): if not value:raise ValueError(code) @@ -34,7 +35,7 @@ def prepare(directory): for action,approval in IDS.items(): folder=directory/action;folder.mkdir();doc=copy.deepcopy(source);doc['approval']['authorization_id']=approval (folder/(LANE+'.yaml')).write_text(yaml.safe_dump(doc,sort_keys=False)) - cfg=replace(Config.load(),catalog_dir=folder,bao_addr='https://bao.coulomb.social',approval_url='http://127.0.0.1:18281',approval_token_file=None,approval_client_secret_file=directory/'client-secret',keycape_token_url='https://kc.coulomb.social/token',keycape_issuer='https://kc.coulomb.social',keycape_client_secret_file=None,openbao_jwt_login_file=None,authorization_subject_id='secrets-engine',authorization_subject_type='service',authorization_policy_package='secrets-engine.catalog-lane.lifecycle',authorization_policy_version='v2',authorization_min_approvals=1,pdp_url='http://127.0.0.1:18282',pdp_token_file=directory/'pdp-caller') + cfg=replace(Config.load(),catalog_dir=folder,bao_addr='http://127.0.0.1:18200',approval_url='http://127.0.0.1:18281',approval_token_file=None,approval_client_secret_file=directory/'client-secret',keycape_token_url='https://kc.coulomb.social/token',keycape_issuer='https://kc.coulomb.social',keycape_client_secret_file=None,openbao_jwt_login_file=None,authorization_subject_id='secrets-engine',authorization_subject_type='service',authorization_policy_package='secrets-engine.catalog-lane.lifecycle',authorization_policy_version='v2',authorization_min_approvals=1,pdp_url='http://127.0.0.1:18282',pdp_token_file=directory/'pdp-caller') entry=get_entry(folder,LANE);fields=() if action=='apply' else tuple(entry.fields) actual=build_action_request(entry,action,subject_id='secrets-engine',subject_type='service',purpose=entry.approval['purpose'],fields=fields,policy_targets=(entry.policy_name,),auth_targets=(entry.role_name,)) expected=json.loads((ROOT/f'docs/evidence/2026-09-14-openrouter-final-{action}-request.json').read_text()) @@ -73,6 +74,9 @@ def admin(directory,negative): require('platform-admin' in policies and 'root' not in policies and identity.get('entity_id') and 0 window.lower_ns + or claims.get("nbf", claims["iat"]) * 1000000000 > window.lower_ns + or claims["exp"] * 1000000000 <= window.upper_ns): + raise ValueError("token_does_not_contain_railiance_interval") diff --git a/tests/test_t03_request_time.py b/tests/test_t03_request_time.py new file mode 100644 index 0000000..164a488 --- /dev/null +++ b/tests/test_t03_request_time.py @@ -0,0 +1,12 @@ +from pathlib import Path +from types import SimpleNamespace +import importlib.util +import unittest +p=Path(__file__).resolve().parents[1]/'scripts/t03_request_time.py' +s=importlib.util.spec_from_file_location('request_time',p);m=importlib.util.module_from_spec(s);s.loader.exec_module(m) +class TokenTimeTests(unittest.TestCase): + def test_full_interval(self):m.validate_token_time({'iat':10,'exp':13},SimpleNamespace(lower_ns=11000000000,upper_ns=12000000000)) + def test_boundaries(self): + for claims in [{'iat':12,'exp':20},{'iat':10,'exp':12},{'iat':10,'exp':13,'nbf':12},{'iat':True,'exp':13}]: + with self.subTest(claims=claims),self.assertRaises(ValueError):m.validate_token_time(claims,SimpleNamespace(lower_ns=11000000000,upper_ns=12000000000)) +if __name__=='__main__':unittest.main()