From 5cc325b7448e9a7a1af256710e6a9a41b2eb6dfe Mon Sep 17 00:00:00 2001 From: codex Date: Fri, 11 Sep 2026 06:47:35 +0200 Subject: [PATCH] Record operator approval of the two factory audit sender lanes Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a07ff8-19d0-7820-b4d0-1353833cb7fc --- .../CCR-2026-0021-approval-engine-audit.yaml | 107 ++++++++++------- ...CCR-2026-0022-informed-decision-audit.yaml | 110 ++++++++++-------- .../factory-audit-senders-review.md | 14 ++- manifests/factory-audit-senders.yaml | 10 +- tests/test_factory_audit_custody.py | 6 +- ...-WP-0035-credential-lane-implementation.md | 14 ++- 6 files changed, 155 insertions(+), 106 deletions(-) diff --git a/credential-change-requests/CCR-2026-0021-approval-engine-audit.yaml b/credential-change-requests/CCR-2026-0021-approval-engine-audit.yaml index 0c5f0a3..9dcebe9 100644 --- a/credential-change-requests/CCR-2026-0021-approval-engine-audit.yaml +++ b/credential-change-requests/CCR-2026-0021-approval-engine-audit.yaml @@ -3,29 +3,38 @@ kind: credential-change-request schema_version: 1 request_type: workload-kv-read title: approval-engine load-bearing audit sender custody and delivery -status: proposed +status: approved created: '2026-09-11' updated: '2026-09-11' requester: agent: codex - reason: AUDIT-WP-0009-T09 and HFACT-WP-0001-T03 require the existing exact sender declaration. This - request supplies the missing platform custody and ESO delivery; receiver compatibility and service - rollout remain explicit gates. + reason: AUDIT-WP-0009-T09 and HFACT-WP-0001-T03 require the existing exact sender + declaration. This request supplies the missing platform custody and ESO delivery; + receiver compatibility and service rollout remain explicit gates. review: required: true required_approvers: - platform-operator - audit-core-owner - approval-engine-owner - comments: [] + comments: + - at: '2026-09-11T04:36:46+00:00' + reviewer: user (platform-operator, audit-core-owner, approval-engine-owner) + decision: approved + comment: User replied "good, go on" on 2026-09-11 to the explicit approval question + for CCR-2026-0021 and CCR-2026-0022 as platform operator and owner of Audit + Core, Approval Engine, and Informed Decision. Record this as approval of the + reviewed exact sender lane. Compatible receiver, namespace readiness, attended + custody and native verification remain prerequisites; no factory execution or + broader grant is admitted. target: domain: financials tenant: platform workload: approval-engine environment: production purpose: Provide only the approval-engine sender with source=approval-engine, tenants=[tenant:platform], - may_write=true, may_read=false, evidence_kind=load-bearing, secret_policy=redact. Preserve the - existing receiver registry and every other sender. + may_write=true, may_read=false, evidence_kind=load-bearing, secret_policy=redact. + Preserve the existing receiver registry and every other sender. openbao: mount: platform kv_path: platform/workloads/approval-engine/audit-sender @@ -55,56 +64,64 @@ access_frontdoor: resolvable: false delivery: surface: external-secrets - target: 'ClusterSecretStore openbao-approval-engine-audit restricted to namespace approval-engine; - ExternalSecret and Secret approval-engine/approval-engine-audit, key audit-token. Source: manifests/factory-audit-senders.yaml. - A missing namespace stays a workload-owner prerequisite; this packet creates none.' + target: 'ClusterSecretStore openbao-approval-engine-audit restricted to namespace + approval-engine; ExternalSecret and Secret approval-engine/approval-engine-audit, + key audit-token. Source: manifests/factory-audit-senders.yaml. A missing namespace + stays a workload-owner prerequisite; this packet creates none.' risk: classification: high notes: - - A bearer permits append for its exact sender and tenant, never reading or changing stored evidence. - - The registry update reads existing sender credentials inside the attended platform process only. - No registry is delivered to a producer. - - OpenBao login TTL limits the ESO reader session, not the audit bearer. Revocation must remove - the sender token from the receiver registry and prove refusal. - - New paths extend the existing coding-agent deny boundary. No existing high-risk grant is widened. + - A bearer permits append for its exact sender and tenant, never reading or changing + stored evidence. + - The registry update reads existing sender credentials inside the attended platform + process only. No registry is delivered to a producer. + - OpenBao login TTL limits the ESO reader session, not the audit bearer. Revocation + must remove the sender token from the receiver registry and prove refusal. + - New paths extend the existing coding-agent deny boundary. No existing high-risk + grant is widened. verification: positive: - - Independent CAS=0 token creation and exact sender merge with registry-version compare-and-set; - repeated runs preserve both tokens and other registry fields. - - ESO delivers only AUDIT_TOKEN into approval-engine/approval-engine-audit:audit-token; source and - receiver copies agree without displaying values. - - Compatible deployed receiver accepts and deduplicates a declared synthetic event for the exact - sender and tenant, retaining load-bearing/redact declarations. + - Independent CAS=0 token creation and exact sender merge with registry-version + compare-and-set; repeated runs preserve both tokens and other registry fields. + - ESO delivers only AUDIT_TOKEN into approval-engine/approval-engine-audit:audit-token; + source and receiver copies agree without displaying values. + - Compatible deployed receiver accepts and deduplicates a declared synthetic event + for the exact sender and tenant, retaining load-bearing/redact declarations. negative: - - Sibling sender path, full registry and parent listing are denied to each workload reader. Wrong - service account/namespace and disallowed store namespace fail. - - Receiver denies sibling source, wrong tenant, every read route and revoked token. No existing - sender is removed or re-scoped. - - Proposed or altered CCR, legacy receiver, malformed/duplicate registry identity, token collision, - stale registry version or partial/conflicting custody refuses without overwriting. + - Sibling sender path, full registry and parent listing are denied to each workload + reader. Wrong service account/namespace and disallowed store namespace fail. + - Receiver denies sibling source, wrong tenant, every read route and revoked token. + No existing sender is removed or re-scoped. + - Proposed or altered CCR, legacy receiver, malformed/duplicate registry identity, + token collision, stale registry version or partial/conflicting custody refuses + without overwriting. activation_conditions: - All three named owner reviews are approved before any native credential mutation. - - A current image supporting evidence_kind is published/admitted by audit-core and deployed with - its source scope and network policy; current c2fe39a image fails compatibility. - - Use the Warden attended platform-admin login envelope; preserve independent receipt and revoke - the session on exit. - - Apply reviewed policy/auth metadata and ESO projection only after receiver compatibility and namespace - readiness. An interrupted seed resumes from durable KV values, never blindly rotates or deletes. - - Record native positive/negative evidence before declaring verified or active. Custody alone does - not admit UI, human approval or factory execution. + - A current image supporting evidence_kind is published/admitted by audit-core and + deployed with its source scope and network policy; current c2fe39a image fails + compatibility. + - Use the Warden attended platform-admin login envelope; preserve independent receipt + and revoke the session on exit. + - Apply reviewed policy/auth metadata and ESO projection only after receiver compatibility + and namespace readiness. An interrupted seed resumes from durable KV values, never + blindly rotates or deletes. + - Record native positive/negative evidence before declaring verified or active. + Custody alone does not admit UI, human approval or factory execution. lifecycle: - deactivate: Stop the exact producer; remove only its admitted token from the registry using CAS - and reload/verify receiver refusal. Then detach its reader policy and remove its ExternalSecret/projection, - retaining KV versions for investigation. Do not delete audit events or other sender entries. - rotate: 'Reviewed overlap-first rotation: append a replacement to this sender only, deliver it, - prove acceptance, then remove the predecessor and prove refusal. The first-provision helper refuses - rotation and unexpected existing values.' - compromised: Stop affected producer and revoke the exact receiver token first; inspect affected - source/tenant events, rotate through a separate reviewed action, and preserve the independent - audit trail. + deactivate: Stop the exact producer; remove only its admitted token from the registry + using CAS and reload/verify receiver refusal. Then detach its reader policy and + remove its ExternalSecret/projection, retaining KV versions for investigation. + Do not delete audit events or other sender entries. + rotate: 'Reviewed overlap-first rotation: append a replacement to this sender only, + deliver it, prove acceptance, then remove the predecessor and prove refusal. The + first-provision helper refuses rotation and unexpected existing values.' + compromised: Stop affected producer and revoke the exact receiver token first; inspect + affected source/tenant events, rotate through a separate reviewed action, and + preserve the independent audit trail. state_hub: workplan_id: RPF-WP-0035 task_id: RPF-WP-0035-T08 related_workplan: AUDIT-WP-0009-T09 decision_id: 2c9fe9f0-034a-41d7-9d49-b99df488fdc8 decision_api_url: http://127.0.0.1:8000/decisions/2c9fe9f0-034a-41d7-9d49-b99df488fdc8 + decision_resolved_at: '2026-09-11T04:36:46.312720Z' diff --git a/credential-change-requests/CCR-2026-0022-informed-decision-audit.yaml b/credential-change-requests/CCR-2026-0022-informed-decision-audit.yaml index 5fb71c0..b0c1ba5 100644 --- a/credential-change-requests/CCR-2026-0022-informed-decision-audit.yaml +++ b/credential-change-requests/CCR-2026-0022-informed-decision-audit.yaml @@ -3,29 +3,39 @@ kind: credential-change-request schema_version: 1 request_type: workload-kv-read title: informed-decision load-bearing audit sender custody and delivery -status: proposed +status: approved created: '2026-09-11' updated: '2026-09-11' requester: agent: codex - reason: AUDIT-WP-0009-T11 and HFACT-WP-0001-T03 require the existing exact sender declaration. This - request supplies the missing platform custody and ESO delivery; receiver compatibility and service - rollout remain explicit gates. + reason: AUDIT-WP-0009-T11 and HFACT-WP-0001-T03 require the existing exact sender + declaration. This request supplies the missing platform custody and ESO delivery; + receiver compatibility and service rollout remain explicit gates. review: required: true required_approvers: - platform-operator - audit-core-owner - informed-decision-owner - comments: [] + comments: + - at: '2026-09-11T04:36:46+00:00' + reviewer: user (platform-operator, audit-core-owner, informed-decision-owner) + decision: approved + comment: User replied "good, go on" on 2026-09-11 to the explicit approval question + for CCR-2026-0021 and CCR-2026-0022 as platform operator and owner of Audit + Core, Approval Engine, and Informed Decision. Record this as approval of the + reviewed exact sender lane. Compatible receiver, namespace readiness, attended + custody and native verification remain prerequisites; no factory execution or + broader grant is admitted. target: domain: financials tenant: platform workload: informed-decision environment: production - purpose: Provide only the informed-decision sender with source=informed-decision, tenants=[tenant:platform], - may_write=true, may_read=false, evidence_kind=load-bearing, secret_policy=redact. Preserve the - existing receiver registry and every other sender. + purpose: Provide only the informed-decision sender with source=informed-decision, + tenants=[tenant:platform], may_write=true, may_read=false, evidence_kind=load-bearing, + secret_policy=redact. Preserve the existing receiver registry and every other + sender. openbao: mount: platform kv_path: platform/workloads/informed-decision/audit-sender @@ -55,56 +65,64 @@ access_frontdoor: resolvable: false delivery: surface: external-secrets - target: 'ClusterSecretStore openbao-informed-decision-audit restricted to namespace informed-decision; - ExternalSecret and Secret informed-decision/informed-decision-audit, key token. Source: manifests/factory-audit-senders.yaml. - A missing namespace stays a workload-owner prerequisite; this packet creates none.' + target: 'ClusterSecretStore openbao-informed-decision-audit restricted to namespace + informed-decision; ExternalSecret and Secret informed-decision/informed-decision-audit, + key token. Source: manifests/factory-audit-senders.yaml. A missing namespace stays + a workload-owner prerequisite; this packet creates none.' risk: classification: high notes: - - A bearer permits append for its exact sender and tenant, never reading or changing stored evidence. - - The registry update reads existing sender credentials inside the attended platform process only. - No registry is delivered to a producer. - - OpenBao login TTL limits the ESO reader session, not the audit bearer. Revocation must remove - the sender token from the receiver registry and prove refusal. - - New paths extend the existing coding-agent deny boundary. No existing high-risk grant is widened. + - A bearer permits append for its exact sender and tenant, never reading or changing + stored evidence. + - The registry update reads existing sender credentials inside the attended platform + process only. No registry is delivered to a producer. + - OpenBao login TTL limits the ESO reader session, not the audit bearer. Revocation + must remove the sender token from the receiver registry and prove refusal. + - New paths extend the existing coding-agent deny boundary. No existing high-risk + grant is widened. verification: positive: - - Independent CAS=0 token creation and exact sender merge with registry-version compare-and-set; - repeated runs preserve both tokens and other registry fields. - - ESO delivers only AUDIT_TOKEN into informed-decision/informed-decision-audit:token; source and - receiver copies agree without displaying values. - - Compatible deployed receiver accepts and deduplicates a declared synthetic event for the exact - sender and tenant, retaining load-bearing/redact declarations. + - Independent CAS=0 token creation and exact sender merge with registry-version + compare-and-set; repeated runs preserve both tokens and other registry fields. + - ESO delivers only AUDIT_TOKEN into informed-decision/informed-decision-audit:token; + source and receiver copies agree without displaying values. + - Compatible deployed receiver accepts and deduplicates a declared synthetic event + for the exact sender and tenant, retaining load-bearing/redact declarations. negative: - - Sibling sender path, full registry and parent listing are denied to each workload reader. Wrong - service account/namespace and disallowed store namespace fail. - - Receiver denies sibling source, wrong tenant, every read route and revoked token. No existing - sender is removed or re-scoped. - - Proposed or altered CCR, legacy receiver, malformed/duplicate registry identity, token collision, - stale registry version or partial/conflicting custody refuses without overwriting. + - Sibling sender path, full registry and parent listing are denied to each workload + reader. Wrong service account/namespace and disallowed store namespace fail. + - Receiver denies sibling source, wrong tenant, every read route and revoked token. + No existing sender is removed or re-scoped. + - Proposed or altered CCR, legacy receiver, malformed/duplicate registry identity, + token collision, stale registry version or partial/conflicting custody refuses + without overwriting. activation_conditions: - All three named owner reviews are approved before any native credential mutation. - - A current image supporting evidence_kind is published/admitted by audit-core and deployed with - its source scope and network policy; current c2fe39a image fails compatibility. - - Use the Warden attended platform-admin login envelope; preserve independent receipt and revoke - the session on exit. - - Apply reviewed policy/auth metadata and ESO projection only after receiver compatibility and namespace - readiness. An interrupted seed resumes from durable KV values, never blindly rotates or deletes. - - Record native positive/negative evidence before declaring verified or active. Custody alone does - not admit UI, human approval or factory execution. + - A current image supporting evidence_kind is published/admitted by audit-core and + deployed with its source scope and network policy; current c2fe39a image fails + compatibility. + - Use the Warden attended platform-admin login envelope; preserve independent receipt + and revoke the session on exit. + - Apply reviewed policy/auth metadata and ESO projection only after receiver compatibility + and namespace readiness. An interrupted seed resumes from durable KV values, never + blindly rotates or deletes. + - Record native positive/negative evidence before declaring verified or active. + Custody alone does not admit UI, human approval or factory execution. lifecycle: - deactivate: Stop the exact producer; remove only its admitted token from the registry using CAS - and reload/verify receiver refusal. Then detach its reader policy and remove its ExternalSecret/projection, - retaining KV versions for investigation. Do not delete audit events or other sender entries. - rotate: 'Reviewed overlap-first rotation: append a replacement to this sender only, deliver it, - prove acceptance, then remove the predecessor and prove refusal. The first-provision helper refuses - rotation and unexpected existing values.' - compromised: Stop affected producer and revoke the exact receiver token first; inspect affected - source/tenant events, rotate through a separate reviewed action, and preserve the independent - audit trail. + deactivate: Stop the exact producer; remove only its admitted token from the registry + using CAS and reload/verify receiver refusal. Then detach its reader policy and + remove its ExternalSecret/projection, retaining KV versions for investigation. + Do not delete audit events or other sender entries. + rotate: 'Reviewed overlap-first rotation: append a replacement to this sender only, + deliver it, prove acceptance, then remove the predecessor and prove refusal. The + first-provision helper refuses rotation and unexpected existing values.' + compromised: Stop affected producer and revoke the exact receiver token first; inspect + affected source/tenant events, rotate through a separate reviewed action, and + preserve the independent audit trail. state_hub: workplan_id: RPF-WP-0035 task_id: RPF-WP-0035-T08 related_workplan: AUDIT-WP-0009-T11 decision_id: ee4ff001-256a-4406-9cb8-51be2cd5d31b decision_api_url: http://127.0.0.1:8000/decisions/ee4ff001-256a-4406-9cb8-51be2cd5d31b + decision_resolved_at: '2026-09-11T04:36:46.480026Z' diff --git a/docs/credential-lane-designs/factory-audit-senders-review.md b/docs/credential-lane-designs/factory-audit-senders-review.md index 8ef9cf0..fa7fd08 100644 --- a/docs/credential-lane-designs/factory-audit-senders-review.md +++ b/docs/credential-lane-designs/factory-audit-senders-review.md @@ -1,11 +1,13 @@ # Factory audit senders: concrete custody review -CCR-2026-0021 and CCR-2026-0022 are **proposed**. RPF-WP-0035-T08 owns the -platform work; AUDIT-WP-0009-T09/T11 retain receiver admission. This packet -requires the named platform operator, Audit Core owner and each producer owner -to approve its request before native credential mutation. +CCR-2026-0021 and CCR-2026-0022 are **approved** by the user on 2026-09-11, +replying "good, go on" to the explicit question naming the platform operator, +Audit Core owner, and each producer owner. The source review comments and the +two existing State Hub decisions record that approval. RPF-WP-0035-T08 owns +platform execution; AUDIT-WP-0009-T09/T11 retain receiver admission. Approval +alone does not mark custody delivered or either producer admitted. -## Scope to approve +## Approved scope | Request | Producer / exact source | OpenBao path | Producer Secret / key | | --- | --- | --- | --- | @@ -24,7 +26,7 @@ log in to the reader role (15-minute session). Neither producer can read the full sender registry or its sibling's token. The coding-agent boundary gains exact denies on the two new data/metadata paths; existing rules are preserved. -The approved first-provision operation would generate two independent values +The approved first-provision operation generates two independent values in the attended platform process, store them with CAS=0, and append the exact identities to `platform/workloads/audit-core/senders` with compare-and-set on its observed KV version. That process necessarily reads the existing registry diff --git a/manifests/factory-audit-senders.yaml b/manifests/factory-audit-senders.yaml index 803a869..92de187 100644 --- a/manifests/factory-audit-senders.yaml +++ b/manifests/factory-audit-senders.yaml @@ -1,11 +1,11 @@ -# CCR-2026-0021/0022. Review only; no credentials or namespaces. +# CCR-2026-0021/0022 approved 2026-09-11; no credentials or namespaces. apiVersion: external-secrets.io/v1 kind: ClusterSecretStore metadata: name: openbao-approval-engine-audit annotations: railiance.io/credential-change: CCR-2026-0021 - railiance.io/admission: proposed + railiance.io/admission: approved spec: provider: vault: @@ -30,7 +30,7 @@ metadata: namespace: approval-engine annotations: railiance.io/credential-change: CCR-2026-0021 - railiance.io/admission: proposed + railiance.io/admission: approved spec: refreshInterval: 5m secretStoreRef: @@ -52,7 +52,7 @@ metadata: name: openbao-informed-decision-audit annotations: railiance.io/credential-change: CCR-2026-0022 - railiance.io/admission: proposed + railiance.io/admission: approved spec: provider: vault: @@ -77,7 +77,7 @@ metadata: namespace: informed-decision annotations: railiance.io/credential-change: CCR-2026-0022 - railiance.io/admission: proposed + railiance.io/admission: approved spec: refreshInterval: 5m secretStoreRef: diff --git a/tests/test_factory_audit_custody.py b/tests/test_factory_audit_custody.py index b9ee3d7..85c975a 100644 --- a/tests/test_factory_audit_custody.py +++ b/tests/test_factory_audit_custody.py @@ -22,7 +22,11 @@ import factory_audit_custody as lane class Contracts(unittest.TestCase): def test_proposed_requests_cannot_seed(self): self.assertEqual(len(lane.contracts()),2) - with patch.object(lane,'bao',side_effect=AssertionError('must not contact Bao')): + module=lane.credential_module(); original=module.validate_ccr + def proposed(path): + c,errors,warnings=original(path); c=copy.deepcopy(c); c['status']='proposed' + return c,errors,warnings + with patch.object(module,'validate_ccr',side_effect=proposed), patch.object(lane,'credential_module',return_value=module), patch.object(lane,'bao',side_effect=AssertionError('must not contact Bao')): with self.assertRaisesRegex(lane.LaneError,'approved_ccrs_required'): lane.contracts(approved=True) diff --git a/workplans/RPF-WP-0035-credential-lane-implementation.md b/workplans/RPF-WP-0035-credential-lane-implementation.md index 2135ddf..2b2f5c3 100644 --- a/workplans/RPF-WP-0035-credential-lane-implementation.md +++ b/workplans/RPF-WP-0035-credential-lane-implementation.md @@ -407,11 +407,11 @@ state_hub_task_id: "0ef52c26-2669-5cd1-8149-b1f6fcdda6cb" Consume AUDIT-WP-0009-T09/T11's exact declarations for approval-engine and informed-decision: tenant:platform, write-only, load-bearing, redact. Source -preparation supplies two proposed CCRs, independent exact-path policies/ESO +preparation supplies two approved CCRs, independent exact-path policies/ESO projections, and the attended `factory_audit_custody.py` first-provision helper. Its CAS and request-provenance checks preserve unrelated senders and recover -interrupted writes without generating replacements. Native reviews and -provision/delivery/receiver-ingestion acceptance remain open. +interrupted writes without generating replacements. The user approved all named review roles on 2026-09-11. Native +provision/delivery/receiver-ingestion acceptance remains open. The 2026-09-11 native read-only check found an additional deployment dependency: receiver image c2fe39a is 1/1 Ready but does not support evidence_kind. The @@ -473,3 +473,11 @@ T05 remains wait: both CCRs are still proposed, the actual upstream ID-token issuer precondition remains open, and no verifier-side credential is provisioned. Client-side retrieval and audit-sender custody are still separate owner returns. The capability receipt is not a review approval or service readiness proof. + +### Sender approval recorded — 2026-09-11 + +The user replied "good, go on" to the explicit CCR-2026-0021/0022 question naming +platform-operator, audit-core-owner and both producer owners. Both exact requests +are approved; their existing State Hub decisions are resolved. This clears the +review request only. Receiver rollout, namespace readiness, attended custody and +positive/negative native evidence remain the execution gates.