Keep Forgejo reader blocked on reviewed isolated consumer identity
Assistant: codex Assistant-Model: gpt-6.1-sol Assistant-Session: 01a126e1-76f8-7643-8cf3-e93336539ade
This commit is contained in:
codex
parent
8c152d012a
commit
6b1c1c700d
9 changed files with 316 additions and 1 deletions
|
|
@ -71,4 +71,11 @@ in_flight:
|
|||
missing_fields:
|
||||
- openbao.auth
|
||||
owner: railiance-apps
|
||||
blocking_reason: railiance-apps binds this reader to forgejo's own identity in its deployment path (hand-over).
|
||||
blocking_reason: >-
|
||||
railiance-apps must choose and review the consumer delivery/auth identity. Native
|
||||
forgejo-gitea and forgejo-runner both use forgejo/default; that shared identity
|
||||
must not be filled as a dedicated consumer binding. RAPPS-WP-0016 intends ESO
|
||||
delivery; current type1.1 templates only the KeyCape ESO role, so a consumer
|
||||
role/delivery refinement needs explicit owner review. Historical type1.0 CCR
|
||||
provenance remains unchanged; reconcile exact current1.1 structure before
|
||||
application. See docs/evidence/2026-10-11-forgejo-first-case/owner-return.md.
|
||||
|
|
|
|||
|
|
@ -0,0 +1,33 @@
|
|||
{
|
||||
"scenario_type": "project_driver",
|
||||
"case_id": "forgejo-netkingdom-oidc-owner-follow-through",
|
||||
"driver_workplan_id": "ORGREF-WP-0002",
|
||||
"driver_repo": "prj-forgejo-org-refactor",
|
||||
"beneficiary_workplan_id": "NK-WP-0048",
|
||||
"obligor_workplan_id": "MASON-WP-0010",
|
||||
"flavor": "implementation",
|
||||
"state": "waiting",
|
||||
"reason": "Mason structural receipts and CCR42 consumer delivery binding/application absent; Warden owner-native machine/session integration not installed.",
|
||||
"foreign_commitment_refs": [
|
||||
"MASON-WP-0010-T03",
|
||||
"WARDEN-WP-0044-T03",
|
||||
"RAPPS-WP-0016-T02",
|
||||
"CCR-2026-0042"
|
||||
],
|
||||
"human_gate_refs": [
|
||||
"RAPPS-WP-0016-T01 real break-glass login",
|
||||
"exact metadata apply grant if owner-approved binding changes native auth",
|
||||
"contained first native case session/client restart and verification"
|
||||
],
|
||||
"leased_workers": false,
|
||||
"native_service_wakeup_enabled": false,
|
||||
"central_projection_posted": false,
|
||||
"checkpoint": {
|
||||
"summary": "Existing Forgejo project driver selected; source structural request validated and fixed native workload metadata observed. No copied task list or new workplan.",
|
||||
"files_changed": [
|
||||
"CCR42 blocking-reason clarification and evidence proposal only"
|
||||
],
|
||||
"next_action": "Consumer owner chooses a supported dedicated identity/delivery path; platform reviews/reconciles CCR42 and supplies exact independent structural observations. Native adapters/type descriptors and contained execution follow only after owner acceptance.",
|
||||
"blocked_reason": "owner binding and authenticated native receipts; independent human sessions are separate stops"
|
||||
}
|
||||
}
|
||||
|
|
@ -0,0 +1,37 @@
|
|||
{
|
||||
"central_observed": true,
|
||||
"records": [
|
||||
{
|
||||
"id": "e31f3f9d-0748-5137-b0a3-7b3ca46a66eb",
|
||||
"backing_filename": "NK-WP-0048-security-case-types.md",
|
||||
"backing_relative_path": "workplans/NK-WP-0048-security-case-types.md",
|
||||
"status": "active",
|
||||
"flavor": null,
|
||||
"repo_id": "4589488d-625b-4ffe-b8f0-48744d7b1498"
|
||||
},
|
||||
{
|
||||
"id": "f7e81013-6868-5d99-8528-ba75a442eca9",
|
||||
"backing_filename": "WARDEN-WP-0044-security-case-follow-through.md",
|
||||
"backing_relative_path": "workplans/WARDEN-WP-0044-security-case-follow-through.md",
|
||||
"status": "active",
|
||||
"flavor": null,
|
||||
"repo_id": "74df727e-a756-42de-b776-11928b03bd1f"
|
||||
},
|
||||
{
|
||||
"id": "eabf2c39-94bd-5a11-8f2e-76d7a95d1583",
|
||||
"backing_filename": "MASON-WP-0010-security-case-materialization.md",
|
||||
"backing_relative_path": "workplans/MASON-WP-0010-security-case-materialization.md",
|
||||
"status": "blocked",
|
||||
"flavor": "implementation",
|
||||
"repo_id": "b9066ab1-c6fe-409b-9145-64ba374654db"
|
||||
},
|
||||
{
|
||||
"id": "f873c10f-1408-5bf2-a834-fed88387804b",
|
||||
"backing_filename": "ORGREF-WP-0002-forge-closure-netkingdom-access.md",
|
||||
"backing_relative_path": "workplans/ORGREF-WP-0002-forge-closure-netkingdom-access.md",
|
||||
"status": "blocked",
|
||||
"flavor": "implementation",
|
||||
"repo_id": "01631c7a-f612-4799-892e-a96970d06063"
|
||||
}
|
||||
]
|
||||
}
|
||||
|
|
@ -0,0 +1,80 @@
|
|||
{
|
||||
"observed_at": "2026-10-11T00:50:33.119567+00:00",
|
||||
"secret_objects_read": false,
|
||||
"raw_output_suppressed": true,
|
||||
"workloads": [
|
||||
{
|
||||
"kind": "Deployment",
|
||||
"name": "forgejo-gitea",
|
||||
"uid": "e8eff0aa-64bb-4b44-9a80-a66612986355",
|
||||
"resourceVersion": "67848734",
|
||||
"generation": 11,
|
||||
"readyReplicas": 1,
|
||||
"serviceAccountName": "default",
|
||||
"automountServiceAccountToken": null,
|
||||
"containers": [
|
||||
{
|
||||
"name": "gitea",
|
||||
"image": "code.forgejo.org/forgejo/forgejo:11.0.3-rootless",
|
||||
"env_names": [
|
||||
"SSH_LISTEN_PORT",
|
||||
"SSH_PORT",
|
||||
"GITEA_APP_INI",
|
||||
"GITEA_CUSTOM",
|
||||
"GITEA_WORK_DIR",
|
||||
"GITEA_TEMP",
|
||||
"TMPDIR",
|
||||
"HOME"
|
||||
],
|
||||
"env_secret_refs": []
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"kind": "Deployment",
|
||||
"name": "forgejo-runner",
|
||||
"uid": "89c8a056-bcae-4940-acdd-2eb2768e108a",
|
||||
"resourceVersion": "68161637",
|
||||
"generation": 3,
|
||||
"readyReplicas": 1,
|
||||
"serviceAccountName": "default",
|
||||
"automountServiceAccountToken": null,
|
||||
"containers": [
|
||||
{
|
||||
"name": "dind",
|
||||
"image": "docker:27-dind",
|
||||
"env_names": [
|
||||
"DOCKER_TLS_CERTDIR"
|
||||
],
|
||||
"env_secret_refs": []
|
||||
},
|
||||
{
|
||||
"name": "runner",
|
||||
"image": "code.forgejo.org/forgejo/runner:6.3.1",
|
||||
"env_names": [
|
||||
"DOCKER_HOST"
|
||||
],
|
||||
"env_secret_refs": []
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"delivery": [
|
||||
{
|
||||
"name": "forgejo-mailer",
|
||||
"uid": "cbbea71e-70a8-4010-aca9-9136920f2f58",
|
||||
"store": {
|
||||
"kind": "ClusterSecretStore",
|
||||
"name": "openbao-forgejo"
|
||||
},
|
||||
"target_name": "forgejo-mailer",
|
||||
"ready": true,
|
||||
"remote_paths": [
|
||||
"workloads/forgejo/forgejo-mailer"
|
||||
]
|
||||
}
|
||||
],
|
||||
"deployments_read": true,
|
||||
"statefulsets_read": true,
|
||||
"externalsecrets_read": true
|
||||
}
|
||||
|
|
@ -0,0 +1,21 @@
|
|||
import subprocess,json,datetime
|
||||
remote=r'''
|
||||
import json,subprocess,datetime
|
||||
out={'observed_at':datetime.datetime.now(datetime.timezone.utc).isoformat(),'secret_objects_read':False,'raw_output_suppressed':True,'workloads':[],'delivery':[]}
|
||||
for resource in ['deployments','statefulsets']:
|
||||
r=subprocess.run(['kubectl','get',resource,'-n','forgejo','-o','json'],capture_output=True,text=True)
|
||||
if r.returncode:out[resource+'_read']=False;continue
|
||||
out[resource+'_read']=True
|
||||
for d in json.loads(r.stdout)['items']:
|
||||
s=d['spec']['template']['spec'];out['workloads'].append({'kind':d['kind'],'name':d['metadata']['name'],'uid':d['metadata']['uid'],'resourceVersion':d['metadata']['resourceVersion'],'generation':d['metadata'].get('generation'),'readyReplicas':d.get('status',{}).get('readyReplicas',0),'serviceAccountName':s.get('serviceAccountName','default'),'automountServiceAccountToken':s.get('automountServiceAccountToken'),'containers':[{'name':c['name'],'image':c['image'],'env_names':[e['name'] for e in c.get('env',[])],'env_secret_refs':[{'env':e['name'],'secret_name':e['valueFrom']['secretKeyRef']['name'],'key':e['valueFrom']['secretKeyRef']['key']} for e in c.get('env',[]) if 'secretKeyRef' in e.get('valueFrom',{})]} for c in s['containers']]})
|
||||
r=subprocess.run(['kubectl','get','externalsecrets','-n','forgejo','-o','json'],capture_output=True,text=True)
|
||||
out['externalsecrets_read']=r.returncode==0
|
||||
if not r.returncode:
|
||||
for d in json.loads(r.stdout)['items']:
|
||||
out['delivery'].append({'name':d['metadata']['name'],'uid':d['metadata']['uid'],'store':d['spec'].get('secretStoreRef'),'target_name':d['spec'].get('target',{}).get('name'),'ready':any(c['type']=='Ready' and c['status']=='True' for c in d.get('status',{}).get('conditions',[])),'remote_paths':[x.get('remoteRef',{}).get('key') for x in d['spec'].get('data',[])]})
|
||||
print(json.dumps(out))
|
||||
'''
|
||||
r=subprocess.run(['ssh','railiance01','python3 -'],input=remote,capture_output=True,text=True)
|
||||
try:out=json.loads(r.stdout)
|
||||
except Exception:out={'native_metadata_read':False,'raw_output_suppressed':True}
|
||||
open('/tmp/security-case-forgejo-native-metadata.json','w').write(json.dumps(out,indent=2)+'\n');print(json.dumps(out))
|
||||
27
docs/evidence/2026-10-11-forgejo-first-case/owner-return.md
Normal file
27
docs/evidence/2026-10-11-forgejo-first-case/owner-return.md
Normal file
|
|
@ -0,0 +1,27 @@
|
|||
# First Forgejo SecurityCase owner return — source/native metadata review
|
||||
|
||||
Disposition: source structural preparation is usable, native first-case completion is not ready. Existing driver ORGREF-WP-0002 already coordinates Forgejo closure/sign-in and names NK-WP0048-T06; attach this observed/waiting case there. No new plan or copied foreign task list is needed. Hub records were observed read-only; this receipt is not centrally projected or a worker wake/lease.
|
||||
|
||||
## Exact source/type boundary
|
||||
|
||||
The actual accepted case remains accepted, oidc-browser-relying-party@1.1, raw SHA256 bcc2c6d5bae0d28242b3cdb71e74d8ca297c2afe04766b55d53597f86893351d. Current exact type SHA256 f705c64e4875e9b8e18a912fb51c135e77898926d6a451f5cb74ab3c0cbe4d1c produces full render e64b56e4590b57b858303fcda1a474693e3dd821bc83df26646fe78fc345498a. Prior reviewed full render af1f4f81ef313f5e086e6e3de17197d9112dd40f00b4c20b52b5ca73c7a6d18a is retained, not inherited as current execution approval. Actual read-only Mason structure-request passes and pins structural projection523a9020822a406f4f4cfb36608abbddf01eecf126aae5f2d170100fc4fdd5c0, requestf2ffc19676b257d4ecbbb79b653da19cc097e3a8d5f7cdfe6fd7e69481b4b49f, five exact objects. Source changes are register-client --check-config/startup guard; structural footprint matches, full execution hash remains changed. Current source pins are attached.
|
||||
|
||||
Mason f52c94c structural seam and Warden1b82619 durable kernel are implementation evidence. Human architecture approval e46b149b accepted the exact source design, not a new execution session or the local warden.case.execution.v1 wire schema. The acknowledged descriptive type1.1 has no execution_descriptors map. Machine descriptor/adapter revisions must get specific native-owner review and type acknowledgment/versioned contract before activation; do not label a different machine contract as already acknowledged1.1. A stricter --check-config guard can receive exact technical owner rereview without inventing a fresh founder ratification of unchanged doctrine, but its current source must be pinned in the actual run sheet. New grants, identity choices or broadened effects require their own disposition.
|
||||
|
||||
## Actual CCR42 binding defect
|
||||
|
||||
At00:50:33Z native Forgejo Deployment forgejo-gitea UIDe8eff0aa-64bb-4b44-9a80-a66612986355 is Ready1 and uses forgejo/default. Forgejo-runner also uses forgejo/default. Binding CCR42 to that observed namespace/SA would cover the runner too and is not a dedicated consumer identity. No Secret object/value was read. Existing Forgejo delivery shows only ready forgejo-mailer via ClusterSecretStore/openbao-forgejo; no OIDC ExternalSecret was observed.
|
||||
|
||||
RAPPS0016 explicitly intends an ESO-delivered OIDC credential. CCR42 is still in_flight with no openbao.auth and historical1.0 render/provenance. Current type1.1 materialization includes a KeyCape ESO role but only a consumer policy, not a consumer role. Therefore filling an arbitrary role/SA and claiming the five-object structural footprint unchanged is incorrect. Existing policy family, exact KV read-only path and self-lifecycle clauses are reusable; historical CCR41 applied approval and CCR42 original request provenance must stay intact.
|
||||
|
||||
Concrete owner proposal: railiance-apps must first select its consumer delivery/authentication implementation. If using its declared ESO path, propose a namespace-scoped SecretStore in forgejo and a dedicated reviewed consumer-reader role targeting the actual ESO controller identity, with the exact CCR42 policy only, audienceopenbao, 15m TTL, no default policy, target secret metadata/config references only, and no broad policy merge into the existing mailer store. That role is additional structural scope not currently templated and needs explicit type/Mason owner refinement; the actual trusted ESO identity and cross-namespace restrictions must be confirmed. If instead using a dedicated Forgejo ServiceAccount, propose that new SA and actual OpenBao-read integration plus projected audience/path; current Forgejo source has neither. Do not grant forgejo/default or reuse an unrelated runtime token to finish a checkbox. These are alternatives for owner review, not an approved auth binding or runnable native adapter.
|
||||
|
||||
Before application: reconcile CCR42's historical1.0 evidence to exact reviewed/current1.1 structure while retaining originals, validate the complete request and policy/role bodies using platform's own validator, independently review identity isolation and scoped capabilities, prepare exact UID/resourceVersion/dry-run/diff/rollback and obtain the specific native grant. No such grant is present here.
|
||||
|
||||
## Remaining authenticated receipts and real human stops
|
||||
|
||||
Platform must return request-bound native ESO/consumer policy and role metadata plus fixed layout identity; Warden returns pointer-source observation. Classify created versus preexisting-matched from independent owner evidence, not planned rollback.yaml. Mint/delivery/login are follow-through, not prerequisites to mark structural presence. Only the verified structural binding permits an accepted→materialized status-only candidate; do not write that label before receipts exist.
|
||||
|
||||
Owner-native adapters need fixed descriptor/source pins and authenticated per-attempt result/reconciliation/created-object evidence. Broker mint must require exact materialized case1.1, independent broker-grant and parent-session revocation receipts and CAS already-present reconciliation without regeneration. Delivery must report fixed readiness/target metadata without values. Registration/groups/env changes remain one contained attended session with exact accepted memberships, registry CAS and current startup validation, owned by NetKingdom/KeyCape. Consumer handover must prove group refusal through the actual Forgejo configuration, preserve local sign-in/break-glass and use exact reversible Helm ownership. Current kernel has no installed dispatch/adapter provenance or ordered global verification; a fake verifier is not an owner return.
|
||||
|
||||
The real break-glass login, founder MFA/sign-in/group mapping and attended credential generation/client restart are separate human/native gates. No new login or live policy/workload/credential change was attempted. NK-WP0048-T06, MASON-WP0010-T03 and WARDEN-WP0044-T03 cannot finish from source preparation or this receipt. Existing4-phase type review and native first-run acceptance remain in force; no placeholder framework was added.
|
||||
42
docs/evidence/2026-10-11-forgejo-first-case/source-pins.json
Normal file
42
docs/evidence/2026-10-11-forgejo-first-case/source-pins.json
Normal file
|
|
@ -0,0 +1,42 @@
|
|||
{
|
||||
"net-kingdom": {
|
||||
"head": "42aaf6006228004a82dc7175bb0202120c68d3df",
|
||||
"files": {
|
||||
"security-cases/forgejo-netkingdom-oidc.yaml": "bcc2c6d5bae0d28242b3cdb71e74d8ca297c2afe04766b55d53597f86893351d",
|
||||
"security-case-types/oidc-browser-relying-party/type.yaml": "f705c64e4875e9b8e18a912fb51c135e77898926d6a451f5cb74ab3c0cbe4d1c"
|
||||
}
|
||||
},
|
||||
"ops-mason": {
|
||||
"head": "f52c94cd4e36276d58cd23c34be6d22f02682ba4",
|
||||
"files": {
|
||||
"src/ops_mason/case_structure.py": "71032a5ea613f5226f552f796656599c1a7447a38428f890595d8f252831ce80",
|
||||
"docs/forgejo-structural-materialization-source-v1.md": "60c9a3aa3d4d12da4b18dbf4e34e0ef5ef7f6eec1343980a8096d6d04cc844cb"
|
||||
}
|
||||
},
|
||||
"ops-warden": {
|
||||
"head": "eaabb4216186f4fee2d830376a381740b140087c",
|
||||
"files": {
|
||||
"src/warden/case_run.py": "3636d089bfa9dd3fe66971529305354ba1e7ed46572eeceaabeb3c9a064b76a8",
|
||||
"docs/security-case-execution-kernel-v1.md": "ed5b6432ada71d1065fc837e3638e248cd4803241b6430d6ded07c25c0094c8d"
|
||||
}
|
||||
},
|
||||
"railiance-platform": {
|
||||
"head": "8c152d012a44664f51969f2cb3456e28a3a0e5ff",
|
||||
"files": {
|
||||
"credential-change-requests/CCR-2026-0042-forgejo-netkingdom-oidc-consumer-reader.yaml": "3d894cee60c9623780431c8a008bea22c61cecce9aac7bd152399a7a26d64789"
|
||||
}
|
||||
},
|
||||
"railiance-apps": {
|
||||
"head": "b6be18b7274964b9da73c4612c707be65fef02a1",
|
||||
"files": {
|
||||
"workplans/RAPPS-WP-0016-forgejo-netkingdom-login.md": "a74f9fbc3300739bc0d8e31f1de88c0b7226ff2f6990e7cbb3ae433ac84fdb5e",
|
||||
"helm/forgejo-values.yaml": "dab8376997e4db458fb28f751b802db2463a1e628b2510d5a4207c6fca06d41a"
|
||||
}
|
||||
},
|
||||
"prj-forgejo-org-refactor": {
|
||||
"head": "a03597ff3cbd1f8415b361838136607f8976f8b7",
|
||||
"files": {
|
||||
"workplans/ORGREF-WP-0002-forge-closure-netkingdom-access.md": "c749ad68f7eec9544b6f4f775906b5bc034c44a3f3506e634a9ee03bd221aa4d"
|
||||
}
|
||||
}
|
||||
}
|
||||
|
|
@ -0,0 +1,59 @@
|
|||
{
|
||||
"source_only": true,
|
||||
"request_digest": "sha256:f2ffc19676b257d4ecbbb79b653da19cc097e3a8d5f7cdfe6fd7e69481b4b49f",
|
||||
"request": {
|
||||
"schema": "ops-mason.case-structure-request.v1",
|
||||
"case": "forgejo-netkingdom-oidc",
|
||||
"case_digest": "sha256:bcc2c6d5bae0d28242b3cdb71e74d8ca297c2afe04766b55d53597f86893351d",
|
||||
"type_ref": "oidc-browser-relying-party@1.1",
|
||||
"type_digest": "sha256:f705c64e4875e9b8e18a912fb51c135e77898926d6a451f5cb74ab3c0cbe4d1c",
|
||||
"render_digest": "sha256:e64b56e4590b57b858303fcda1a474693e3dd821bc83df26646fe78fc345498a",
|
||||
"plan_digest": "sha256:21c51b1046e1622c2aa7a9295437e5ef51cb5cd271bf5f4a4b2da5307f5ed2ca",
|
||||
"bundle_digest": "sha256:8a41bfa829386a8ea5f01baa7407f9f31ab6be384f51ca9a4b07027f6ee955e0",
|
||||
"structural_digest": "sha256:523a9020822a406f4f4cfb36608abbddf01eecf126aae5f2d170100fc4fdd5c0",
|
||||
"reviewed_render_digest": "sha256:af1f4f81ef313f5e086e6e3de17197d9112dd40f00b4c20b52b5ca73c7a6d18a",
|
||||
"run_source_changed": true,
|
||||
"objects": [
|
||||
{
|
||||
"id": "client-secret-path",
|
||||
"kind": "kv_path",
|
||||
"target": "platform/workloads/keycape/forgejo",
|
||||
"expected_digest": "sha256:04bef1f10b77b1b2fde4e5eae1b90a41a2e9c5a3b11cb1d4869c1fbdb5d63807",
|
||||
"evidence_owner": "railiance-platform",
|
||||
"proof": "layout-only"
|
||||
},
|
||||
{
|
||||
"id": "keycape-reader-policy",
|
||||
"kind": "openbao_policy",
|
||||
"target": "workload-kv-read-keycape-forgejo-eso",
|
||||
"expected_digest": "sha256:cdf9bbd0050daef327b3e135a4c9a357f274111a1c65e640b9ff50ac22ce3a23",
|
||||
"evidence_owner": "railiance-platform",
|
||||
"proof": "native-structure"
|
||||
},
|
||||
{
|
||||
"id": "consumer-reader-policy",
|
||||
"kind": "openbao_policy",
|
||||
"target": "workload-kv-read-keycape-forgejo-forgejo",
|
||||
"expected_digest": "sha256:861d80ffcc0289a4623badd9dbb248264899b990f1c8acf72078b86ddbe77335",
|
||||
"evidence_owner": "railiance-platform",
|
||||
"proof": "native-structure"
|
||||
},
|
||||
{
|
||||
"id": "eso-role",
|
||||
"kind": "openbao_role",
|
||||
"target": "external-secrets-keycape-forgejo",
|
||||
"expected_digest": "sha256:7035f10ca01fc0db0ddaf3b04828b5c3e92e2e747065fce8b408bdc1c5aeb8f4",
|
||||
"evidence_owner": "railiance-platform",
|
||||
"proof": "native-structure"
|
||||
},
|
||||
{
|
||||
"id": "catalog-entry",
|
||||
"kind": "catalog_entry",
|
||||
"target": "forgejo-keycape-client",
|
||||
"expected_digest": "sha256:87feb0bc280ea5de555bfee1b2de169331c9739a11c955d2dabdad1a2ec87a7e",
|
||||
"evidence_owner": "ops-warden",
|
||||
"proof": "pointer-source"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
|
|
@ -0,0 +1,9 @@
|
|||
{
|
||||
"platform_native_ccr_validator_passed": true,
|
||||
"ccr_status": "in_flight",
|
||||
"auth_binding_added": false,
|
||||
"historical_security_case_provenance_unchanged": true,
|
||||
"source_structure_request_passed": true,
|
||||
"native_materialization_claimed": false,
|
||||
"human_session_performed": false
|
||||
}
|
||||
Loading…
Add table
Add a link
Reference in a new issue