diff --git a/credential-change-requests/CCR-2026-0042-forgejo-netkingdom-oidc-consumer-reader.yaml b/credential-change-requests/CCR-2026-0042-forgejo-netkingdom-oidc-consumer-reader.yaml index 7733c3e..a4a58d3 100644 --- a/credential-change-requests/CCR-2026-0042-forgejo-netkingdom-oidc-consumer-reader.yaml +++ b/credential-change-requests/CCR-2026-0042-forgejo-netkingdom-oidc-consumer-reader.yaml @@ -71,4 +71,11 @@ in_flight: missing_fields: - openbao.auth owner: railiance-apps - blocking_reason: railiance-apps binds this reader to forgejo's own identity in its deployment path (hand-over). + blocking_reason: >- + railiance-apps must choose and review the consumer delivery/auth identity. Native + forgejo-gitea and forgejo-runner both use forgejo/default; that shared identity + must not be filled as a dedicated consumer binding. RAPPS-WP-0016 intends ESO + delivery; current type1.1 templates only the KeyCape ESO role, so a consumer + role/delivery refinement needs explicit owner review. Historical type1.0 CCR + provenance remains unchanged; reconcile exact current1.1 structure before + application. See docs/evidence/2026-10-11-forgejo-first-case/owner-return.md. diff --git a/docs/evidence/2026-10-11-forgejo-first-case/coordination-receipt.json b/docs/evidence/2026-10-11-forgejo-first-case/coordination-receipt.json new file mode 100644 index 0000000..3dd0596 --- /dev/null +++ b/docs/evidence/2026-10-11-forgejo-first-case/coordination-receipt.json @@ -0,0 +1,33 @@ +{ + "scenario_type": "project_driver", + "case_id": "forgejo-netkingdom-oidc-owner-follow-through", + "driver_workplan_id": "ORGREF-WP-0002", + "driver_repo": "prj-forgejo-org-refactor", + "beneficiary_workplan_id": "NK-WP-0048", + "obligor_workplan_id": "MASON-WP-0010", + "flavor": "implementation", + "state": "waiting", + "reason": "Mason structural receipts and CCR42 consumer delivery binding/application absent; Warden owner-native machine/session integration not installed.", + "foreign_commitment_refs": [ + "MASON-WP-0010-T03", + "WARDEN-WP-0044-T03", + "RAPPS-WP-0016-T02", + "CCR-2026-0042" + ], + "human_gate_refs": [ + "RAPPS-WP-0016-T01 real break-glass login", + "exact metadata apply grant if owner-approved binding changes native auth", + "contained first native case session/client restart and verification" + ], + "leased_workers": false, + "native_service_wakeup_enabled": false, + "central_projection_posted": false, + "checkpoint": { + "summary": "Existing Forgejo project driver selected; source structural request validated and fixed native workload metadata observed. No copied task list or new workplan.", + "files_changed": [ + "CCR42 blocking-reason clarification and evidence proposal only" + ], + "next_action": "Consumer owner chooses a supported dedicated identity/delivery path; platform reviews/reconciles CCR42 and supplies exact independent structural observations. Native adapters/type descriptors and contained execution follow only after owner acceptance.", + "blocked_reason": "owner binding and authenticated native receipts; independent human sessions are separate stops" + } +} diff --git a/docs/evidence/2026-10-11-forgejo-first-case/hub-observation.json b/docs/evidence/2026-10-11-forgejo-first-case/hub-observation.json new file mode 100644 index 0000000..5f15a5f --- /dev/null +++ b/docs/evidence/2026-10-11-forgejo-first-case/hub-observation.json @@ -0,0 +1,37 @@ +{ + "central_observed": true, + "records": [ + { + "id": "e31f3f9d-0748-5137-b0a3-7b3ca46a66eb", + "backing_filename": "NK-WP-0048-security-case-types.md", + "backing_relative_path": "workplans/NK-WP-0048-security-case-types.md", + "status": "active", + "flavor": null, + "repo_id": "4589488d-625b-4ffe-b8f0-48744d7b1498" + }, + { + "id": "f7e81013-6868-5d99-8528-ba75a442eca9", + "backing_filename": "WARDEN-WP-0044-security-case-follow-through.md", + "backing_relative_path": "workplans/WARDEN-WP-0044-security-case-follow-through.md", + "status": "active", + "flavor": null, + "repo_id": "74df727e-a756-42de-b776-11928b03bd1f" + }, + { + "id": "eabf2c39-94bd-5a11-8f2e-76d7a95d1583", + "backing_filename": "MASON-WP-0010-security-case-materialization.md", + "backing_relative_path": "workplans/MASON-WP-0010-security-case-materialization.md", + "status": "blocked", + "flavor": "implementation", + "repo_id": "b9066ab1-c6fe-409b-9145-64ba374654db" + }, + { + "id": "f873c10f-1408-5bf2-a834-fed88387804b", + "backing_filename": "ORGREF-WP-0002-forge-closure-netkingdom-access.md", + "backing_relative_path": "workplans/ORGREF-WP-0002-forge-closure-netkingdom-access.md", + "status": "blocked", + "flavor": "implementation", + "repo_id": "01631c7a-f612-4799-892e-a96970d06063" + } + ] +} diff --git a/docs/evidence/2026-10-11-forgejo-first-case/native-forgejo-metadata.json b/docs/evidence/2026-10-11-forgejo-first-case/native-forgejo-metadata.json new file mode 100644 index 0000000..5555675 --- /dev/null +++ b/docs/evidence/2026-10-11-forgejo-first-case/native-forgejo-metadata.json @@ -0,0 +1,80 @@ +{ + "observed_at": "2026-10-11T00:50:33.119567+00:00", + "secret_objects_read": false, + "raw_output_suppressed": true, + "workloads": [ + { + "kind": "Deployment", + "name": "forgejo-gitea", + "uid": "e8eff0aa-64bb-4b44-9a80-a66612986355", + "resourceVersion": "67848734", + "generation": 11, + "readyReplicas": 1, + "serviceAccountName": "default", + "automountServiceAccountToken": null, + "containers": [ + { + "name": "gitea", + "image": "code.forgejo.org/forgejo/forgejo:11.0.3-rootless", + "env_names": [ + "SSH_LISTEN_PORT", + "SSH_PORT", + "GITEA_APP_INI", + "GITEA_CUSTOM", + "GITEA_WORK_DIR", + "GITEA_TEMP", + "TMPDIR", + "HOME" + ], + "env_secret_refs": [] + } + ] + }, + { + "kind": "Deployment", + "name": "forgejo-runner", + "uid": "89c8a056-bcae-4940-acdd-2eb2768e108a", + "resourceVersion": "68161637", + "generation": 3, + "readyReplicas": 1, + "serviceAccountName": "default", + "automountServiceAccountToken": null, + "containers": [ + { + "name": "dind", + "image": "docker:27-dind", + "env_names": [ + "DOCKER_TLS_CERTDIR" + ], + "env_secret_refs": [] + }, + { + "name": "runner", + "image": "code.forgejo.org/forgejo/runner:6.3.1", + "env_names": [ + "DOCKER_HOST" + ], + "env_secret_refs": [] + } + ] + } + ], + "delivery": [ + { + "name": "forgejo-mailer", + "uid": "cbbea71e-70a8-4010-aca9-9136920f2f58", + "store": { + "kind": "ClusterSecretStore", + "name": "openbao-forgejo" + }, + "target_name": "forgejo-mailer", + "ready": true, + "remote_paths": [ + "workloads/forgejo/forgejo-mailer" + ] + } + ], + "deployments_read": true, + "statefulsets_read": true, + "externalsecrets_read": true +} diff --git a/docs/evidence/2026-10-11-forgejo-first-case/observe-forgejo-metadata.py b/docs/evidence/2026-10-11-forgejo-first-case/observe-forgejo-metadata.py new file mode 100644 index 0000000..d1521d3 --- /dev/null +++ b/docs/evidence/2026-10-11-forgejo-first-case/observe-forgejo-metadata.py @@ -0,0 +1,21 @@ +import subprocess,json,datetime +remote=r''' +import json,subprocess,datetime +out={'observed_at':datetime.datetime.now(datetime.timezone.utc).isoformat(),'secret_objects_read':False,'raw_output_suppressed':True,'workloads':[],'delivery':[]} +for resource in ['deployments','statefulsets']: + r=subprocess.run(['kubectl','get',resource,'-n','forgejo','-o','json'],capture_output=True,text=True) + if r.returncode:out[resource+'_read']=False;continue + out[resource+'_read']=True + for d in json.loads(r.stdout)['items']: + s=d['spec']['template']['spec'];out['workloads'].append({'kind':d['kind'],'name':d['metadata']['name'],'uid':d['metadata']['uid'],'resourceVersion':d['metadata']['resourceVersion'],'generation':d['metadata'].get('generation'),'readyReplicas':d.get('status',{}).get('readyReplicas',0),'serviceAccountName':s.get('serviceAccountName','default'),'automountServiceAccountToken':s.get('automountServiceAccountToken'),'containers':[{'name':c['name'],'image':c['image'],'env_names':[e['name'] for e in c.get('env',[])],'env_secret_refs':[{'env':e['name'],'secret_name':e['valueFrom']['secretKeyRef']['name'],'key':e['valueFrom']['secretKeyRef']['key']} for e in c.get('env',[]) if 'secretKeyRef' in e.get('valueFrom',{})]} for c in s['containers']]}) +r=subprocess.run(['kubectl','get','externalsecrets','-n','forgejo','-o','json'],capture_output=True,text=True) +out['externalsecrets_read']=r.returncode==0 +if not r.returncode: + for d in json.loads(r.stdout)['items']: + out['delivery'].append({'name':d['metadata']['name'],'uid':d['metadata']['uid'],'store':d['spec'].get('secretStoreRef'),'target_name':d['spec'].get('target',{}).get('name'),'ready':any(c['type']=='Ready' and c['status']=='True' for c in d.get('status',{}).get('conditions',[])),'remote_paths':[x.get('remoteRef',{}).get('key') for x in d['spec'].get('data',[])]}) +print(json.dumps(out)) +''' +r=subprocess.run(['ssh','railiance01','python3 -'],input=remote,capture_output=True,text=True) +try:out=json.loads(r.stdout) +except Exception:out={'native_metadata_read':False,'raw_output_suppressed':True} +open('/tmp/security-case-forgejo-native-metadata.json','w').write(json.dumps(out,indent=2)+'\n');print(json.dumps(out)) diff --git a/docs/evidence/2026-10-11-forgejo-first-case/owner-return.md b/docs/evidence/2026-10-11-forgejo-first-case/owner-return.md new file mode 100644 index 0000000..d93bd13 --- /dev/null +++ b/docs/evidence/2026-10-11-forgejo-first-case/owner-return.md @@ -0,0 +1,27 @@ +# First Forgejo SecurityCase owner return — source/native metadata review + +Disposition: source structural preparation is usable, native first-case completion is not ready. Existing driver ORGREF-WP-0002 already coordinates Forgejo closure/sign-in and names NK-WP0048-T06; attach this observed/waiting case there. No new plan or copied foreign task list is needed. Hub records were observed read-only; this receipt is not centrally projected or a worker wake/lease. + +## Exact source/type boundary + +The actual accepted case remains accepted, oidc-browser-relying-party@1.1, raw SHA256 bcc2c6d5bae0d28242b3cdb71e74d8ca297c2afe04766b55d53597f86893351d. Current exact type SHA256 f705c64e4875e9b8e18a912fb51c135e77898926d6a451f5cb74ab3c0cbe4d1c produces full render e64b56e4590b57b858303fcda1a474693e3dd821bc83df26646fe78fc345498a. Prior reviewed full render af1f4f81ef313f5e086e6e3de17197d9112dd40f00b4c20b52b5ca73c7a6d18a is retained, not inherited as current execution approval. Actual read-only Mason structure-request passes and pins structural projection523a9020822a406f4f4cfb36608abbddf01eecf126aae5f2d170100fc4fdd5c0, requestf2ffc19676b257d4ecbbb79b653da19cc097e3a8d5f7cdfe6fd7e69481b4b49f, five exact objects. Source changes are register-client --check-config/startup guard; structural footprint matches, full execution hash remains changed. Current source pins are attached. + +Mason f52c94c structural seam and Warden1b82619 durable kernel are implementation evidence. Human architecture approval e46b149b accepted the exact source design, not a new execution session or the local warden.case.execution.v1 wire schema. The acknowledged descriptive type1.1 has no execution_descriptors map. Machine descriptor/adapter revisions must get specific native-owner review and type acknowledgment/versioned contract before activation; do not label a different machine contract as already acknowledged1.1. A stricter --check-config guard can receive exact technical owner rereview without inventing a fresh founder ratification of unchanged doctrine, but its current source must be pinned in the actual run sheet. New grants, identity choices or broadened effects require their own disposition. + +## Actual CCR42 binding defect + +At00:50:33Z native Forgejo Deployment forgejo-gitea UIDe8eff0aa-64bb-4b44-9a80-a66612986355 is Ready1 and uses forgejo/default. Forgejo-runner also uses forgejo/default. Binding CCR42 to that observed namespace/SA would cover the runner too and is not a dedicated consumer identity. No Secret object/value was read. Existing Forgejo delivery shows only ready forgejo-mailer via ClusterSecretStore/openbao-forgejo; no OIDC ExternalSecret was observed. + +RAPPS0016 explicitly intends an ESO-delivered OIDC credential. CCR42 is still in_flight with no openbao.auth and historical1.0 render/provenance. Current type1.1 materialization includes a KeyCape ESO role but only a consumer policy, not a consumer role. Therefore filling an arbitrary role/SA and claiming the five-object structural footprint unchanged is incorrect. Existing policy family, exact KV read-only path and self-lifecycle clauses are reusable; historical CCR41 applied approval and CCR42 original request provenance must stay intact. + +Concrete owner proposal: railiance-apps must first select its consumer delivery/authentication implementation. If using its declared ESO path, propose a namespace-scoped SecretStore in forgejo and a dedicated reviewed consumer-reader role targeting the actual ESO controller identity, with the exact CCR42 policy only, audienceopenbao, 15m TTL, no default policy, target secret metadata/config references only, and no broad policy merge into the existing mailer store. That role is additional structural scope not currently templated and needs explicit type/Mason owner refinement; the actual trusted ESO identity and cross-namespace restrictions must be confirmed. If instead using a dedicated Forgejo ServiceAccount, propose that new SA and actual OpenBao-read integration plus projected audience/path; current Forgejo source has neither. Do not grant forgejo/default or reuse an unrelated runtime token to finish a checkbox. These are alternatives for owner review, not an approved auth binding or runnable native adapter. + +Before application: reconcile CCR42's historical1.0 evidence to exact reviewed/current1.1 structure while retaining originals, validate the complete request and policy/role bodies using platform's own validator, independently review identity isolation and scoped capabilities, prepare exact UID/resourceVersion/dry-run/diff/rollback and obtain the specific native grant. No such grant is present here. + +## Remaining authenticated receipts and real human stops + +Platform must return request-bound native ESO/consumer policy and role metadata plus fixed layout identity; Warden returns pointer-source observation. Classify created versus preexisting-matched from independent owner evidence, not planned rollback.yaml. Mint/delivery/login are follow-through, not prerequisites to mark structural presence. Only the verified structural binding permits an accepted→materialized status-only candidate; do not write that label before receipts exist. + +Owner-native adapters need fixed descriptor/source pins and authenticated per-attempt result/reconciliation/created-object evidence. Broker mint must require exact materialized case1.1, independent broker-grant and parent-session revocation receipts and CAS already-present reconciliation without regeneration. Delivery must report fixed readiness/target metadata without values. Registration/groups/env changes remain one contained attended session with exact accepted memberships, registry CAS and current startup validation, owned by NetKingdom/KeyCape. Consumer handover must prove group refusal through the actual Forgejo configuration, preserve local sign-in/break-glass and use exact reversible Helm ownership. Current kernel has no installed dispatch/adapter provenance or ordered global verification; a fake verifier is not an owner return. + +The real break-glass login, founder MFA/sign-in/group mapping and attended credential generation/client restart are separate human/native gates. No new login or live policy/workload/credential change was attempted. NK-WP0048-T06, MASON-WP0010-T03 and WARDEN-WP0044-T03 cannot finish from source preparation or this receipt. Existing4-phase type review and native first-run acceptance remain in force; no placeholder framework was added. diff --git a/docs/evidence/2026-10-11-forgejo-first-case/source-pins.json b/docs/evidence/2026-10-11-forgejo-first-case/source-pins.json new file mode 100644 index 0000000..6fadb08 --- /dev/null +++ b/docs/evidence/2026-10-11-forgejo-first-case/source-pins.json @@ -0,0 +1,42 @@ +{ + "net-kingdom": { + "head": "42aaf6006228004a82dc7175bb0202120c68d3df", + "files": { + "security-cases/forgejo-netkingdom-oidc.yaml": "bcc2c6d5bae0d28242b3cdb71e74d8ca297c2afe04766b55d53597f86893351d", + "security-case-types/oidc-browser-relying-party/type.yaml": "f705c64e4875e9b8e18a912fb51c135e77898926d6a451f5cb74ab3c0cbe4d1c" + } + }, + "ops-mason": { + "head": "f52c94cd4e36276d58cd23c34be6d22f02682ba4", + "files": { + "src/ops_mason/case_structure.py": "71032a5ea613f5226f552f796656599c1a7447a38428f890595d8f252831ce80", + "docs/forgejo-structural-materialization-source-v1.md": "60c9a3aa3d4d12da4b18dbf4e34e0ef5ef7f6eec1343980a8096d6d04cc844cb" + } + }, + "ops-warden": { + "head": "eaabb4216186f4fee2d830376a381740b140087c", + "files": { + "src/warden/case_run.py": "3636d089bfa9dd3fe66971529305354ba1e7ed46572eeceaabeb3c9a064b76a8", + "docs/security-case-execution-kernel-v1.md": "ed5b6432ada71d1065fc837e3638e248cd4803241b6430d6ded07c25c0094c8d" + } + }, + "railiance-platform": { + "head": "8c152d012a44664f51969f2cb3456e28a3a0e5ff", + "files": { + "credential-change-requests/CCR-2026-0042-forgejo-netkingdom-oidc-consumer-reader.yaml": "3d894cee60c9623780431c8a008bea22c61cecce9aac7bd152399a7a26d64789" + } + }, + "railiance-apps": { + "head": "b6be18b7274964b9da73c4612c707be65fef02a1", + "files": { + "workplans/RAPPS-WP-0016-forgejo-netkingdom-login.md": "a74f9fbc3300739bc0d8e31f1de88c0b7226ff2f6990e7cbb3ae433ac84fdb5e", + "helm/forgejo-values.yaml": "dab8376997e4db458fb28f751b802db2463a1e628b2510d5a4207c6fca06d41a" + } + }, + "prj-forgejo-org-refactor": { + "head": "a03597ff3cbd1f8415b361838136607f8976f8b7", + "files": { + "workplans/ORGREF-WP-0002-forge-closure-netkingdom-access.md": "c749ad68f7eec9544b6f4f775906b5bc034c44a3f3506e634a9ee03bd221aa4d" + } + } +} diff --git a/docs/evidence/2026-10-11-forgejo-first-case/structural-request.json b/docs/evidence/2026-10-11-forgejo-first-case/structural-request.json new file mode 100644 index 0000000..fc181de --- /dev/null +++ b/docs/evidence/2026-10-11-forgejo-first-case/structural-request.json @@ -0,0 +1,59 @@ +{ + "source_only": true, + "request_digest": "sha256:f2ffc19676b257d4ecbbb79b653da19cc097e3a8d5f7cdfe6fd7e69481b4b49f", + "request": { + "schema": "ops-mason.case-structure-request.v1", + "case": "forgejo-netkingdom-oidc", + "case_digest": "sha256:bcc2c6d5bae0d28242b3cdb71e74d8ca297c2afe04766b55d53597f86893351d", + "type_ref": "oidc-browser-relying-party@1.1", + "type_digest": "sha256:f705c64e4875e9b8e18a912fb51c135e77898926d6a451f5cb74ab3c0cbe4d1c", + "render_digest": "sha256:e64b56e4590b57b858303fcda1a474693e3dd821bc83df26646fe78fc345498a", + "plan_digest": "sha256:21c51b1046e1622c2aa7a9295437e5ef51cb5cd271bf5f4a4b2da5307f5ed2ca", + "bundle_digest": "sha256:8a41bfa829386a8ea5f01baa7407f9f31ab6be384f51ca9a4b07027f6ee955e0", + "structural_digest": "sha256:523a9020822a406f4f4cfb36608abbddf01eecf126aae5f2d170100fc4fdd5c0", + "reviewed_render_digest": "sha256:af1f4f81ef313f5e086e6e3de17197d9112dd40f00b4c20b52b5ca73c7a6d18a", + "run_source_changed": true, + "objects": [ + { + "id": "client-secret-path", + "kind": "kv_path", + "target": "platform/workloads/keycape/forgejo", + "expected_digest": "sha256:04bef1f10b77b1b2fde4e5eae1b90a41a2e9c5a3b11cb1d4869c1fbdb5d63807", + "evidence_owner": "railiance-platform", + "proof": "layout-only" + }, + { + "id": "keycape-reader-policy", + "kind": "openbao_policy", + "target": "workload-kv-read-keycape-forgejo-eso", + "expected_digest": "sha256:cdf9bbd0050daef327b3e135a4c9a357f274111a1c65e640b9ff50ac22ce3a23", + "evidence_owner": "railiance-platform", + "proof": "native-structure" + }, + { + "id": "consumer-reader-policy", + "kind": "openbao_policy", + "target": "workload-kv-read-keycape-forgejo-forgejo", + "expected_digest": "sha256:861d80ffcc0289a4623badd9dbb248264899b990f1c8acf72078b86ddbe77335", + "evidence_owner": "railiance-platform", + "proof": "native-structure" + }, + { + "id": "eso-role", + "kind": "openbao_role", + "target": "external-secrets-keycape-forgejo", + "expected_digest": "sha256:7035f10ca01fc0db0ddaf3b04828b5c3e92e2e747065fce8b408bdc1c5aeb8f4", + "evidence_owner": "railiance-platform", + "proof": "native-structure" + }, + { + "id": "catalog-entry", + "kind": "catalog_entry", + "target": "forgejo-keycape-client", + "expected_digest": "sha256:87feb0bc280ea5de555bfee1b2de169331c9739a11c955d2dabdad1a2ec87a7e", + "evidence_owner": "ops-warden", + "proof": "pointer-source" + } + ] + } +} diff --git a/docs/evidence/2026-10-11-forgejo-first-case/validation.json b/docs/evidence/2026-10-11-forgejo-first-case/validation.json new file mode 100644 index 0000000..077e3b6 --- /dev/null +++ b/docs/evidence/2026-10-11-forgejo-first-case/validation.json @@ -0,0 +1,9 @@ +{ + "platform_native_ccr_validator_passed": true, + "ccr_status": "in_flight", + "auth_binding_added": false, + "historical_security_case_provenance_unchanged": true, + "source_structure_request_passed": true, + "native_materialization_claimed": false, + "human_session_performed": false +}