Provision scoped T03 requester custody and native requests
Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a09cbb-87c6-7900-a145-4ce53ba9f1a6
This commit is contained in:
codex
parent
525664efa3
commit
703d552ee7
10 changed files with 650 additions and 0 deletions
|
|
@ -0,0 +1,44 @@
|
|||
apiVersion: external-secrets.io/v1
|
||||
kind: ClusterSecretStore
|
||||
metadata:
|
||||
name: openbao-keycape-secrets-engine-requester
|
||||
labels:
|
||||
app.kubernetes.io/part-of: railiance-gitops
|
||||
railiance-platform/component: external-secrets
|
||||
app.kubernetes.io/name: keycape
|
||||
spec:
|
||||
provider:
|
||||
vault:
|
||||
server: http://openbao.openbao.svc:8200
|
||||
path: platform
|
||||
version: v2
|
||||
auth:
|
||||
kubernetes:
|
||||
mountPath: kubernetes
|
||||
role: external-secrets-keycape-secrets-engine-requester
|
||||
serviceAccountRef:
|
||||
name: external-secrets
|
||||
namespace: external-secrets
|
||||
conditions:
|
||||
- namespaces:
|
||||
- sso
|
||||
---
|
||||
apiVersion: external-secrets.io/v1
|
||||
kind: ExternalSecret
|
||||
metadata:
|
||||
name: keycape-secrets-engine-requester-client
|
||||
namespace: sso
|
||||
spec:
|
||||
refreshInterval: 5m
|
||||
secretStoreRef:
|
||||
kind: ClusterSecretStore
|
||||
name: openbao-keycape-secrets-engine-requester
|
||||
target:
|
||||
name: keycape-secrets-engine-requester-client
|
||||
creationPolicy: Owner
|
||||
deletionPolicy: Retain
|
||||
data:
|
||||
- secretKey: client-secret
|
||||
remoteRef:
|
||||
key: workloads/secrets-engine/approval-requester
|
||||
property: CLIENT_SECRET
|
||||
|
|
@ -0,0 +1,105 @@
|
|||
id: CCR-2026-0024
|
||||
kind: credential-change-request
|
||||
schema_version: 1
|
||||
request_type: workload-kv-read
|
||||
title: T03 create-only requester KeyCape verifier custody
|
||||
status: applied
|
||||
created: '2026-09-14'
|
||||
updated: '2026-09-14'
|
||||
requester:
|
||||
agent: codex
|
||||
reason: User instructed completion of SECRETS-WP-0010-T03 and explicitly confirmed
|
||||
its scoped human review mandate. A separate create-only requester is required;
|
||||
the withdrawn combined operator client remains unused.
|
||||
review:
|
||||
required: true
|
||||
required_approvers:
|
||||
- platform-operator
|
||||
- key-cape-owner
|
||||
comments:
|
||||
- at: '2026-09-14'
|
||||
reviewer: operator instruction in Codex session
|
||||
decision: approved
|
||||
comment: Necessary implementation of the user-authorized T03 completion. Exact
|
||||
requester has only approval:create, subject secrets-engine matching the existing
|
||||
evaluator actor, audience approval-engine, tenant:platform, lifetime 15m. No
|
||||
approval, consume, provider-key access or model-spending scope. Separate reader
|
||||
and verifier remain exact to this new path; no old credential or registration
|
||||
is widened.
|
||||
target:
|
||||
domain: financials
|
||||
tenant: platform
|
||||
workload: secrets-engine
|
||||
environment: production
|
||||
purpose: T03 create-only requester KeyCape verifier custody; execute only the three
|
||||
fixed T03 request records.
|
||||
openbao:
|
||||
mount: platform
|
||||
kv_path: platform/workloads/secrets-engine/approval-requester
|
||||
fields:
|
||||
- CLIENT_SECRET
|
||||
policy_name: workload-kv-read-keycape-secrets-engine-requester
|
||||
policy_file: openbao/policies/workload-kv-read-keycape-secrets-engine-requester.hcl
|
||||
auth:
|
||||
method: kubernetes
|
||||
mount: kubernetes
|
||||
role: external-secrets-keycape-secrets-engine-requester
|
||||
bound_claims:
|
||||
service_account_names:
|
||||
- external-secrets
|
||||
service_account_namespaces:
|
||||
- external-secrets
|
||||
bound_claims_confirmed: true
|
||||
policies:
|
||||
- workload-kv-read-keycape-secrets-engine-requester
|
||||
ttl: 15m
|
||||
access_frontdoor:
|
||||
type: ops-warden
|
||||
catalog_id: secrets-engine-requester-login
|
||||
selector: T03 create-only approval requester
|
||||
command: warden access secrets-engine-requester-login --exec -- <reviewed-requester-command>
|
||||
resolvable: false
|
||||
readiness: pending-review
|
||||
delivery:
|
||||
surface: external-secrets
|
||||
target: sso/keycape-secrets-engine-requester-client via ESO; env KEYCAPE_SECRETS_ENGINE_REQUESTER_CLIENT_SECRET
|
||||
risk:
|
||||
classification: high
|
||||
notes:
|
||||
- Credential authenticates only the separate approval:create requester. Human disposition
|
||||
remains mandatory and uses a different public PKCE client.
|
||||
- The stable subject secrets-engine matches the existing evaluator and Approval
|
||||
Engine binding.actor check; it is not an alias for consumer subject service:secrets-engine.
|
||||
verification:
|
||||
positive:
|
||||
- Exact scope and 900-second token lifetime; native create of only the reviewed
|
||||
three records.
|
||||
negative:
|
||||
- Approval and consume scopes refused; sibling KV paths and parent listing denied.
|
||||
activation_conditions:
|
||||
- Attended platform authority, CAS=0 custody, exact policy/auth readback and synchronized
|
||||
verifier delivery.
|
||||
- Separate reader verification and no human entry synthesized.
|
||||
evidence:
|
||||
- at: '2026-09-14T00:23:31+00:00'
|
||||
actor: operator via attended T03 requester custody session
|
||||
kind: delegated_metadata_apply
|
||||
result: passed
|
||||
details:
|
||||
- Delegated metadata applier ran as operator via attended T03 requester custody
|
||||
session using local bao CLI ambient authority.
|
||||
- 'Policy metadata write: sys/policies/acl/workload-kv-read-keycape-secrets-engine-requester'
|
||||
- 'Auth role metadata write: auth/kubernetes/role/external-secrets-keycape-secrets-engine-requester'
|
||||
- No secret values were read, written, printed, or accepted in argv.
|
||||
lifecycle:
|
||||
deactivate: Disable the secrets-engine-requester KeyCape registration and detach
|
||||
only the two requester reader roles. Preserve approvals and existing consumer/verifier
|
||||
lanes.
|
||||
rotate: Rotate through KeyCape and platform using a new version with predecessor
|
||||
refusal proof.
|
||||
compromised: Disable requester issuance first; revoke sessions and rotate under
|
||||
attended owner authority.
|
||||
state_hub:
|
||||
workplan_id: RPF-WP-0035
|
||||
task_id: RPF-WP-0035-T06
|
||||
related_request: CCR-2026-0025
|
||||
|
|
@ -0,0 +1,115 @@
|
|||
id: CCR-2026-0025
|
||||
kind: credential-change-request
|
||||
schema_version: 1
|
||||
request_type: workload-kv-read
|
||||
title: T03 create-only requester attended operator reader
|
||||
status: applied
|
||||
created: '2026-09-14'
|
||||
updated: '2026-09-14'
|
||||
requester:
|
||||
agent: codex
|
||||
reason: User instructed completion of SECRETS-WP-0010-T03 and explicitly confirmed
|
||||
its scoped human review mandate. A separate create-only requester is required;
|
||||
the withdrawn combined operator client remains unused.
|
||||
review:
|
||||
required: true
|
||||
required_approvers:
|
||||
- platform-operator
|
||||
- secrets-engine-owner
|
||||
comments:
|
||||
- at: '2026-09-14'
|
||||
reviewer: operator instruction in Codex session
|
||||
decision: approved
|
||||
comment: Necessary implementation of the user-authorized T03 completion. Exact
|
||||
requester has only approval:create, subject secrets-engine matching the existing
|
||||
evaluator actor, audience approval-engine, tenant:platform, lifetime 15m. No
|
||||
approval, consume, provider-key access or model-spending scope. Separate reader
|
||||
and verifier remain exact to this new path; no old credential or registration
|
||||
is widened.
|
||||
target:
|
||||
domain: financials
|
||||
tenant: platform
|
||||
workload: secrets-engine
|
||||
environment: production
|
||||
purpose: T03 create-only requester attended operator reader; execute only the three
|
||||
fixed T03 request records.
|
||||
openbao:
|
||||
mount: platform
|
||||
kv_path: platform/workloads/secrets-engine/approval-requester
|
||||
fields:
|
||||
- CLIENT_SECRET
|
||||
policy_name: workload-kv-read-secrets-engine-requester-client
|
||||
policy_file: openbao/policies/workload-kv-read-secrets-engine-requester-client.hcl
|
||||
auth:
|
||||
method: oidc
|
||||
mount: netkingdom
|
||||
role: secrets-engine-requester-workload-kv-read
|
||||
allowed_redirect_uris:
|
||||
- https://bao.coulomb.social/ui/vault/auth/netkingdom/oidc/callback
|
||||
- http://localhost:8250/oidc/callback
|
||||
- http://127.0.0.1:8250/oidc/callback
|
||||
oidc_scopes:
|
||||
- openid
|
||||
- profile
|
||||
- email
|
||||
- groups
|
||||
user_claim: sub
|
||||
groups_claim: groups
|
||||
bound_claims:
|
||||
groups:
|
||||
- net-kingdom-admins
|
||||
bound_claims_confirmed: true
|
||||
policies:
|
||||
- workload-kv-read-secrets-engine-requester-client
|
||||
ttl: 15m
|
||||
access_frontdoor:
|
||||
type: ops-warden
|
||||
catalog_id: secrets-engine-requester-login
|
||||
selector: T03 create-only approval requester
|
||||
command: warden access secrets-engine-requester-login --exec -- <reviewed-requester-command>
|
||||
resolvable: false
|
||||
readiness: pending-review
|
||||
delivery:
|
||||
surface: operator-workstation
|
||||
target: Contained attended reader session; secret stays in memory for native requester
|
||||
exchange; no retained file or raw output.
|
||||
risk:
|
||||
classification: high
|
||||
notes:
|
||||
- Credential authenticates only the separate approval:create requester. Human disposition
|
||||
remains mandatory and uses a different public PKCE client.
|
||||
- The stable subject secrets-engine matches the existing evaluator and Approval
|
||||
Engine binding.actor check; it is not an alias for consumer subject service:secrets-engine.
|
||||
verification:
|
||||
positive:
|
||||
- Exact scope and 900-second token lifetime; native create of only the reviewed
|
||||
three records.
|
||||
negative:
|
||||
- Approval and consume scopes refused; sibling KV paths and parent listing denied.
|
||||
activation_conditions:
|
||||
- Attended platform authority, CAS=0 custody, exact policy/auth readback and synchronized
|
||||
verifier delivery.
|
||||
- Separate reader verification and no human entry synthesized.
|
||||
evidence:
|
||||
- at: '2026-09-14T00:23:32+00:00'
|
||||
actor: operator via attended T03 requester custody session
|
||||
kind: delegated_metadata_apply
|
||||
result: passed
|
||||
details:
|
||||
- Delegated metadata applier ran as operator via attended T03 requester custody
|
||||
session using local bao CLI ambient authority.
|
||||
- 'Policy metadata write: sys/policies/acl/workload-kv-read-secrets-engine-requester-client'
|
||||
- 'Auth role metadata write: auth/netkingdom/role/secrets-engine-requester-workload-kv-read'
|
||||
- No secret values were read, written, printed, or accepted in argv.
|
||||
lifecycle:
|
||||
deactivate: Disable the secrets-engine-requester KeyCape registration and detach
|
||||
only the two requester reader roles. Preserve approvals and existing consumer/verifier
|
||||
lanes.
|
||||
rotate: Rotate through KeyCape and platform using a new version with predecessor
|
||||
refusal proof.
|
||||
compromised: Disable requester issuance first; revoke sessions and rotate under
|
||||
attended owner authority.
|
||||
state_hub:
|
||||
workplan_id: RPF-WP-0035
|
||||
task_id: RPF-WP-0035-T06
|
||||
related_request: CCR-2026-0024
|
||||
145
docs/evidence/2026-09-14-t03-native-approval-requests.json
Normal file
145
docs/evidence/2026-09-14-t03-native-approval-requests.json
Normal file
|
|
@ -0,0 +1,145 @@
|
|||
{
|
||||
"observed_at": "2026-09-14T00:33:04.552946+00:00",
|
||||
"status": "created",
|
||||
"phase": "three_unapproved_requests_created",
|
||||
"requests": [
|
||||
{
|
||||
"memo_id": "SECRETS-WP-0010-T03-apply",
|
||||
"action": "apply",
|
||||
"approval": {
|
||||
"binding": {
|
||||
"action": "apply",
|
||||
"actor": "secrets-engine",
|
||||
"digest": "sha256:03cc5b37437f14e86b686ce4054f976556334eff3fa260b03e8014ed3d9217e5",
|
||||
"human_control": true,
|
||||
"pdp_digest": "sha256:933427642c58c54f65dd4781b8e4c8e2f358eb96497ae35870fff4bd593d2b84",
|
||||
"pdp_path": true,
|
||||
"principal": "secrets-engine",
|
||||
"purpose": "IR-WP-0004 read-only OpenRouter key authentication check; no inference",
|
||||
"target": {
|
||||
"attributes": {
|
||||
"auth_targets": [
|
||||
"se-prod-openrouter-llm-connect"
|
||||
],
|
||||
"fields": [],
|
||||
"policy_targets": [
|
||||
"se-prod-openrouter-llm-connect"
|
||||
],
|
||||
"stage": "prod"
|
||||
},
|
||||
"id": "catalog:openrouter-llm-connect",
|
||||
"system": "secrets-engine",
|
||||
"type": "secret-catalog-lane"
|
||||
}
|
||||
},
|
||||
"created_at": "2026-09-14T00:33:07+00:00",
|
||||
"entries": [],
|
||||
"id": "09592588-ab15-53e7-89b8-c4e9f29aaacf",
|
||||
"required_count": 1,
|
||||
"status": "requested",
|
||||
"superseded_by": null,
|
||||
"updated_at": "2026-09-14T00:33:07+00:00",
|
||||
"validity": {
|
||||
"expires_at": "2026-09-15T00:33:06.559689+00:00",
|
||||
"not_before": "2026-09-14T00:33:06.559689+00:00"
|
||||
}
|
||||
}
|
||||
},
|
||||
{
|
||||
"memo_id": "SECRETS-WP-0010-T03-verify",
|
||||
"action": "verify",
|
||||
"approval": {
|
||||
"binding": {
|
||||
"action": "verify",
|
||||
"actor": "secrets-engine",
|
||||
"digest": "sha256:72d9267d038c17107c880ffc9009793ce9c70defbddfe2219628854b811a04b2",
|
||||
"human_control": true,
|
||||
"pdp_digest": "sha256:9e36cdbf3890cc5a7e550fd57191f9c0f2a6b2180909aac302aa3b999e7e6b25",
|
||||
"pdp_path": true,
|
||||
"principal": "secrets-engine",
|
||||
"purpose": "IR-WP-0004 read-only OpenRouter key authentication check; no inference",
|
||||
"target": {
|
||||
"attributes": {
|
||||
"auth_targets": [
|
||||
"se-prod-openrouter-llm-connect"
|
||||
],
|
||||
"fields": [
|
||||
"OPENROUTER_API_KEY"
|
||||
],
|
||||
"policy_targets": [
|
||||
"se-prod-openrouter-llm-connect"
|
||||
],
|
||||
"stage": "prod"
|
||||
},
|
||||
"id": "catalog:openrouter-llm-connect",
|
||||
"system": "secrets-engine",
|
||||
"type": "secret-catalog-lane"
|
||||
}
|
||||
},
|
||||
"created_at": "2026-09-14T00:33:07+00:00",
|
||||
"entries": [],
|
||||
"id": "9416fa31-fa9e-5603-8289-f35bc9625409",
|
||||
"required_count": 1,
|
||||
"status": "requested",
|
||||
"superseded_by": null,
|
||||
"updated_at": "2026-09-14T00:33:07+00:00",
|
||||
"validity": {
|
||||
"expires_at": "2026-09-15T00:33:06.722887+00:00",
|
||||
"not_before": "2026-09-14T00:33:06.722887+00:00"
|
||||
}
|
||||
}
|
||||
},
|
||||
{
|
||||
"memo_id": "SECRETS-WP-0010-T03-exec",
|
||||
"action": "exec",
|
||||
"approval": {
|
||||
"binding": {
|
||||
"action": "exec",
|
||||
"actor": "secrets-engine",
|
||||
"digest": "sha256:f2cf0fb53b740900756ccde5587c3578fcff44beef2f1edab17b9a198a4033d8",
|
||||
"human_control": true,
|
||||
"pdp_digest": "sha256:9f17812750fc8962b0fc58fc09df136850c9935a864fafa998a1c030dfb75bd9",
|
||||
"pdp_path": true,
|
||||
"principal": "secrets-engine",
|
||||
"purpose": "IR-WP-0004 read-only OpenRouter key authentication check; no inference",
|
||||
"target": {
|
||||
"attributes": {
|
||||
"auth_targets": [
|
||||
"se-prod-openrouter-llm-connect"
|
||||
],
|
||||
"fields": [
|
||||
"OPENROUTER_API_KEY"
|
||||
],
|
||||
"policy_targets": [
|
||||
"se-prod-openrouter-llm-connect"
|
||||
],
|
||||
"stage": "prod"
|
||||
},
|
||||
"id": "catalog:openrouter-llm-connect",
|
||||
"system": "secrets-engine",
|
||||
"type": "secret-catalog-lane"
|
||||
}
|
||||
},
|
||||
"created_at": "2026-09-14T00:33:07+00:00",
|
||||
"entries": [],
|
||||
"id": "da678b61-35be-598e-8d95-a7aefa2fdc73",
|
||||
"required_count": 1,
|
||||
"status": "requested",
|
||||
"superseded_by": null,
|
||||
"updated_at": "2026-09-14T00:33:07+00:00",
|
||||
"validity": {
|
||||
"expires_at": "2026-09-15T00:33:06.955168+00:00",
|
||||
"not_before": "2026-09-14T00:33:06.955168+00:00"
|
||||
}
|
||||
}
|
||||
}
|
||||
],
|
||||
"credential_values_emitted": false,
|
||||
"signature_verified": true,
|
||||
"excess_scopes_refused": true,
|
||||
"wrong_secret_refused": true,
|
||||
"reader_scope_verified": true,
|
||||
"human_entries_created": false,
|
||||
"approvals_consumed": false,
|
||||
"warden_session": "exited_0_after_self_revocation_and_helper_cleanup"
|
||||
}
|
||||
24
docs/evidence/2026-09-14-t03-requester-provision.json
Normal file
24
docs/evidence/2026-09-14-t03-requester-provision.json
Normal file
|
|
@ -0,0 +1,24 @@
|
|||
{
|
||||
"observed_at": "2026-09-14T00:23:24.931083+00:00",
|
||||
"status": "applied",
|
||||
"phase": "keycape_ready",
|
||||
"ccrs": [
|
||||
"CCR-2026-0024",
|
||||
"CCR-2026-0025"
|
||||
],
|
||||
"credential_values_emitted": false,
|
||||
"approval_mutations": false,
|
||||
"kv_version": 1,
|
||||
"request_id": "2f85087b-68af-028a-a9a7-3c0d89c06c03",
|
||||
"keycape": {
|
||||
"deployment_uid": "99ddd83c-cb3f-4847-bcf8-35f1aa87627f",
|
||||
"generation": 51,
|
||||
"pod_uid": "c4b4b63c-fd5b-45eb-bfa5-59197afe1412",
|
||||
"single_ready_replica": true
|
||||
},
|
||||
"image_unchanged": "forgejo.coulomb.social/coulomb/key-cape@sha256:db2c5a13a47839049349e881c8d19bc39f720ee69d8518f9f2eba2b1f98af9d5",
|
||||
"unrelated_config_preserved": true,
|
||||
"verifier_secret_exported": false,
|
||||
"requester_credential_presented": false,
|
||||
"warden_session": "exited_0_after_self_revocation_and_helper_cleanup"
|
||||
}
|
||||
|
|
@ -0,0 +1,7 @@
|
|||
path "platform/data/workloads/secrets-engine/approval-requester" {
|
||||
capabilities = ["read"]
|
||||
}
|
||||
|
||||
path "platform/metadata/workloads/secrets-engine/approval-requester" {
|
||||
capabilities = ["read"]
|
||||
}
|
||||
|
|
@ -0,0 +1,7 @@
|
|||
path "platform/data/workloads/secrets-engine/approval-requester" {
|
||||
capabilities = ["read"]
|
||||
}
|
||||
|
||||
path "platform/metadata/workloads/secrets-engine/approval-requester" {
|
||||
capabilities = ["read"]
|
||||
}
|
||||
93
scripts/create-t03-approval-requests.py
Normal file
93
scripts/create-t03-approval-requests.py
Normal file
|
|
@ -0,0 +1,93 @@
|
|||
"""Silent, single-attempt creation of the three operator-reviewed T03 requests."""
|
||||
import base64,json,os,stat,subprocess,time
|
||||
from pathlib import Path
|
||||
from datetime import datetime,timezone,timedelta
|
||||
from urllib.request import Request,build_opener,ProxyHandler,HTTPRedirectHandler
|
||||
from urllib.parse import urlencode
|
||||
from urllib.error import HTTPError
|
||||
import jwt
|
||||
ROOT=Path('/home/worsch/railiance-platform')
|
||||
RECEIPT=ROOT/'docs/evidence/2026-09-14-t03-native-approval-requests.json'
|
||||
POLICY='workload-kv-read-secrets-engine-requester-client'
|
||||
KV='platform/data/workloads/secrets-engine/approval-requester'
|
||||
ISSUER='https://kc.coulomb.social'
|
||||
class NoRedirect(HTTPRedirectHandler):
|
||||
def redirect_request(self,*args,**kwargs): return None
|
||||
|
||||
def http(url,*,body=None,headers=None):
|
||||
req=Request(url,data=body,headers=headers or {})
|
||||
try:
|
||||
with build_opener(ProxyHandler({}),NoRedirect()).open(req,timeout=20) as response:
|
||||
content=response.read(1048577);status=response.status
|
||||
except HTTPError as error:
|
||||
status=error.code;content=error.read(1048577);error.close()
|
||||
if len(content)>1048576:raise ValueError('response_too_large')
|
||||
return status,json.loads(content)
|
||||
|
||||
def bao(*args):
|
||||
p=subprocess.run(['bao',*args],capture_output=True,text=True,timeout=20)
|
||||
if p.returncode:raise ValueError('metadata_failed')
|
||||
return json.loads(p.stdout)
|
||||
|
||||
def check_identity(d):
|
||||
policies=set(d.get('policies',[]))|set(d.get('identity_policies',[]))
|
||||
if POLICY not in policies or policies-{POLICY,'default'} or not d.get('entity_id') or not 0<d.get('ttl',0)<=900:
|
||||
raise ValueError('reader_identity_failed')
|
||||
|
||||
def requests():
|
||||
records=json.loads(Path('/home/worsch/flex-auth/examples/informed-decision-t03/records.json').read_text())
|
||||
evaluations=json.loads(Path('/home/worsch/secrets-engine/docs/evidence/2026-09-14-t03-native-pdp-inputs.json').read_text())
|
||||
if {r['action'] for r in records.values()}!={'apply','verify','exec'} or len(records)!=3:raise ValueError('exact_three_records_required')
|
||||
result=[]
|
||||
for memo,record in records.items():
|
||||
d=evaluations[record['action']]
|
||||
if d['provenance']['policy_package_digest']!='sha256:bd11c5fe77ce6439c65fea225ad6b71d2110efc5e7b5bc9b499c59cd0a53b8b4' or d['binding']['subject']['id']!='secrets-engine' or record['binding']['actor']!='secrets-engine':raise ValueError('native_evaluator_binding_drift')
|
||||
digest='sha256:'+__import__('hashlib').sha256(json.dumps(record['binding'],sort_keys=True,separators=(',',':'),ensure_ascii=False).encode()).hexdigest()
|
||||
if digest!=record['binding_digest']:raise ValueError('native_binding_drift')
|
||||
result.append((memo,record,d['binding']['request_digest']))
|
||||
return result
|
||||
|
||||
def main(receipt):
|
||||
prepared=requests()
|
||||
if Path.home().parent.name!='.warden-attended-login' or os.getenv('BAO_TOKEN') or os.getenv('VAULT_TOKEN'):raise ValueError('attended_reader_required')
|
||||
check_identity(bao('token','lookup','-format=json')['data'])
|
||||
for path,expected in [(KV,['read']),('platform/data/workloads/secrets-engine/approval-client',['deny']),('platform/metadata/workloads/secrets-engine',['deny'])]:
|
||||
if bao('token','capabilities','-format=json',path)!=expected:raise ValueError('reader_scope_failed')
|
||||
helper=Path.home()/'.vault-token';info=helper.lstat()
|
||||
if not stat.S_ISREG(info.st_mode) or stat.S_IMODE(info.st_mode)!=0o600 or info.st_uid!=os.getuid():raise ValueError('private_helper_required')
|
||||
status,data=http('https://bao.coulomb.social/v1/'+KV+'?version=1',headers={'X-Vault-Token':helper.read_text().strip()})
|
||||
if status!=200 or data['data']['metadata']['version']!=1:raise ValueError('requester_delivery_failed')
|
||||
secret=data['data']['data']['CLIENT_SECRET'];del data
|
||||
def exchange(scope,credential=secret):
|
||||
auth=base64.b64encode(('secrets-engine-requester:'+credential).encode()).decode()
|
||||
return http(ISSUER+'/token',body=urlencode({'grant_type':'client_credentials','scope':scope}).encode(),headers={'Authorization':'Basic '+auth,'Content-Type':'application/x-www-form-urlencoded'})
|
||||
status,tokens=exchange('approval:create')
|
||||
if status!=200:raise ValueError('requester_exchange_failed')
|
||||
token=tokens['access_token'];status,jwks=http(ISSUER+'/jwks')
|
||||
if status!=200:raise ValueError('jwks_failed')
|
||||
header=jwt.get_unverified_header(token)
|
||||
keys=[key for key in jwks['keys'] if key['kid']==header.get('kid')]
|
||||
if header.get('alg')!='RS256' or len(keys)!=1:raise ValueError('signing_key_failed')
|
||||
claims=jwt.decode(token,jwt.PyJWK.from_dict(keys[0]).key,algorithms=['RS256'],issuer=ISSUER,audience='approval-engine',options={'strict_aud':True,'require':['sub','iat','exp','iss','aud']})
|
||||
expected={'sub':'secrets-engine','tenant':'tenant:platform','principal_type':'service','scope':'approval:create','roles':['secrets-engine-requester'],'groups':[]}
|
||||
if any(claims.get(k)!=v for k,v in expected.items()) or claims['exp']-claims['iat']!=900:raise ValueError('requester_claims_failed')
|
||||
for scope in ('approval:approve','approval:consume','approval:read'):
|
||||
if exchange(scope)[0]!=400:raise ValueError('excess_scope_not_refused')
|
||||
if exchange('approval:create','invalid-synthetic-credential')[0]!=401:raise ValueError('wrong_secret_not_refused')
|
||||
receipt.update(phase='requester_verified',signature_verified=True,excess_scopes_refused=True,wrong_secret_refused=True,reader_scope_verified=True)
|
||||
for memo,record,pdp_digest in prepared:
|
||||
now=datetime.now(timezone.utc)
|
||||
body={'id':record['approval_id'],'binding':record['binding'],'validity':{'not_before':now.isoformat(),'expires_at':(now+timedelta(hours=24)).isoformat()},'required_count':1,'human_control':True,'pdp_path':True,'pdp_digest':pdp_digest}
|
||||
receipt['phase']='create_attempt:'+record['action'];RECEIPT.write_text(json.dumps(receipt,indent=2)+'\n')
|
||||
status,result=http('http://127.0.0.1:18281/v1/approvals',body=json.dumps(body).encode(),headers={'Authorization':'Bearer '+token,'Content-Type':'application/json'})
|
||||
if status!=201 or result['status']!='requested' or result['entries'] or result['binding']['digest']!=record['binding_digest'] or result['binding']['human_control'] is not True or result['binding']['pdp_digest']!=pdp_digest:raise ValueError('request_creation_requires_reconciliation')
|
||||
receipt['requests'].append({'memo_id':memo.removeprefix('memo:'),'action':record['action'],'approval':result})
|
||||
RECEIPT.write_text(json.dumps(receipt,indent=2)+'\n')
|
||||
receipt.update(status='created',phase='three_unapproved_requests_created',human_entries_created=False,approvals_consumed=False)
|
||||
|
||||
if __name__=='__main__':
|
||||
if RECEIPT.exists():raise SystemExit(1)
|
||||
receipt={'observed_at':datetime.now(timezone.utc).isoformat(),'status':'failed','phase':'preflight','requests':[],'credential_values_emitted':False}
|
||||
try:main(receipt)
|
||||
except Exception:raise SystemExit(1) from None
|
||||
finally:RECEIPT.write_text(json.dumps(receipt,indent=2)+'\n')
|
||||
75
scripts/provision-t03-requester.py
Normal file
75
scripts/provision-t03-requester.py
Normal file
|
|
@ -0,0 +1,75 @@
|
|||
"""Silent attended provisioning of the separate create-only T03 requester."""
|
||||
import base64,copy,hashlib,importlib.util,json,os,secrets,sys,time
|
||||
from pathlib import Path
|
||||
from datetime import datetime,timezone
|
||||
import yaml
|
||||
ROOT=Path('/home/worsch/railiance-platform')
|
||||
sys.path.insert(0,str(ROOT/'scripts'))
|
||||
from state_hub_preflight_lane import command,bao,data,assert_cluster,LaneError
|
||||
from keycape_approval_custody import require,read_optional,BOUNDARY
|
||||
KUBE=['kubectl','--kubeconfig','/home/worsch/.kube/config-railiance01']
|
||||
KV='platform/data/workloads/secrets-engine/approval-requester'
|
||||
META='platform/metadata/workloads/secrets-engine/approval-requester'
|
||||
CLIENT=json.loads(Path('/home/worsch/key-cape/docs/t03-requester-registration.json').read_text())
|
||||
RECEIPT=ROOT/'docs/evidence/2026-09-14-t03-requester-provision.json'
|
||||
def load(name,path):
|
||||
spec=importlib.util.spec_from_file_location(name,path); m=importlib.util.module_from_spec(spec);spec.loader.exec_module(m);return m
|
||||
rollout=load('requester_rollout','/home/worsch/net-kingdom/sso-mfa/k8s/keycape/approval-clients-rollout.py')
|
||||
rollout.IDS=('secrets-engine-requester',)
|
||||
|
||||
def run(receipt):
|
||||
require(Path.home().parent.name=='.warden-attended-login' and not os.getenv('BAO_TOKEN') and not os.getenv('VAULT_TOKEN'),'attended_envelope_required')
|
||||
assert_cluster(KUBE)
|
||||
identity=data(bao(['token','lookup','-format=json']))['data']
|
||||
require('platform-admin' in identity['policies'] and 'root' not in identity['policies'],'attended_operator_required')
|
||||
require(CLIENT['clientId']=='secrets-engine-requester' and CLIENT['allowedScopes']==['approval:create'] and CLIENT['serviceSubject']=='secrets-engine' and CLIENT['audience']=='approval-engine' and CLIENT['tenant']=='tenant:platform','requester_contract_drift')
|
||||
require(read_optional(META) is None,'existing_requester_custody_requires_reconciliation')
|
||||
for ref in ('CCR-2026-0024','CCR-2026-0025'):
|
||||
command(['python3',str(ROOT/'scripts/credential-change.py'),'applier-dry-run',ref,'--json'])
|
||||
secret=rollout.get(KUBE,'secret','keycape-config')
|
||||
deployment=rollout.get(KUBE,'deployment','keycape')
|
||||
config=rollout.replacement(secret,[CLIENT])
|
||||
spec=copy.deepcopy(deployment['spec'])
|
||||
require(spec.get('replicas',1)==1 and spec['strategy']['type']=='Recreate','single_recreate_keycape_required')
|
||||
container=next(c for c in spec['template']['spec']['containers'] if c['name']=='keycape')
|
||||
image=container['image']; require('@sha256:' in image,'pinned_keycape_image_required')
|
||||
env_name='KEYCAPE_SECRETS_ENGINE_REQUESTER_CLIENT_SECRET'
|
||||
require(not any(e['name']==env_name for e in container.setdefault('env',[])),'existing_requester_env')
|
||||
container['env'].append({'name':env_name,'valueFrom':{'secretKeyRef':{'name':'keycape-secrets-engine-requester-client','key':'client-secret'}}})
|
||||
rollout.patch_object(KUBE,'secret',secret,'/data/config.yaml',config,dry=True)
|
||||
rollout.patch_object(KUBE,'deployment',deployment,'/spec',spec,dry=True)
|
||||
receipt['phase']='metadata_preflight_passed'
|
||||
boundary=read_optional(BOUNDARY); require(boundary is not None,'agent_boundary_required')
|
||||
additions=''.join('path "'+p+'" { capabilities = ["deny"] }\n' for p in (KV,META))
|
||||
require(all('"'+p+'"' not in boundary['policy'] for p in (KV,META)),'boundary_path_requires_reconciliation')
|
||||
bao(['write',BOUNDARY,'-'],payload={'policy':boundary['policy']+'\n'+additions})
|
||||
require(read_optional(BOUNDARY)['policy']==boundary['policy']+'\n'+additions,'boundary_readback_failed')
|
||||
for ref in ('CCR-2026-0024','CCR-2026-0025'):
|
||||
command(['python3',str(ROOT/'scripts/credential-change.py'),'applier-apply',ref,'--actor','operator via attended T03 requester custody session','--confirm','DELEGATED APPLY '+ref,'--quiet'])
|
||||
receipt['phase']='reader_roles_applied'
|
||||
result=data(bao(['write','-format=json',KV,'-'],payload={'options':{'cas':0},'data':{'CLIENT_SECRET':secrets.token_urlsafe(48)}}))
|
||||
require(result['data']['version']==1,'initial_version_mismatch')
|
||||
receipt.update(phase='custody_seeded',kv_version=1,request_id=result.get('request_id'))
|
||||
RECEIPT.write_text(json.dumps(receipt,indent=2)+'\n')
|
||||
command(KUBE+['apply','-f',str(ROOT/'argocd/platform-addons/openbao-secretstore/t03-requester.yaml')])
|
||||
deadline=time.monotonic()+90
|
||||
while time.monotonic()<deadline:
|
||||
obj=rollout.get(KUBE,'externalsecret','keycape-secrets-engine-requester-client')
|
||||
if any(c.get('type')=='Ready' and c.get('status')=='True' for c in obj.get('status',{}).get('conditions',[])):
|
||||
break
|
||||
time.sleep(2)
|
||||
else:raise LaneError('verifier_sync_failed')
|
||||
receipt['phase']='verifier_synced'
|
||||
# UID/resourceVersion preconditions forbid overwriting concurrent owner changes.
|
||||
rollout.patch_object(KUBE,'secret',secret,'/data/config.yaml',config)
|
||||
after=rollout.get(KUBE,'secret','keycape-config')
|
||||
require(after['data']==dict(secret['data'],**{'config.yaml':config}),'unrelated_config_or_key_changed')
|
||||
rollout.patch_object(KUBE,'deployment',deployment,'/spec',spec)
|
||||
receipt['keycape']=rollout.ready(KUBE,image)
|
||||
receipt.update(status='applied',phase='keycape_ready',image_unchanged=image,unrelated_config_preserved=True,verifier_secret_exported=False,requester_credential_presented=False)
|
||||
|
||||
if __name__=='__main__':
|
||||
receipt={'observed_at':datetime.now(timezone.utc).isoformat(),'status':'failed','phase':'preflight','ccrs':['CCR-2026-0024','CCR-2026-0025'],'credential_values_emitted':False,'approval_mutations':False}
|
||||
try:run(receipt)
|
||||
except Exception:raise SystemExit(1) from None
|
||||
finally:RECEIPT.write_text(json.dumps(receipt,indent=2)+'\n')
|
||||
|
|
@ -633,3 +633,38 @@ Remaining: an actual nonmember login refusal, real approval claim/consume,
|
|||
separate narrow requester admission and deployed Informed Decision review with
|
||||
an explicitly admitted human mandate. The reader group alone grants no review
|
||||
mandate. T03 and CCR delivery activation remain open; no OpenRouter key was read.
|
||||
|
||||
|
||||
### T03 scoped review deployment — 2026-09-14
|
||||
|
||||
The operator explicitly admitted `net-kingdom-admins` as the human review group
|
||||
for only the T03 apply, verify and read-only key-check records, separately from
|
||||
its credential-reader membership. The review service is live and ready at
|
||||
https://decisions.coulomb.social with verified KeyCape groups, fresh MFA and a
|
||||
dedicated caller-bound Flex Auth policy. Its mandate does not grant consumption.
|
||||
|
||||
The new `secrets-engine-requester` client has subject `secrets-engine`, tenant
|
||||
`tenant:platform`, role `secrets-engine-requester`, and only `approval:create`.
|
||||
CCR-2026-0024 and CCR-2026-0025 provide distinct verifier and attended reader
|
||||
custody. Native signature, subject, scope and TTL checks passed; excess scopes
|
||||
and a wrong secret were refused. Existing consumer identity is unchanged.
|
||||
Three real requested approvals were created with human control, required count
|
||||
one, and zero entries. Platform evidence is
|
||||
`docs/evidence/2026-09-14-t03-native-approval-requests.json`.
|
||||
|
||||
Review image: sha256:8f55bcecf37a8d65f96e073510b1ffb4636c0a91d75e1ee7d582ad4bce8b953a.
|
||||
Policy image: sha256:c9f028b49dfcede930a9cc48757ec8371ecc71d20b1bfee2733e55298dffcc7c.
|
||||
Review tests: 339 passed, 39 optional integration tests skipped; 11 container
|
||||
checks and HIGH/CRITICAL image scan passed. Policy checks: 57 local and 6 native
|
||||
caller checks passed, using synthetic subjects, not human binding evidence.
|
||||
Approval Engine CPU request was reduced from 25m to 10m after observing 1m use;
|
||||
review requests 20m and its PDP 5m. Limits are unchanged. Native services ready.
|
||||
|
||||
Remaining T03 gate: the operator's exact signed-in account is needed to address
|
||||
three prepared immutable memos, followed by real acknowledgements and acceptance
|
||||
in Informed Decision. No human entry or consume has been generated by an agent.
|
||||
Then execute claim -> validated PDP Check -> CAS consume separately for apply,
|
||||
verify and exec using scoped attended authority, and capture native denial,
|
||||
revocation, workload health and key-check evidence. No OpenRouter credential has
|
||||
been read and no inference or spend was performed. T03 remains waiting; this
|
||||
entry supersedes earlier statements that requester or group admission is missing.
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue