From 79fbb4bdb5beb6c908e11691f8a4fd91ca9d151d Mon Sep 17 00:00:00 2001 From: codex Date: Sun, 18 Oct 2026 12:58:39 +0200 Subject: [PATCH] CCR-2026-0051: binding confirmed on native evidence, status applied; RPF-WP-0061 follow-up D Co-Authored-By: Claude Opus 5.5 Assistant: claude-code Assistant-Model: opus Assistant-Process: 306568@bnt-lap001 Assistant-Session: 8bdf8150-ea56-41e7-9132-13f04f6b0b91 --- .../CCR-2026-0051-mas-tem-relay-smtp.yaml | 24 +++++++++++++++++-- .../RPF-WP-0061-self-service-ccr-intake.md | 5 ++++ 2 files changed, 27 insertions(+), 2 deletions(-) diff --git a/credential-change-requests/CCR-2026-0051-mas-tem-relay-smtp.yaml b/credential-change-requests/CCR-2026-0051-mas-tem-relay-smtp.yaml index e26cb44..eee70d5 100644 --- a/credential-change-requests/CCR-2026-0051-mas-tem-relay-smtp.yaml +++ b/credential-change-requests/CCR-2026-0051-mas-tem-relay-smtp.yaml @@ -3,7 +3,7 @@ kind: credential-change-request schema_version: 1 request_type: workload-kv-read title: Temporary MAS Scaleway TEM relay SMTP ESO read lane -status: approved +status: applied created: '2026-10-18' updated: '2026-10-18' requester: @@ -37,6 +37,15 @@ review: path=platform/suppliers/scaleway/mas-tem-relay policy=workload-kv-read-mas-tem-relay auth_role=auth/kubernetes/role/external-secrets-mas-tem-relay; rationale=temporary MAS TEM relay lane, read-only, namespace mas, torn down with mas' + - at: '2026-10-18T10:58:26+00:00' + reviewer: railiance-platform-owner (claude, native evidence) + decision: binding_confirmed + comment: 'Native 2026-10-18: SA mas-tem-relay-eso exists in ns mas (consumer mail-address-semantics + deploy/railiance/manifests.yaml 2e9a074, automount false). SecretStore mas/openbao-mas-tem-relay + references mount kubernetes, role external-secrets-mas-tem-relay, SA mas-tem-relay-eso, + audience openbao, and validated Ready at 10:49:56Z, i.e. a successful login + with exactly the CCR bound claims. ESO reads the path; the 10:56:56Z failure + is consumer-side admission, not auth.' target: domain: infotech tenant: platform @@ -63,7 +72,7 @@ openbao: - mas-tem-relay-eso service_account_namespaces: - mas - bound_claims_confirmed: false + bound_claims_confirmed: true policies: - workload-kv-read-mas-tem-relay ttl: 15m @@ -119,6 +128,17 @@ verification: no value read - 'pending: SA mas-tem-relay-eso not yet applied (bound_claims_confirmed false); confirm-binding and ESO sync next' + - at: '2026-10-18T10:58:27+00:00' + actor: railiance-platform (claude) + kind: native-binding + result: success + details: + - SecretStoreValid 2026-10-18T10:49:56Z with the exact CCR SA/namespace/audience/role; + ESO provider read succeeded; ops-mason apply readback 102668f. + - 'Open: ExternalSecret mas/mas-relay refused by admission policy reject-secret-last-applied + (client-side apply annotation copied to target); fix sent to mail-address-semantics + 1a76a832. Negative checks (wrong SA/namespace/audience, sibling, list, metadata, + write) not yet run.' lifecycle: deactivate: Delete ExternalSecret and role external-secrets-mas-tem-relay, then policy workload-kv-read-mas-tem-relay, when namespace mas is torn down. diff --git a/workplans/RPF-WP-0061-self-service-ccr-intake.md b/workplans/RPF-WP-0061-self-service-ccr-intake.md index 99d61c4..c6a9bfc 100644 --- a/workplans/RPF-WP-0061-self-service-ccr-intake.md +++ b/workplans/RPF-WP-0061-self-service-ccr-intake.md @@ -172,6 +172,11 @@ MFA-backed OIDC login so clients can sync themselves; (C) separate Forgejo and OS identities per agent so `ccr/*` can be restricted. Both stem from the finding that every workstation agent pushes as Forgejo user `tegwick` with the key `workstation-automation`. +(D, ops-mason point 5) Self-service teardown: deactivate lifecycle event filed +by the client and applied under ops-mason-construct. Founder to decide whether a +deactivate needs a decision. Until then teardown goes through a platform session. +ops-mason points 1-4 were adopted in 7e7ca8b (`plan_ref`, `render-policy`, +single hub decision, readback before `record-evidence`). ## T05 — Client documentation and first self-service CCR