From 814469944c151cbfdca391d87366d84743bcd3cf Mon Sep 17 00:00:00 2001 From: codex Date: Mon, 2 Nov 2026 11:33:10 +0100 Subject: [PATCH] Record the MAS evidence supplier key path. The founder stored the API key at platform/suppliers/scaleway/mas-evidence-backup-primary, preferred project mail-address-semantics. The workload pair and delivery admission stay unchanged. Assistant: grok Assistant-Session: 01a198fa-fd27-7e41-a0a2-57355c3e4efd --- .../CCR-2026-0062-mas-backup-primary.yaml | 13 ++++++++++++- .../mas-evidence-backup-grant-2026-11-02.md | 14 ++++++++++---- workplans/RPF-WP-0070-mas-evidence-recovery.md | 10 +++++++--- 3 files changed, 29 insertions(+), 8 deletions(-) diff --git a/credential-change-requests/CCR-2026-0062-mas-backup-primary.yaml b/credential-change-requests/CCR-2026-0062-mas-backup-primary.yaml index 4da91c6..b36086f 100644 --- a/credential-change-requests/CCR-2026-0062-mas-backup-primary.yaml +++ b/credential-change-requests/CCR-2026-0062-mas-backup-primary.yaml @@ -103,7 +103,7 @@ "endpoint": "https://s3.nl-ams.scw.cloud", "bucket": "railiance-platform-pg-backup", "prefix": "platform-pg/application-archives/mas/", - "identity": "IAM application mas-evidence-backup-primary 25a4cbca-220e-40c0-9af5-6c7713000174; no key stored; bucket policy source allows only platform-pg/application-archives/mas/ and withholds object delete", + "identity": "IAM application mas-evidence-backup-primary 25a4cbca-220e-40c0-9af5-6c7713000174; founder stored the API key at platform/suppliers/scaleway/mas-evidence-backup-primary, preferred project mail-address-semantics; this workload path has no pair; bucket policy source allows only platform-pg/application-archives/mas/ and withholds object delete", "retained_delete": false }, "risk": { @@ -138,6 +138,17 @@ "Attended platform-admin login ran scripts/install-mas-backup-primary-reader.sh. The local receipt status is installed and the stage file is empty.", "Readback bound backup-primary-delivery in namespace mas, one policy workload-kv-read-mas-backup-primary, role mas-backup-primary-workload-kv-read, ttl 300, token_max_ttl 300, token_explicit_max_ttl 300, token_num_uses 4, token_no_default_policy true, token_type service." ] + }, + { + "at": "2026-11-02T10:31:45Z", + "actor": "grok", + "kind": "supplier_path_recorded", + "result": "passed", + "details": [ + "Founder stored the API key at platform/suppliers/scaleway/mas-evidence-backup-primary and bound it to preferred project mail-address-semantics.", + "ops-mason custody row and ops-warden catalog id scaleway-mas-evidence-backup-primary record that path. The value was not read. The workload pair remains empty and delivery admission stays false.", + "Metadata read of that path with the local token returned HTTP 403, so the version was not confirmed from this workstation." + ] } ], "activation_conditions": [ diff --git a/docs/credential-lane-designs/mas-evidence-backup-grant-2026-11-02.md b/docs/credential-lane-designs/mas-evidence-backup-grant-2026-11-02.md index c93afc3..63def04 100644 --- a/docs/credential-lane-designs/mas-evidence-backup-grant-2026-11-02.md +++ b/docs/credential-lane-designs/mas-evidence-backup-grant-2026-11-02.md @@ -6,7 +6,10 @@ ServiceAccount `backup-primary-delivery` in namespace `mas`, which exists with automount disabled. Delivery admission is still false. The OpenBao policy and role were installed at 2026-11-02T09:02:50Z. IAM application `mas-evidence-backup-primary` is `25a4cbca-220e-40c0-9af5-6c7713000174`. -No key, value, node file, offsite upload, or timer exists yet. +The founder stored its API key at +`platform/suppliers/scaleway/mas-evidence-backup-primary`, bound to preferred +project `mail-address-semantics`. The local token cannot read that metadata. +No workload pair, node file, offsite upload, or timer exists yet. The accepted shape is the email-connect ledger reader, CCR-2026-0037. The MAS prefix is `platform-pg/application-archives/mas/` in bucket @@ -17,13 +20,14 @@ local. It is not an offsite object. | Item | Prepared value | Live state | | --- | --- | --- | | Reader request | CCR-2026-0062 | applied; delivery admission false | +| Supplier key | platform/suppliers/scaleway/mas-evidence-backup-primary | founder-stored; preferred project mail-address-semantics; metadata not read here | | KV path | platform/workloads/mas/backup-primary | no value written | | Fields | AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY | absent | | Policy | workload-kv-read-mas-backup-primary | installed; receipt status installed | | Role | mas-backup-primary-workload-kv-read | installed for backup-primary-delivery in namespace mas | | ServiceAccount | backup-primary-delivery in namespace mas | live, automount false, uid c0e5867b-b4be-49b7-94db-6aae0a6e566e; no RoleBinding | | Node file | /etc/mas-backup/primary.env, root:root 0600, directory 0700 | not created | -| Provider identity | application mas-evidence-backup-primary `25a4cbca-220e-40c0-9af5-6c7713000174` | id recorded; no API key stored | +| Provider identity | application mas-evidence-backup-primary `25a4cbca-220e-40c0-9af5-6c7713000174` | id recorded; key at the supplier path above, not at the workload path | Do not reuse the email-connect publisher or its node file. Object-storage IAM is not prefix-scoped inside a project, so a later admission needs its own IAM @@ -39,8 +43,10 @@ and is not created here. 2026-11-02T09:02:50Z and wrote a metadata receipt. Delivery admission stays false. 3. IAM application `mas-evidence-backup-primary` is - `25a4cbca-220e-40c0-9af5-6c7713000174`. Do not add a key to email-connect - or to a broad application. + `25a4cbca-220e-40c0-9af5-6c7713000174`. The founder stored its API key at + `platform/suppliers/scaleway/mas-evidence-backup-primary`, preferred + project `mail-address-semantics`. Do not add a key to email-connect or + to a broad application, and do not copy this value onto the workload path. 4. The source bucket policy has three statements for that application, limited to `platform-pg/application-archives/mas/`, with no object delete. The live merge did not run: the local OpenBao token cannot read the diff --git a/workplans/RPF-WP-0070-mas-evidence-recovery.md b/workplans/RPF-WP-0070-mas-evidence-recovery.md index 8a80887..f588387 100644 --- a/workplans/RPF-WP-0070-mas-evidence-recovery.md +++ b/workplans/RPF-WP-0070-mas-evidence-recovery.md @@ -40,7 +40,7 @@ status: progress priority: medium needs_human: true depends_on: [RPF-WP-0053-T05] -intervention_note: "CCR-2026-0062 is applied. IAM application mas-evidence-backup-primary is 25a4cbca-220e-40c0-9af5-6c7713000174. The source bucket policy names that id under platform-pg/application-archives/mas/ with no object delete. No API key is stored. Delivery admission stays false. Age-identity escrow remains separate." +intervention_note: "CCR-2026-0062 is applied. IAM application mas-evidence-backup-primary is 25a4cbca-220e-40c0-9af5-6c7713000174. The founder stored its API key at platform/suppliers/scaleway/mas-evidence-backup-primary, preferred project mail-address-semantics. The source bucket policy names that id under platform-pg/application-archives/mas/ with no object delete. The workload pair is still empty. Delivery admission stays false. Age-identity escrow remains separate." state_hub_task_id: "4f6484fb-8303-5dd5-94cb-b2622e1322c8" ``` @@ -69,7 +69,11 @@ role were installed at 2026-11-02T09:02:50Z by the silent reader script. IAM application `mas-evidence-backup-primary` is `25a4cbca-220e-40c0-9af5-6c7713000174`. The source bucket policy allows that id only under `platform-pg/application-archives/mas/` and does not -grant object delete. No API key is stored. The KV pair and -`/etc/mas-backup/primary.env` do not exist. Pair-custody lists still +grant object delete. The founder stored the API key at +`platform/suppliers/scaleway/mas-evidence-backup-primary`, preferred +project `mail-address-semantics`. ops-mason records that custody row and +ops-warden routes it as `scaleway-mas-evidence-backup-primary`. The +workload KV pair and `/etc/mas-backup/primary.env` do not exist. +Pair-custody lists still name only coulomb-social and email-connect. Design: `docs/credential-lane-designs/mas-evidence-backup-grant-2026-11-02.md`.