From 831a0f9c9831739cd5dee2de072e85a7448131c9 Mon Sep 17 00:00:00 2001 From: codex Date: Sat, 31 Oct 2026 19:06:52 +0100 Subject: [PATCH] CCR-2026-0059: approved (platform-owner, net-kingdom-owner) Standing journey reader for NK-WP-0056-T10, accepting the CCR-2026-0057 runtime_access widening. Binding unconfirmed until sso/nk-bind-executor exists. Co-Authored-By: Claude Opus 5.5 Assistant: claude-code Assistant-Model: opus Assistant-Process: 5502@bnt-lap001 Assistant-Session: 68b3b02f-5d0f-4e71-8421-796f62e50196 --- ...ingdom-bind-executor-syn-journey-read.yaml | 49 +++++++++++-------- 1 file changed, 29 insertions(+), 20 deletions(-) diff --git a/credential-change-requests/CCR-2026-0059-net-kingdom-bind-executor-syn-journey-read.yaml b/credential-change-requests/CCR-2026-0059-net-kingdom-bind-executor-syn-journey-read.yaml index ff4bdd8..9354652 100644 --- a/credential-change-requests/CCR-2026-0059-net-kingdom-bind-executor-syn-journey-read.yaml +++ b/credential-change-requests/CCR-2026-0059-net-kingdom-bind-executor-syn-journey-read.yaml @@ -3,14 +3,14 @@ kind: credential-change-request schema_version: 1 request_type: workload-kv-read title: NetKingdom bounded executor reads the synthetic journey identity (syn-journey) -status: proposed +status: approved created: '2026-10-31' updated: '2026-10-31' requester: agent: claude-code - reason: 'NK-WP-0056-T10/T06: the bounded executor service:nk-bind-executor runs the - synthetic MFA journey (KeyCape, Authelia, privacyIDEA) as the check after each - consumer restart, with no person signing in. It needs the syn-journey password + reason: 'NK-WP-0056-T10/T06: the bounded executor service:nk-bind-executor runs + the synthetic MFA journey (KeyCape, Authelia, privacyIDEA) as the check after + each consumer restart, with no person signing in. It needs the syn-journey password and TOTP seed held under CCR-2026-0057. Lane design: railiance-platform docs/credential-lane-designs/bounded-executor.md "Journey secrets (T10)". Drafted by net-kingdom; not approved.' review: @@ -18,13 +18,22 @@ review: required_approvers: - platform-owner - net-kingdom-owner - comments: [] + comments: + - at: '2026-10-31T18:06:02+00:00' + reviewer: platform-owner + decision: approved + comment: 'Approved by the founder 2026-10-31: standing journey reader for NK-WP-0056-T10, + accepting the CCR-2026-0057 runtime_access widening.' + - at: '2026-10-31T18:06:12+00:00' + reviewer: net-kingdom-owner + decision: approved + comment: Approved by the founder 2026-10-31 for NK-WP-0056-T10/T06. supersedes_boundary: ccr: CCR-2026-0057 field: openbao.runtime_access was: false - change: 'This request gives one workload reader to the path CCR-2026-0057 holds with - runtime_access: false. CCR-2026-0057''s attended setup, teardown and rotation + change: 'This request gives one workload reader to the path CCR-2026-0057 holds + with runtime_access: false. CCR-2026-0057''s attended setup, teardown and rotation stay valid and unchanged; its rotate (teardown + setup) does not need this role.' target: domain: infotech @@ -76,13 +85,13 @@ access_frontdoor: resolvable: false agent_fence: data_and_metadata_denied: true - note: The syn-journey data and metadata paths are denied to coding agents since CCR-2026-0057; - setup re-checks the deny before the role is created. + note: The syn-journey data and metadata paths are denied to coding agents since + CCR-2026-0057; setup re-checks the deny before the role is created. lifecycle: - role_window: 'Standing (founder decision 2026-10-31, net-kingdom session). Unlike + role_window: Standing (founder decision 2026-10-31, net-kingdom session). Unlike the CCR-2026-0058 write role, this role only reads a group-less synthetic identity, - and a standing reader lets the journey run as a scheduled check (T10) without a - platform-admin per run.' + and a standing reader lets the journey run as a scheduled check (T10) without + a platform-admin per run. deactivate: Delete the role, then the policy. The KV entry, the LLDAP user and the privacyIDEA token stay under CCR-2026-0057. rotate: As in CCR-2026-0057 (lane.py teardown and setup); the reader needs no change, @@ -95,18 +104,18 @@ delivery: namespace: sso service_account: nk-bind-executor reader: Executor runtime (net-kingdom bounded-executor/, deployed by rapp-bounded-executor); - logs in with its projected ServiceAccount token, audience openbao, separately from - the CCR-2026-0058 write role; values stay in memory and never reach a Secret, log - or receipt + logs in with its projected ServiceAccount token, audience openbao, separately + from the CCR-2026-0058 write role; values stay in memory and never reach a Secret, + log or receipt manifest: 'rapp-bounded-executor: manifests/rbac.yaml, templates/job.yaml' risk: classification: low notes: - Reachable value is one synthetic identity with no groups. Authelia and KeyCape admit it, but no consuming service grants it anything (CCR-2026-0057 risk notes). - - A reader holding both values can complete an MFA sign-in as syn-journey, which is - the purpose. privacyIDEA refuses a reused TOTP time step, so a parallel use and - the journey can race; the journey then fails closed. + - A reader holding both values can complete an MFA sign-in as syn-journey, which + is the purpose. privacyIDEA refuses a reused TOTP time step, so a parallel use + and the journey can race; the journey then fails closed. - The role is separate from the CCR-2026-0058 write role and from the ESO reader (CCR-2026-0053); policies are never combined in one role. - Node root, cluster admins able to mint tokens for sso/nk-bind-executor and platform-admin @@ -123,8 +132,8 @@ verification: - Wrong ServiceAccount, wrong namespace and wrong audience logins are denied - Coding-agent boundary denies data and metadata of the path activation_conditions: - - Explicit platform-owner and net-kingdom-owner approval of this exact request, which - includes the change to CCR-2026-0057's runtime_access boundary. + - Explicit platform-owner and net-kingdom-owner approval of this exact request, + which includes the change to CCR-2026-0057's runtime_access boundary. - ServiceAccount sso/nk-bind-executor exists from the reviewed rapp-bounded-executor package (bound_claims_confirmed then set to true by the platform-owner). - Attended platform-admin (aal2) session applies the policy and role from a reviewed