From 84c529f239c81e6d3ca337015700b03e3a862f53 Mon Sep 17 00:00:00 2001 From: codex Date: Fri, 16 Oct 2026 20:26:28 +0200 Subject: [PATCH] Separate signer runtime storage review from GitOps ownership Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a140c4-354a-7823-8f0d-8f717397f786 --- ...-2026-0050-flex-auth-envelope-signing.yaml | 21 ++++++++++++------- ...ex-auth-envelope-signing-native-adapter.md | 18 ++++++++++++++++ ...lex-auth-envelope-signing-native-plan.json | 20 +++++++++++------- scripts/flex_auth_signer_native.py | 2 +- tests/test_flex_auth_signer_native.py | 17 +++++++++++++++ ...-WP-0035-credential-lane-implementation.md | 16 ++++++++++++++ 6 files changed, 79 insertions(+), 15 deletions(-) diff --git a/credential-change-requests/CCR-2026-0050-flex-auth-envelope-signing.yaml b/credential-change-requests/CCR-2026-0050-flex-auth-envelope-signing.yaml index ccccdb2..6e8b621 100644 --- a/credential-change-requests/CCR-2026-0050-flex-auth-envelope-signing.yaml +++ b/credential-change-requests/CCR-2026-0050-flex-auth-envelope-signing.yaml @@ -18,7 +18,7 @@ review: - railiance-platform-owner - access-engine-owner - secrets-engine-owner - - cluster-gitops-owner + - cluster-runtime-storage-owner comments: [] target: domain: infotech @@ -77,8 +77,10 @@ risk: only private field is projected. Signer and Secrets consumer have no KV read role.' - No parent/list/metadata/write/delete capability on ESO role. No token/Secret read or ExternalSecret mutation granted to signer/consumer. - - Dedicated role is new scope; founder approval required. No workload rapp tuple - invented; absent managed package declaration remains explicit migration debt. + - Dedicated role is new scope; founder approval required. Canonical local draft + rapp-flex-auth-secrets-engine declaration committed d52f811ed5ec0be27c9c367e71d476125b3228be + (tree d4fbad71bdc8ef870603526ccd1f53195d0322af) resolves locally. Remote publication, + placement and actual runtime/package join remain open; no missing-declaration waiver. - Controlled outage fence stops every signer pod and disables autoscaling before creation/rotation. Recreate single writer and retained PVC remain Access-owned review gates. @@ -102,10 +104,15 @@ verification: activation_conditions: - All five required approvers independently dispose the exact CCR and native writer/fence proposal; founder exact new custody scope approved. - - Current retained identity919ce25, immutable published producer image and explicit - new flex-auth-secrets-engine-outbox PVC1Gi/local-path, retention/reclaim and bounded-runtime - plan reviewed by Access; missing managed package migration debt explicitly accepted - for this retained workload only. + - Exact proposed candidate source Git revision 84c78e072c8f3daf2bc3b90f8efc8fbeb16c3cf0 and immutable + OCI reference forgejo.coulomb.social/coulomb/flex-auth@sha256:09a83b273740133518cc7e7915fb211381e06545d347d2dd1974042525ac981f + published by successful ordinary CI402; source OS-lock/64MiB/startup hardening present. + Access reviews exact workload/Helm image/mount/outbox source and actual stopped fence; + Platform reviews existing GitOps Application sync/freeze; cluster reviews runtime, + headroom and new PVC1Gi/local-path actual PV retention. Local draft package d52 + remains source2b/current05a, not candidate84 adoption; remote placement/runtime join + and native mounted-runtime acceptance remain open. Enablement only if separately + proposed ArgoCD installation/controller configuration changes; none granted here. - Exact native bound claims verified without printing JWT/Secret; read grant policy and role native readback match source. - Protected child source pinned, silent attended OIDC context verified, target cluster/backend diff --git a/docs/credential-lane-designs/flex-auth-envelope-signing-native-adapter.md b/docs/credential-lane-designs/flex-auth-envelope-signing-native-adapter.md index 9dcfe1b..4f719c5 100644 --- a/docs/credential-lane-designs/flex-auth-envelope-signing-native-adapter.md +++ b/docs/credential-lane-designs/flex-auth-envelope-signing-native-adapter.md @@ -185,3 +185,21 @@ refresh after OIDC, reinterpret expiry as start-only, widen120seconds, skip reviews or start a general window-grant service. An alternative authority/window contract would itself require separate owner/founder design and is not supplied by R2. Current native admission remains unapproved. + +## R3 precise owner review boundary + +The native review slot is now `cluster-runtime-storage-owner`, held by +railiance-cluster for runtime/storage/headroom only. The previous +`cluster-gitops-owner` slot conflated separate authorities and is rejected; +no historic review is reinterpreted as a combined assent. Platform's existing +review covers its custody/read lane and existing GitOps Applications/freeze +integration. Access retains workload/release/Helm-values and signer/outbox +ownership. Enablement review is needed only when the action actually changes +ArgoCD installation/controller configuration; this action does not authorize +that. Changed scope requires a separate exact revision and any affected owner. + +This is a source-schema correction, not a new approval. Existing R1/R2 source +reviews and P1/P2 packets remain frozen. A successor packet must pin the new +executor/source-bundle/plan/CCR hashes and collect five exact fresh dispositions +under the corrected role set. Admission-file digest approval and CCR +approved/binding-confirmed status/native checks remain unchanged. diff --git a/docs/credential-lane-designs/flex-auth-envelope-signing-native-plan.json b/docs/credential-lane-designs/flex-auth-envelope-signing-native-plan.json index 167408d..165d331 100644 --- a/docs/credential-lane-designs/flex-auth-envelope-signing-native-plan.json +++ b/docs/credential-lane-designs/flex-auth-envelope-signing-native-plan.json @@ -67,11 +67,11 @@ "Verify deployment spec replicas0, observed generation caught up, no live or terminating owned ReplicaSet/pods, no matching signer-SA pods and no HPA targeting deployment.", "Reject a differing/previously existing KV entry at bootstrap. Hold exclusive owner action receipt lock and recheck fence immediately before CAS." ], - "after_cas": "Keep consumers/signer stopped until independent public admission and exact ESO/readback/source/image verification. Recreate1 is Access-owned; any drift or uncertain outcome keeps fence closed. Access reports current outbox lacks OS process lock, byte ceiling and bounded startup/compaction; Recreate1 alone is not bounded durable acceptance. Keep protected acceptance closed until reviewed source hardening or explicit bounded attended fixture disposition.", - "concurrency": "Single attended owner window/exclusive receipt; GitOps/Helm autosync/other writers must be paused by Access/cluster owner under distinct reviewed action. Plan is not a Kubernetes atomic fence or same-UID isolation." + "after_cas": "Keep consumers/signer stopped until independent public admission and exact ESO/readback/source/image verification. Access published source Git revision 84c78e072c8f3daf2bc3b90f8efc8fbeb16c3cf0 with OS process lock,64MiB capacity/startup bounds and ordinary CI402 success, immutable OCI reference forgejo.coulomb.social/coulomb/flex-auth@sha256:09a83b273740133518cc7e7915fb211381e06545d347d2dd1974042525ac981f. This supplies reviewed-source/publication evidence, not native mounted-runtime/durable-record acceptance. Access owns Recreate1 activation; actual stopped fence, single writer, PV retention and protected consumer acceptance remain open.", + "concurrency": "Single attended owner window/exclusive receipt; Access owns workload/Helm release and freeze of competing workload writers; Platform owns existing GitOps Applications and sync/freeze integration; cluster owner reviews runtime/storage/headroom only. Enablement reviews actual ArgoCD installation/controller configuration changes only, which this action excludes. Actual competing creator IDs/revisions and stopped signer fence need separately reviewed authenticated observations. Plan is not a Kubernetes atomic fence or same-UID isolation." }, "protected_adapter": { - "state": "implementation/independent tests still required before executable approval; fixture code must never be promoted by removing its dev-process check", + "state": "Native adapter bootstrap/phase-aware read-only recovery source implemented and tested at published Platform a3e8eb64bae110393ba0aeab043de03a92b8421a; owner-boundary source R3/R4 is a successor exact review revision, not a native execution approval. Exact source/CCR, distinct owner/founder dispositions, entity/window/expiry and actual backend/fence remain mandatory. Fixture dev-process gate remains preserved.", "reuse": [ "scripts/state_hub_preflight_lane.py attended silent child/cluster/platform-admin/fencing patterns", "scripts/flex_auth_signer_custody.py protected Ed25519 CAS/readback and receipt state machine", @@ -115,9 +115,9 @@ "requested_scope": { "read_lane": "Exact CCR0050 policy/role/delivery source only after separate founder review. No extra ESO RBAC permitted.", "custody_writer": "One attended exact-target CAS0 plus fixed KV metadata setup/readback; no standing writer grant or broker role. This authority is separate from read CCR.", - "kubernetes": "Metadata-only fence observations by child; Access/cluster separately approve stop/restart/delivery manifests and sync control.", + "kubernetes": "Metadata-only fence observations by child; Access separately reviews workload/Helm stop/restart/delivery; Platform owns GitOps Application sync/freeze integration; cluster owner reviews runtime/storage/headroom/PV retention; no ArgoCD installation/controller configuration mutation included.", "new_infrastructure_spend_eur": 0, - "new_resources": "Platform creates no storage resources. Access reports zero flex-auth PVCs; Access proposes separate exact new flex-auth-secrets-engine-outbox1Gi local-path Helmkeep. Provisioning, PV reclaim/Delete/WaitForFirstConsumer retention and runtime log bounds require separate founder/cluster/Access review; no durable outbox acceptance yet.", + "new_resources": "Platform creates no storage resources. Access proposes separate exact new flex-auth-secrets-engine-outbox1Gi local-path Helmkeep. Actual provisioning/PV identity, StorageClass Delete/WaitForFirstConsumer to reviewed PV Retain disposition and native bounded-runtime evidence remain open. Source lock/64MiB/startup bounds are published in candidate84, not evidence of native mounted-runtime acceptance.", "risk_bound": "Controlled loss of retained PDP availability during explicit attended fence; seed compromise can forge lifecycle decisions until independent public trust withdrawal; founder must approve this concrete high-risk scope." }, "reviews_required": [ @@ -134,7 +134,7 @@ "disposition": "pending exact source/artifact review; no approval recorded" }, { - "role": "cluster-gitops-owner", + "role": "cluster-runtime-storage-owner", "disposition": "pending exact source/artifact review; no approval recorded" }, { @@ -147,6 +147,12 @@ "supersedes_unadmitted_R3_role": "external-secrets-flex-auth-envelope-signing replaces flex-auth-envelope-signing-eso to fit existing delegated-applier role convention; dedicated SA unchanged", "read_ccr_field_projection": "Only ED25519_PRIVATE_KEY is delivered; public sibling fields remain visible to dedicated document-reader identity but never become consumer trust discovery", "projection_source": "docs/credential-lane-designs/flex-auth-envelope-signing-native-projection.yaml.proposed", - "managed_declaration": "Missing rapp declaration remains migration debt; retain actual Access919ce25 workload identity, do not create package tuple" + "managed_declaration": "Canonical local rapp-flex-auth-secrets-engine declaration committed d52f811ed5ec0be27c9c367e71d476125b3228be, exact13file tree d4fbad71bdc8ef870603526ccd1f53195d0322af; tuple rapp-flex-auth-secrets-engine/flex-auth-secrets-engine/flex-auth-secrets-engine resolves locally as draft. Frozen source2b/current05a package baseline does not adopt candidate84/signing. Remote publication/placement and actual runtime/package join remain open. No missing-declaration claim or migration-debt waiver is applicable to the established local declaration." + }, + "owner_review_scope": { + "railiance-platform-owner": "OpenBao custody/read lane; existing GitOps Applications and their sync/freeze/controller ownership; covers explicitly identified workload/Helm competing-writer integration with Access, not Access workload semantic ownership.", + "access-engine-owner": "Retained workload/release source, Helm values, candidate image, signer delivery/mount and process/outbox fencing/rollback.", + "cluster-runtime-storage-owner": "railiance-cluster: cluster identity/runtime/storage/headroom, local-path provisioning and actual PV retention; excludes workload and GitOps Application ownership.", + "enablement_condition": "railiance-enablement additional exact review required only if proposed action changes ArgoCD installation/controller configuration; this fixed custody action authorizes no such change. Changed scope needs a separately reviewed exact revision rather than blanket extra reviewer." } } diff --git a/scripts/flex_auth_signer_native.py b/scripts/flex_auth_signer_native.py index c8cf934..4f1e79c 100644 --- a/scripts/flex_auth_signer_native.py +++ b/scripts/flex_auth_signer_native.py @@ -41,7 +41,7 @@ NAME='flex-auth-secrets-engine' SECRET='flex-auth-secrets-engine-envelope-signing' ROLE='external-secrets-flex-auth-envelope-signing' LIFECYCLE='sha256:bd11c5fe77ce6439c65fea225ad6b71d2110efc5e7b5bc9b499c59cd0a53b8b4' -REVIEWS={'founder','railiance-platform-owner','access-engine-owner','secrets-engine-owner','cluster-gitops-owner'} +REVIEWS={'founder','railiance-platform-owner','access-engine-owner','secrets-engine-owner','cluster-runtime-storage-owner'} SOURCE_FILES={'scripts/flex_auth_signer_native.py','scripts/flex_auth_signer_custody.py','scripts/task_execution_native_fixture.py','scripts/task_execution_journal.py','scripts/task_execution_recovery.py','scripts/credential-change.py'} diff --git a/tests/test_flex_auth_signer_native.py b/tests/test_flex_auth_signer_native.py index da078e6..85e6930 100644 --- a/tests/test_flex_auth_signer_native.py +++ b/tests/test_flex_auth_signer_native.py @@ -316,3 +316,20 @@ def test_generated_but_unstored_seed_phase_recovers_without_public_admission(nat assert result['public_key'] is None and result['public_fingerprint'] is None assert old.read_bytes()==raw assert not any(x[0]=='http' and x[1]=='POST' for x in io.calls) + + +def test_exact_runtime_storage_owner_slot_replaces_conflated_role(native): + c,io,directory,call,approve,source=native + assert m.REVIEWS=={'founder','railiance-platform-owner','access-engine-owner','secrets-engine-owner','cluster-runtime-storage-owner'} + assert m.validate_admission(c)>5 + old=deepcopy(c) + old['owner_reviews']['cluster-gitops-owner']=old['owner_reviews'].pop('cluster-runtime-storage-owner') + with pytest.raises(Refused,match='distinct owner reviews'): + m.validate_admission(old) + missing=deepcopy(c);missing['owner_reviews'].pop('cluster-runtime-storage-owner') + with pytest.raises(Refused,match='distinct owner reviews'): + m.validate_admission(missing) + extra=deepcopy(c);extra['owner_reviews']['railiance-enablement-owner']=next(iter(extra['owner_reviews'].values())) + with pytest.raises(Refused,match='distinct owner reviews'): + m.validate_admission(extra) + assert io.calls==[] diff --git a/workplans/RPF-WP-0035-credential-lane-implementation.md b/workplans/RPF-WP-0035-credential-lane-implementation.md index b675d08..96ce607 100644 --- a/workplans/RPF-WP-0035-credential-lane-implementation.md +++ b/workplans/RPF-WP-0035-credential-lane-implementation.md @@ -1375,3 +1375,19 @@ metadata-loss and denied/ambiguous tests added.120second expiry is unchanged; external reviews and unbounded OIDC require a pre-reviewed exact scheduled window, otherwise refuse/new explicit revision. No native or owner approval inferred; no live action. + + +2026-10-16 T13 bounded source-review preparation note (no status/scope closure): +Native signer owner-boundary R3/R4 preparation replaces conflated +cluster-gitops-owner with cluster-runtime-storage-owner. Platform retains +OpenBao and existing GitOps Applications/sync-freeze integration; Access owns +workload/Helm release semantics; cluster reviews runtime/storage/headroom; +Enablement participates only for actual ArgoCD installation/controller changes. +Source facts reconcile implemented/tested native adapter a3e8eb64, canonical +local draft package d52f811/tree d4fbad7 (frozen source2b/current05a) and +ordinary CI402 published candidate84c78e0/image09a83b with OS lock/64MiB/startup +hardening. Prior R1/R2/R3 and packetP1/P2 reviews/failures remain frozen. +No missing-local-declaration waiver, remote placement, actual stopped fence, +PV retention, native custody, independent post-key trust or founder/owner +approval is inferred. Exact successor source/CCR/plan pins and fresh scoped +reviews remain required; T12 native gates and historical T13 outcome unchanged.