diff --git a/credential-change-requests/CCR-2026-0044-reuse-surface-hub-writer-caller.yaml b/credential-change-requests/CCR-2026-0044-reuse-surface-hub-writer-caller.yaml index 395c599..eef97e2 100644 --- a/credential-change-requests/CCR-2026-0044-reuse-surface-hub-writer-caller.yaml +++ b/credential-change-requests/CCR-2026-0044-reuse-surface-hub-writer-caller.yaml @@ -3,17 +3,17 @@ kind: credential-change-request schema_version: 1 request_type: workload-kv-read title: Name the dedicated reuse-surface hub-writer caller -status: proposed +status: approved created: '2026-10-14' updated: '2026-10-14' requester: agent: ops-mason - reason: 'CUST-WP-0081 / State Hub message 08b254af. CCR-2026-0005 is active and - does not name a caller. Entity 4a1f663c-0621-0483-edd0-f852274f4b6b carries - default, operator-custody and platform-admin, so its token can reach the data - path, the metadata path and siblings. Do not attach workload-kv-read-reuse-surface-runtime + reason: CUST-WP-0081 / State Hub message 08b254af. CCR-2026-0005 is active and does + not name a caller. Entity 4a1f663c-0621-0483-edd0-f852274f4b6b carries default, + operator-custody and platform-admin, so its token can reach the data path, the + metadata path and siblings. Do not attach workload-kv-read-reuse-surface-runtime to that entity. Bind a new OIDC role to a different principal. No secret value - is rotated or read by this request.' + is rotated or read by this request. review: required: true required_approvers: @@ -23,13 +23,27 @@ review: - at: '2026-10-14T16:40:00Z' reviewer: grok decision: filed_proposed - comment: 'Filed from ops-mason fd2c5a5 (State Hub 3642bdc4, MASON-WP-0011). - Status stays proposed. bound_claims_confirmed stays false until key-cape - confirms group reuse-surface-hub-writers and a member entity other than - 4a1f663c-0621-0483-edd0-f852274f4b6b. The caller policy file is unchanged; - apply, after platform-operator and reuse-surface-owner approval, is what - adds lookup-self and revoke-self. CCR-2026-0005 remains the KV and ESO - authority. No KV write and no attachment to the platform-admin entity.' + comment: Filed from ops-mason fd2c5a5 (State Hub 3642bdc4, MASON-WP-0011). Status + stays proposed. bound_claims_confirmed stays false until key-cape confirms group + reuse-surface-hub-writers and a member entity other than 4a1f663c-0621-0483-edd0-f852274f4b6b. + The caller policy file is unchanged; apply, after platform-operator and reuse-surface-owner + approval, is what adds lookup-self and revoke-self. CCR-2026-0005 remains the + KV and ESO authority. No KV write and no attachment to the platform-admin entity. + - at: '2026-10-14T17:44:49+00:00' + reviewer: platform-operator, reuse-surface-owner (founder Bernd Worsch) + decision: approved + comment: Founder go-ahead 2026-10-14. Approves CCR-2026-0044 as platform-operator + and reuse-surface-owner. Group reuse-surface-hub-writers, member bernd.worsch-3, + second factor enrolled, entity f94b7c34-e151-30bb-b473-df3ccdbb9bf1. That entity + is not 4a1f663c-0621-0483-edd0-f852274f4b6b. No KV write. Do not attach the + policy to the admin entity. + - at: '2026-10-14T17:44:49+00:00' + reviewer: founder Bernd Worsch + decision: binding_confirmed + comment: Bound claims are groups=reuse-surface-hub-writers and /assurance/level=aal2. + Member is bernd.worsch-3, entity f94b7c34-e151-30bb-b473-df3ccdbb9bf1. The apply + checks that entity's policy names and stops if platform-admin or operator-custody + is present. target: domain: financials tenant: reuse @@ -66,7 +80,7 @@ openbao: groups: - reuse-surface-hub-writers /assurance/level: aal2 - bound_claims_confirmed: false + bound_claims_confirmed: true policies: - workload-kv-read-reuse-surface-runtime ttl: 15m @@ -78,9 +92,9 @@ access_frontdoor: type: ops-warden catalog_id: reuse-surface-hub-write-token selector: reuse-surface federation hub write bearer token - command: 'After a passing member receipt, run warden access reuse-surface-hub-write-token + command: After a passing member receipt, run warden access reuse-surface-hub-write-token --exec --field REUSE_SURFACE_TOKEN -- with the unprinted lane - token. Do not use --fetch.' + token. Do not use --fetch. resolvable: false readiness: pending-review risk: @@ -98,7 +112,8 @@ risk: verification: positive: - A member token's policy set is exactly workload-kv-read-reuse-surface-runtime. - - That token's capabilities are read on the exact data path and the exact metadata path. + - That token's capabilities are read on the exact data path and the exact metadata + path. negative: - The same token is deny on platform/data/workloads/reuse/reuse-surface, its metadata parent, and platform/data/workloads/issue-core/issue-core/issue-core-runtime. @@ -109,8 +124,8 @@ verification: - key-cape confirms the group and that the member entity has no platform-admin or operator-custody identity policy. - Founder applies policy and role through the delegated applier. No KV write. - - scripts/verify-reuse-surface-hub-writer.py member and non-member both pass. - Receipts stay mode 0600 and contain no token or field value. + - scripts/verify-reuse-surface-hub-writer.py member and non-member both pass. Receipts + stay mode 0600 and contain no token or field value. lifecycle: deactivate: delete auth/netkingdom/role/reuse-surface-hub-writer-workload-kv-read. Leave the KV path, the ESO role, and CCR-2026-0005 delivery in place. diff --git a/openbao/policies/workload-kv-read-reuse-surface-runtime.hcl b/openbao/policies/workload-kv-read-reuse-surface-runtime.hcl index 1427c76..e2dbec6 100644 --- a/openbao/policies/workload-kv-read-reuse-surface-runtime.hcl +++ b/openbao/policies/workload-kv-read-reuse-surface-runtime.hcl @@ -1,7 +1,18 @@ +# CCR-2026-0044 adds lookup-self and revoke-self for the dedicated caller. +# Do not attach this policy to entity 4a1f663c-0621-0483-edd0-f852274f4b6b. + path "platform/data/workloads/reuse/reuse-surface/runtime-secrets" { capabilities = ["read"] } path "platform/metadata/workloads/reuse/reuse-surface/runtime-secrets" { capabilities = ["read"] +} + +path "auth/token/lookup-self" { + capabilities = ["read"] +} + +path "auth/token/revoke-self" { + capabilities = ["update"] } \ No newline at end of file