diff --git a/credential-change-requests/CCR-2026-0063-nk-bind-executor-audit-sender.yaml b/credential-change-requests/CCR-2026-0063-nk-bind-executor-audit-sender.yaml new file mode 100644 index 0000000..e88405a --- /dev/null +++ b/credential-change-requests/CCR-2026-0063-nk-bind-executor-audit-sender.yaml @@ -0,0 +1,130 @@ +id: CCR-2026-0063 +kind: credential-change-request +schema_version: 1 +request_type: workload-kv-read +title: NetKingdom bounded-executor audit sender custody and delivery +status: proposed +created: '2026-11-03' +updated: '2026-11-03' +requester: + agent: claude-code + reason: RPF-WP-0069-T05 / NK-WP-0056-T15 / NK-WP-0040. Audit-core admitted and named + the sender nk-bounded-executor (AUDIT-WP-0018-T02, deploy/senders-scope.json) and + asks railiance-platform for custody of its bearer, ESO-projected to sso + (audit-core docs/bounded-executor-receipts.md). Drafted by the railiance-platform + worker in the CCR-2026-0021/0022 shape; not approved. +review: + required: true + required_approvers: + - platform-owner + - audit-core-owner + - net-kingdom-owner + comments: [] +target: + domain: infotech + tenant: platform + workload: net-kingdom-bounded-executor + environment: production + purpose: 'Provide only the audit-core sender nk-bounded-executor with its registry + scope as declared by audit-core: source net-kingdom.bounded-executor, tenants [platform], + may_write true, may_read false, evidence_kind load-bearing, secret_policy reject, + closing class execution.run.started -> execution.attribution.receipt within 7200 + s. Preserve the existing receiver registry and every other sender.' +openbao: + mount: platform + kv_path: platform/workloads/net-kingdom/bounded-executor/audit-sender + fields: + - AUDIT_TOKEN + - CUSTODY_REQUEST + policy_name: workload-kv-read-nk-bind-executor-audit + policy_file: openbao/policies/workload-kv-read-nk-bind-executor-audit.hcl + metadata_read: false + auth: + method: kubernetes + mount: kubernetes + role: external-secrets-nk-bind-executor-audit + bound_claims: + service_account_names: + - external-secrets + service_account_namespaces: + - external-secrets + bound_claims_confirmed: false + policies: + - workload-kv-read-nk-bind-executor-audit + ttl: 15m +access_frontdoor: + type: external-secrets + catalog_id: nk-bind-executor-audit + readiness: pending-review + resolvable: false +delivery: + surface: external-secrets + namespace: sso + service_account: nk-bind-executor + target: 'ClusterSecretStore openbao-nk-bind-executor-audit restricted to namespace + sso; ExternalSecret and Secret sso/nk-bind-executor-audit, key audit-token, mounted + as a file in the executor pod (sso/nk-bind-executor, uid bd15569c). The store and + ExternalSecret manifests belong in the reviewed rapp-* package next to the executor, + as for CCR-2026-0053; this request creates none.' + receiver: POST /v1/events to http://audit-core.audit-core.svc.cluster.local:8080; + envelope source equals the sender scope source; Idempotency-Key is the envelope + id and correlation_id is the run_id. Ingress audit-core-nk-bounded-executor-ingress + admits only executor pods in sso. +risk: + classification: high + notes: + - The bearer permits append for its exact source and tenant only, never reading + or changing stored evidence. It is not an OpenBao identity. + - secret_policy is reject, as audit-core registered it; this supersedes redact in + the 2026-10-31 owner answer. The overlay may tighten it but never relax it. + - The registry update reads existing sender credentials inside the attended platform + process only. No registry is delivered to a producer. + - OpenBao login TTL limits the ESO reader session, not the audit bearer. Revocation + must remove the sender token from the receiver registry and prove refusal. + - The sso namespace also runs Authelia, LLDAP and KeyCape. The Secret is readable + by any workload allowed to read Secrets in sso; only the executor pod mounts it. + - 'Open for net-kingdom-owner review: NK-WP-0056-T15 prefers an OpenBao read role + for the executor over an ESO Secret. This request follows the shape audit-core + and the platform owner answer agreed (ESO, like the other in-cluster senders); + a direct read role would need a changed request.' + - The new paths extend the coding-agent deny boundary (agent-high-risk-boundary). + No existing high-risk grant is widened. +verification: + positive: + - Independent CAS=0 token creation and exact sender merge with registry-version + compare-and-set; repeated runs preserve all existing senders and registry fields. + - ESO delivers only AUDIT_TOKEN into sso/nk-bind-executor-audit:audit-token; source + and receiver copies agree without displaying values. + - The deployed receiver accepts a synthetic started event and receipt for the exact + source and tenant (202), returns 200 for a duplicate and 409 for a reused run_id + with a different body. + negative: + - Sibling sender path, full registry and parent listing are denied to the ESO reader. + Wrong service account or namespace fails; a disallowed store namespace gets no + Secret. + - Receiver refuses a wrong source or tenant, every read route, a secret-shaped step + check (400) and a revoked token. No existing sender is removed or re-scoped. + - A proposed or altered CCR, stale registry version, token collision or partial + custody refuses without overwriting. + activation_conditions: + - All three named owner reviews approve before any native credential mutation. + - Audit-core's founder-run rollout of the sender scope ConfigMap and the ingress + NetworkPolicy is done, and the executor accepts 202 (NK-WP-0056-T15). + - The rapp-* package carries the ClusterSecretStore and ExternalSecret; the binding + is confirmed against it. + - Use the Warden attended platform-admin login envelope; preserve an independent + receipt and revoke the session on exit. + - Record native positive and negative evidence before declaring verified or active. + Custody alone admits no executor run; that stays with the founder-signed admission + (NK-WP-0056-T06). +lifecycle: + deactivate: Stop the executor; remove only its token from the registry using CAS + and reload and verify receiver refusal. Then detach the reader policy and remove + the ExternalSecret and projection, keeping KV versions for investigation. Do not + delete audit events or other sender entries. + rotate: 'Reviewed overlap-first rotation: append a replacement to this sender only, + deliver it, prove acceptance, then remove the predecessor and prove refusal. The + first-provision helper refuses rotation and unexpected existing values.' + compromised: Stop the executor and revoke the exact receiver token first; inspect + events from net-kingdom.bounded-executor, rotate through a separate reviewed action, + and keep the independent audit trail. diff --git a/openbao/policies/agent-high-risk-boundary.hcl b/openbao/policies/agent-high-risk-boundary.hcl index 42251e7..7ea03e9 100644 --- a/openbao/policies/agent-high-risk-boundary.hcl +++ b/openbao/policies/agent-high-risk-boundary.hcl @@ -144,6 +144,10 @@ path "platform/metadata/workloads/approval-engine/audit-sender" { capabilities = path "platform/data/workloads/informed-decision/audit-sender" { capabilities = ["deny"] } path "platform/metadata/workloads/informed-decision/audit-sender" { capabilities = ["deny"] } +# Proposed bounded-executor audit sender custody: CCR-2026-0063 (RPF-WP-0069-T05). +path "platform/data/workloads/net-kingdom/bounded-executor/audit-sender" { capabilities = ["deny"] } +path "platform/metadata/workloads/net-kingdom/bounded-executor/audit-sender" { capabilities = ["deny"] } + # CCR-2026-0039: coding-agent denies for platform/workloads/coulomb/fluid-telegram/hall-of-helix (data and metadata). path "platform/data/workloads/coulomb/fluid-telegram/hall-of-helix/operator-app" { capabilities = ["deny"] } path "platform/metadata/workloads/coulomb/fluid-telegram/hall-of-helix/operator-app" { capabilities = ["deny"] } diff --git a/openbao/policies/workload-kv-read-nk-bind-executor-audit.hcl b/openbao/policies/workload-kv-read-nk-bind-executor-audit.hcl new file mode 100644 index 0000000..a1efcff --- /dev/null +++ b/openbao/policies/workload-kv-read-nk-bind-executor-audit.hcl @@ -0,0 +1,3 @@ +path "platform/data/workloads/net-kingdom/bounded-executor/audit-sender" { + capabilities = ["read"] +} diff --git a/workplans/RPF-WP-0069-bounded-executor-lanes.md b/workplans/RPF-WP-0069-bounded-executor-lanes.md index 535f0dc..f845bbd 100644 --- a/workplans/RPF-WP-0069-bounded-executor-lanes.md +++ b/workplans/RPF-WP-0069-bounded-executor-lanes.md @@ -9,7 +9,7 @@ flavor: implementation owner: claude topic_slug: railiance created: "2026-10-31" -updated: "2026-11-01" +updated: "2026-11-03" related: - NK-WP-0056 - NK-WP-0040 @@ -63,6 +63,8 @@ id: RPF-WP-0069-T03 status: wait priority: high depends_on: [RPF-WP-0069-T02] +blocked_on: dependency +blocking_reason: "Per-window role creation, run receipts and deletion happen in the first founder-admitted executor run (NK-WP-0056-T06)" state_hub_task_id: "6b456804-c408-53bf-8e1d-49723108fca6" ``` @@ -71,6 +73,15 @@ re-checks the coding-agent fence, applies policy and role, and records value-fre negative receipts. This needs an owner setup script modelled on net-kingdom `bind-lane.py` setup/verify; write it once approval exists. The founder runs it. +2026-11-03 status: the setup half is done. The owner script is net-kingdom +`tools/service-binds/executor-lanes.py`, not a new script here. On 2026-10-31 the founder +ran it: the CCR-2026-0058 policy was applied, `cas_required` was set on the svc-authelia key, +and the coding-agent fence was re-checked (CCR-2026-0058 evidence, net-kingdom `ef6284c`). +Under the window-scoped decision (c29c6eda), no write role exists between runs. What remains +is the per-window part: create the role for an admitted window, record positive and negative +receipts, and delete the role after the run's receipt. That happens in the first admitted run, +NK-WP-0056-T06, which is still `todo` and depends on T15, T16 and T19 on the net-kingdom side. + ## Journey-secret read lane for the executor (NK-WP-0056-T10) ```task @@ -112,8 +123,8 @@ CCR-2026-0057's `runtime_access: false`. Waits for T10 scheduling and the Servic id: RPF-WP-0069-T05 status: wait priority: medium -blocked_on: dependency -blocking_reason: "audit-core admits and names the sender (AUDIT-WP-0018-T02)" +blocked_on: human +blocking_reason: "Owner reviews of CCR-2026-0063 (platform-owner, audit-core-owner, net-kingdom-owner)" state_hub_task_id: "5c582aef-ee9d-56ab-a4eb-2019933f00ac" ``` @@ -121,6 +132,26 @@ After audit-core admits the sender and names it, draft a `workload-kv-read` CCR CCR-2026-0021/0022 shape: custody `platform/workloads/net-kingdom/bounded-executor/audit-sender`, ESO into `sso/nk-bind-executor-audit`, ClusterSecretStore restricted to `sso`. +2026-11-03: audit-core admitted the sender in AUDIT-WP-0018-T02 as `nk-bounded-executor`: +source `net-kingdom.bounded-executor`, tenants `[platform]`, write only, `load-bearing`, +`secret_policy: reject`, closing class `started -> receipt` within 7200 s. +**CCR-2026-0063** is drafted as `proposed`. It validates, with only the expected +unconfirmed-binding warning, and its policy file matches the generated policy. + +- Policy `openbao/policies/workload-kv-read-nk-bind-executor-audit.hcl`: data read on the + exact path only. +- Role `external-secrets-nk-bind-executor-audit`: `external-secrets/external-secrets`. +- Coding-agent deny on the data and metadata paths in `agent-high-risk-boundary.hcl`. This is a + source change; it is applied in the attended session. +- `secret_policy` follows audit-core's `reject`, not the `redact` in our 2026-10-31 answer. +- The ClusterSecretStore and ExternalSecret belong in the rapp-* package, as for + CCR-2026-0053. + +Open for the net-kingdom-owner review: NK-WP-0056-T15 prefers an OpenBao read role over an +ESO Secret, while audit-core and our answer specify ESO. The CCR records this. Approval, +binding confirmation and the attended seed follow, after audit-core's founder-run rollout and +the executor's 202 fix. + ## LLDAP credential custody for the executor ```task