From 8c57aa9acc94408da0e115b4f2ce3ed87d529722 Mon Sep 17 00:00:00 2001 From: codex Date: Wed, 4 Nov 2026 07:23:06 +0100 Subject: [PATCH] CCR-2026-0060/0061/0063: founder approvals and binding confirmations (NK-WP-0056-T06) --- ...-executor-approval-keycape-eso-reader.yaml | 86 ++++++++------ ...ind-executor-approval-consumer-reader.yaml | 108 +++++++++++------- ...26-0063-nk-bind-executor-audit-sender.yaml | 64 +++++++---- 3 files changed, 154 insertions(+), 104 deletions(-) diff --git a/credential-change-requests/CCR-2026-0060-nk-bind-executor-approval-keycape-eso-reader.yaml b/credential-change-requests/CCR-2026-0060-nk-bind-executor-approval-keycape-eso-reader.yaml index ff4e459..de70164 100644 --- a/credential-change-requests/CCR-2026-0060-nk-bind-executor-approval-keycape-eso-reader.yaml +++ b/credential-change-requests/CCR-2026-0060-nk-bind-executor-approval-keycape-eso-reader.yaml @@ -3,28 +3,38 @@ kind: credential-change-request schema_version: 1 request_type: workload-kv-read title: 'nk-bind-executor-approval: keycape-reader-policy and eso-role (oidc-service-client@0.2)' -status: proposed +status: approved created: '2026-10-31' updated: '2026-11-04' requester: agent: railiance-platform - reason: 'NK-WP-0056-T14 first case of SecurityCaseType oidc-service-client 0.2 (net-kingdom + reason: NK-WP-0056-T14 first case of SecurityCaseType oidc-service-client 0.2 (net-kingdom 9ce0d60, acknowledged 2026-11-01; hub decision f8044f81; memo nk-wp-0056-t14-oidc-service-client-r2). Drafted by the platform owner in its review (docs/credential-lane-designs/oidc-service-client-review.md, - R6). KeyCape reads the client secret of nk-bind-executor-approval only through ESO, as - CCR-2026-0041 for the browser type. Not approved.' + R6). KeyCape reads the client secret of nk-bind-executor-approval only through + ESO, as CCR-2026-0041 for the browser type. Not approved. review: required: true required_approvers: - platform-owner - comments: [] + comments: + - at: '2026-11-04T06:21:20+00:00' + reviewer: platform-owner + decision: approved + comment: 'Approved by the founder 2026-11-04: KeyCape ESO reader for SecurityCase + nk-bind-executor-approval (oidc-service-client 0.2), NK-WP-0056-T06.' + - at: '2026-11-04T06:21:25+00:00' + reviewer: platform-owner + decision: binding_confirmed + comment: 'Binding confirmed: external-secrets/external-secrets, audience openbao, + as CCR-2026-0033/0041.' target: domain: infotech tenant: platform workload: keycape environment: production - purpose: KeyCape reads the nk-bind-executor-approval client secret only through ESO. No metadata, - list, parent or sibling access. + purpose: KeyCape reads the nk-bind-executor-approval client secret only through + ESO. No metadata, list, parent or sibling access. openbao: mount: platform kv_path: platform/workloads/keycape/nk-bind-executor-approval @@ -50,15 +60,15 @@ openbao: - external-secrets service_account_namespaces: - external-secrets - bound_claims_confirmed: false + bound_claims_confirmed: true delivery: surface: external-secrets namespace: sso - target: 'ClusterSecretStore openbao-keycape-nk-bind-executor-approval-issuer (rendered + target: ClusterSecretStore openbao-keycape-nk-bind-executor-approval-issuer (rendered from manifests/templates/keycape-issuer-eso.yaml; serviceAccountRef external-secrets/external-secrets, audience openbao) restricted to namespace sso; ExternalSecret and Secret sso/keycape-nk-bind-executor-approval-client, - key client-secret (type deliver-secret step). KeyCape binds it as env - KEYCAPE_NK_BIND_EXECUTOR_APPROVAL_CLIENT_SECRET (net-kingdom bind-env, after Ready=True).' + key client-secret (type deliver-secret step). KeyCape binds it as env KEYCAPE_NK_BIND_EXECUTOR_APPROVAL_CLIENT_SECRET + (net-kingdom bind-env, after Ready=True). manifest: manifests/nk-bind-executor-eso.yaml access_frontdoor: type: external-secrets @@ -68,44 +78,50 @@ access_frontdoor: risk: classification: high notes: - - Rendered from the acknowledged SecurityCaseType oidc-service-client 0.2 (names and bodies - checked against its materialization 2026-11-01); the case is not yet accepted. + - Rendered from the acknowledged SecurityCaseType oidc-service-client 0.2 (names + and bodies checked against its materialization 2026-11-01); the case is not yet + accepted. - Exact read on one KV path; no metadata, list, parent or sibling access. - The value lets its holder obtain approval-engine tokens as service:nk-bind-executor (approval:create/read/consume, tenant:platform). - - Only ExternalSecrets in namespace sso may use the store; sso namespace writers are - within this boundary (as CCR-2026-0033/0041). + - Only ExternalSecrets in namespace sso may use the store; sso namespace writers + are within this boundary (as CCR-2026-0033/0041). verification: positive: - - policy workload-kv-read-keycape-nk-bind-executor-approval-eso grants read on - platform/data/workloads/keycape/nk-bind-executor-approval only (capabilities check) - - ExternalSecret sso/keycape-nk-bind-executor-approval-client reports Ready=True (status - only) + - policy workload-kv-read-keycape-nk-bind-executor-approval-eso grants read on platform/data/workloads/keycape/nk-bind-executor-approval + only (capabilities check) + - ExternalSecret sso/keycape-nk-bind-executor-approval-client reports Ready=True + (status only) negative: - a default-only identity has no read capability on the path - sibling GET, parent LIST and metadata read are denied - wrong ServiceAccount and wrong audience logins are denied activation_conditions: - - oidc-service-client 0.2 acknowledged by the founder (done 2026-11-01, memo r2, hub decision - f8044f81). + - oidc-service-client 0.2 acknowledged by the founder (done 2026-11-01, memo r2, + hub decision f8044f81). - SecurityCase nk-bind-executor-approval accepted by owner and founder. - - Custody entry minted at version 1 by keycape-client-secret-generate, by the broker, which admits - oidc-service-client@0.2 since RPF-WP-0069-T08. The broker needs the case file at status - materialized with acceptance {at, record, by [owner, founder]}. - - Coding-agent deny on the data and metadata paths (scripts/nk_bind_executor_custody.py fence) - before the role exists. - - platform-owner approval of this exact request and bound_claims_confirmed set to true. + - Custody entry minted at version 1 by keycape-client-secret-generate, by the broker, + which admits oidc-service-client@0.2 since RPF-WP-0069-T08. The broker needs the + case file at status materialized with acceptance {at, record, by [owner, founder]}. + - Coding-agent deny on the data and metadata paths (scripts/nk_bind_executor_custody.py + fence) before the role exists. + - platform-owner approval of this exact request and bound_claims_confirmed set to + true. lifecycle: - deactivate: delete ExternalSecret sso/keycape-nk-bind-executor-approval-client, then role - external-secrets-keycape-nk-bind-executor-approval, then the policy (case rollback) - rotate: no rotation lane exists yet (RPF-WP-0055 residual); until then a rotation is an - attended platform-admin write with CAS=current, an ESO refresh and a KeyCape restart - compromised: owner incident process; delete the role first; no automatic read, reseed or - cleanup + deactivate: delete ExternalSecret sso/keycape-nk-bind-executor-approval-client, + then role external-secrets-keycape-nk-bind-executor-approval, then the policy + (case rollback) + rotate: no rotation lane exists yet (RPF-WP-0055 residual); until then a rotation + is an attended platform-admin write with CAS=current, an ESO refresh and a KeyCape + restart + compromised: owner incident process; delete the role first; no automatic read, reseed + or cleanup security_case: case: nk-bind-executor-approval type: oidc-service-client@0.2 type_status: acknowledged - type_source: net-kingdom security-case-types/oidc-service-client/type.yaml (9ce0d60, sha256:cd238693...) - type_acknowledgment: founder accepted informed-decision memo nk-wp-0056-t14-oidc-service-client-r2 on 2026-11-01 (hub decision f8044f81) + type_source: net-kingdom security-case-types/oidc-service-client/type.yaml (9ce0d60, + sha256:cd238693...) + type_acknowledgment: founder accepted informed-decision memo nk-wp-0056-t14-oidc-service-client-r2 + on 2026-11-01 (hub decision f8044f81) acceptance_record: pending diff --git a/credential-change-requests/CCR-2026-0061-nk-bind-executor-approval-consumer-reader.yaml b/credential-change-requests/CCR-2026-0061-nk-bind-executor-approval-consumer-reader.yaml index f9b991f..acb004c 100644 --- a/credential-change-requests/CCR-2026-0061-nk-bind-executor-approval-consumer-reader.yaml +++ b/credential-change-requests/CCR-2026-0061-nk-bind-executor-approval-consumer-reader.yaml @@ -3,36 +3,52 @@ kind: credential-change-request schema_version: 1 request_type: workload-kv-read title: 'nk-bind-executor-approval: consumer reader for sso/nk-bind-executor (oidc-service-client@0.2)' -status: proposed +status: approved created: '2026-10-31' updated: '2026-11-04' requester: agent: railiance-platform - reason: 'NK-WP-0056-T14 first case of SecurityCaseType oidc-service-client 0.2 (net-kingdom - 9ce0d60, acknowledged 2026-11-01; hub decision f8044f81). The bounded executor service:nk-bind-executor - reads its approval-engine client secret natively per call to file, read and consume its - own approvals. Drafted by the platform owner in its review - (docs/credential-lane-designs/oidc-service-client-review.md, R2-R6). Not approved.' + reason: NK-WP-0056-T14 first case of SecurityCaseType oidc-service-client 0.2 (net-kingdom + 9ce0d60, acknowledged 2026-11-01; hub decision f8044f81). The bounded executor + service:nk-bind-executor reads its approval-engine client secret natively per + call to file, read and consume its own approvals. Drafted by the platform owner + in its review (docs/credential-lane-designs/oidc-service-client-review.md, R2-R6). + Not approved. review: required: true required_approvers: - platform-owner - net-kingdom-owner - comments: [] + comments: + - at: '2026-11-04T06:21:31+00:00' + reviewer: platform-owner + decision: approved + comment: 'Approved by the founder 2026-11-04: executor reader of the nk-bind-executor-approval + client secret, NK-WP-0056-T06.' + - at: '2026-11-04T06:21:40+00:00' + reviewer: net-kingdom-owner + decision: approved + comment: Approved by the founder 2026-11-04 for NK-WP-0056-T06. + - at: '2026-11-04T06:21:47+00:00' + reviewer: platform-owner + decision: binding_confirmed + comment: 'Binding confirmed: ServiceAccount nk-bind-executor in namespace sso + only (uid bd15569c-8a85-4625-b001-d9f799cb857b), audience openbao, from rapp-bounded-executor.' target: domain: infotech tenant: platform workload: net-kingdom-bind-executor rapp: rapp-bounded-executor environment: production - purpose: Let only the executor ServiceAccount sso/nk-bind-executor read the - nk-bind-executor-approval CLIENT_SECRET in memory for its client_credentials exchange; - no write, metadata, list, sibling path, Secret copy or other identity + purpose: Let only the executor ServiceAccount sso/nk-bind-executor read the nk-bind-executor-approval + CLIENT_SECRET in memory for its client_credentials exchange; no write, metadata, + list, sibling path, Secret copy or other identity admission: standard: net-kingdom canon/standards/bounded-execution-admission_v0.1.md (proposed) executor_identity: service:nk-bind-executor - note: The role does not evaluate the admission. It bounds what the ServiceAccount can read - to one client secret whose tokens carry approval:create/read/consume at approval-engine. + note: The role does not evaluate the admission. It bounds what the ServiceAccount + can read to one client secret whose tokens carry approval:create/read/consume + at approval-engine. openbao: mount: platform kv_path: platform/workloads/keycape/nk-bind-executor-approval @@ -45,8 +61,6 @@ openbao: auth: method: kubernetes mount: kubernetes - # Type 0.2 template keycape-{client_id}-{consuming_service}-workload-kv-read (review R4): - # the delegated applier admits it. role: keycape-nk-bind-executor-approval-bounded-executor-workload-kv-read audience: openbao ttl: 15m @@ -60,7 +74,7 @@ openbao: - nk-bind-executor service_account_namespaces: - sso - bound_claims_confirmed: false + bound_claims_confirmed: true access_frontdoor: type: platform-owner catalog_id: bounded-executor-keycape-nk-bind-executor-approval @@ -69,61 +83,67 @@ access_frontdoor: agent_fence: data_and_metadata_denied: true note: Coding agents are denied data and metadata of platform/workloads/keycape/nk-bind-executor-approval; - scripts/nk_bind_executor_custody.py fence adds and proves the deny before the role is created. + scripts/nk_bind_executor_custody.py fence adds and proves the deny before the + role is created. lifecycle: - role_window: Standing, as CCR-2026-0059. The executor exchanges a fresh token per call and - keeps neither the secret nor a token beyond the call. - deactivate: Delete the role, then the policy. The custody entry and the ESO reader stay - under CCR-2026-0060 until the case rollback. - rotate: No rotation lane exists yet (RPF-WP-0055 residual). The reader needs no change on - rotation because the path stays the same. - compromised: Remove client nk-bind-executor-approval from KeyCape (register-client rollback, - attended), delete this role, then rotate attended. Approvals already created by the - client still need a human entry under human_control. + role_window: Standing, as CCR-2026-0059. The executor exchanges a fresh token per + call and keeps neither the secret nor a token beyond the call. + deactivate: Delete the role, then the policy. The custody entry and the ESO reader + stay under CCR-2026-0060 until the case rollback. + rotate: No rotation lane exists yet (RPF-WP-0055 residual). The reader needs no + change on rotation because the path stays the same. + compromised: Remove client nk-bind-executor-approval from KeyCape (register-client + rollback, attended), delete this role, then rotate attended. Approvals already + created by the client still need a human entry under human_control. delivery: surface: native-workload-login namespace: sso service_account: nk-bind-executor reader: Executor runtime (net-kingdom bounded-executor/, deployed by rapp-bounded-executor); - logs in with its projected ServiceAccount token, audience openbao, separately from the - CCR-2026-0058 and CCR-2026-0059 roles; the value stays in memory and never reaches a - Secret, log or receipt + logs in with its projected ServiceAccount token, audience openbao, separately + from the CCR-2026-0058 and CCR-2026-0059 roles; the value stays in memory and + never reaches a Secret, log or receipt risk: classification: high notes: - Reachable value is one confidential client secret; its tokens act as service:nk-bind-executor - at approval-engine (create approvals naming itself, read and consume approvals of - tenant:platform). Approvals still need a human entry under human_control. - - The role is separate from the CCR-2026-0058 write role, the CCR-2026-0059 journey reader - and the CCR-2026-0060 ESO reader; policies are never combined in one role. - - No Secret copy in namespace sso beyond KeyCape's own ESO target; other workloads in sso - without the ServiceAccount cannot log in. + at approval-engine (create approvals naming itself, read and consume approvals + of tenant:platform). Approvals still need a human entry under human_control. + - The role is separate from the CCR-2026-0058 write role, the CCR-2026-0059 journey + reader and the CCR-2026-0060 ESO reader; policies are never combined in one role. + - No Secret copy in namespace sso beyond KeyCape's own ESO target; other workloads + in sso without the ServiceAccount cannot log in. - Node root, cluster admins able to mint tokens for sso/nk-bind-executor and platform-admin remain inside this credential boundary. verification: positive: - - Exact policy and role read back; login as sso/nk-bind-executor (audience openbao) gets - only this policy with a lease of at most 15m + - Exact policy and role read back; login as sso/nk-bind-executor (audience openbao) + gets only this policy with a lease of at most 15m - The executor reports the claims of one client_credentials exchange per scope (sub - service:nk-bind-executor, aud approval-engine, tenant:platform, lifetime <= 15m), value-free + service:nk-bind-executor, aud approval-engine, tenant:platform, lifetime <= 15m), + value-free negative: - Write, metadata read, list, delete and sibling paths (including keycape/secrets-engine-openbao and directory-binds) are refused - Wrong ServiceAccount, wrong namespace and wrong audience logins are denied - Coding-agent boundary denies data and metadata of the path activation_conditions: - - oidc-service-client 0.2 acknowledged (done 2026-11-01) and case nk-bind-executor-approval accepted. - - Custody entry minted (CCR-2026-0040 lane; broker admits - oidc-service-client@0.2 since RPF-WP-0069-T08). + - oidc-service-client 0.2 acknowledged (done 2026-11-01) and case nk-bind-executor-approval + accepted. + - Custody entry minted (CCR-2026-0040 lane; broker admits oidc-service-client@0.2 + since RPF-WP-0069-T08). - Explicit platform-owner and net-kingdom-owner approval of this exact request. - bound_claims_confirmed set to true by the platform-owner (ServiceAccount sso/nk-bind-executor already exists, uid bd15569c, CCR-2026-0058/0059). - - Attended platform-admin (aal2) session or the delegated applier applies policy and role - from a reviewed commit; positive and negative results recorded in value-free receipts. + - Attended platform-admin (aal2) session or the delegated applier applies policy + and role from a reviewed commit; positive and negative results recorded in value-free + receipts. security_case: case: nk-bind-executor-approval type: oidc-service-client@0.2 type_status: acknowledged - type_source: net-kingdom security-case-types/oidc-service-client/type.yaml (9ce0d60, sha256:cd238693...) - type_acknowledgment: founder accepted informed-decision memo nk-wp-0056-t14-oidc-service-client-r2 on 2026-11-01 (hub decision f8044f81) + type_source: net-kingdom security-case-types/oidc-service-client/type.yaml (9ce0d60, + sha256:cd238693...) + type_acknowledgment: founder accepted informed-decision memo nk-wp-0056-t14-oidc-service-client-r2 + on 2026-11-01 (hub decision f8044f81) acceptance_record: pending diff --git a/credential-change-requests/CCR-2026-0063-nk-bind-executor-audit-sender.yaml b/credential-change-requests/CCR-2026-0063-nk-bind-executor-audit-sender.yaml index dbc6f45..d8da5f5 100644 --- a/credential-change-requests/CCR-2026-0063-nk-bind-executor-audit-sender.yaml +++ b/credential-change-requests/CCR-2026-0063-nk-bind-executor-audit-sender.yaml @@ -3,16 +3,16 @@ kind: credential-change-request schema_version: 1 request_type: workload-kv-read title: NetKingdom bounded-executor audit sender custody and delivery -status: proposed +status: approved created: '2026-11-03' updated: '2026-11-04' requester: agent: claude-code reason: RPF-WP-0069-T05 / NK-WP-0056-T15 / NK-WP-0040. Audit-core admitted and named - the sender nk-bounded-executor (AUDIT-WP-0018-T02, deploy/senders-scope.json) and - asks railiance-platform for custody of its bearer, ESO-projected to sso - (audit-core docs/bounded-executor-receipts.md). Drafted by the railiance-platform - worker in the CCR-2026-0021/0022 shape; not approved. + the sender nk-bounded-executor (AUDIT-WP-0018-T02, deploy/senders-scope.json) + and asks railiance-platform for custody of its bearer, ESO-projected to sso (audit-core + docs/bounded-executor-receipts.md). Drafted by the railiance-platform worker in + the CCR-2026-0021/0022 shape; not approved. review: required: true required_approvers: @@ -23,21 +23,36 @@ review: - at: '2026-11-04T00:00:00+00:00' reviewer: net-kingdom (agent answer relayed by the railiance-platform worker) decision: open_question_answered - comment: NetKingdom answers the open question for NK-WP-0056-T15 as ESO, like the - other in-cluster senders, not an OpenBao read role for the executor. The executor's - audit client reads a token file. This is the net-kingdom repository's answer only; - the net-kingdom-owner approval is the founder's and is recorded separately with - the approve tool. + comment: NetKingdom answers the open question for NK-WP-0056-T15 as ESO, like + the other in-cluster senders, not an OpenBao read role for the executor. The + executor's audit client reads a token file. This is the net-kingdom repository's + answer only; the net-kingdom-owner approval is the founder's and is recorded + separately with the approve tool. + - at: '2026-11-04T06:21:53+00:00' + reviewer: platform-owner + decision: approved + comment: 'Approved by the founder 2026-11-04: bounded-executor audit sender custody, + ESO to sso/bounded-executor-tokens, NK-WP-0056-T15/T06.' + - at: '2026-11-04T06:22:00+00:00' + reviewer: audit-core-owner + decision: approved + comment: 'Approved by the founder 2026-11-04: sender nk-bounded-executor as registered + in AUDIT-WP-0018-T02.' + - at: '2026-11-04T06:22:07+00:00' + reviewer: platform-owner + decision: binding_confirmed + comment: 'Binding confirmed: external-secrets/external-secrets, audience openbao; + store restricted to namespace sso.' target: domain: infotech tenant: platform workload: net-kingdom-bounded-executor environment: production purpose: 'Provide only the audit-core sender nk-bounded-executor with its registry - scope as declared by audit-core: source net-kingdom.bounded-executor, tenants [platform], - may_write true, may_read false, evidence_kind load-bearing, secret_policy reject, - closing class execution.run.started -> execution.attribution.receipt within 7200 - s. Preserve the existing receiver registry and every other sender.' + scope as declared by audit-core: source net-kingdom.bounded-executor, tenants + [platform], may_write true, may_read false, evidence_kind load-bearing, secret_policy + reject, closing class execution.run.started -> execution.attribution.receipt within + 7200 s. Preserve the existing receiver registry and every other sender.' openbao: mount: platform kv_path: platform/workloads/net-kingdom/bounded-executor/audit-sender @@ -47,8 +62,6 @@ openbao: policy_name: workload-kv-read-nk-bind-executor-audit policy_file: openbao/policies/workload-kv-read-nk-bind-executor-audit.hcl metadata_read: false - # Same reader shape as CCR-2026-0033/0041/0060 (audience openbao, explicit max TTL, - # no default policy, token self-lifecycle), not the older CCR-2026-0021/0022 shape. token_self_lifecycle: true auth: method: kubernetes @@ -66,7 +79,7 @@ openbao: - external-secrets service_account_namespaces: - external-secrets - bound_claims_confirmed: false + bound_claims_confirmed: true access_frontdoor: type: external-secrets catalog_id: nk-bind-executor-audit @@ -76,16 +89,17 @@ delivery: surface: external-secrets namespace: sso service_account: nk-bind-executor - target: 'ClusterSecretStore openbao-nk-bind-executor-audit (serviceAccountRef - external-secrets/external-secrets, audience openbao) restricted to namespace sso; - ExternalSecret and Secret sso/bounded-executor-tokens, key audit-core, which the - rapp-bounded-executor run Job already mounts at /var/run/secrets/bounded-executor/audit-core - (rapp docs/platform-handoffs.md names this delivery as railiance-platform''s). The - platform carries the store and ExternalSecret in manifests/nk-bind-executor-eso.yaml, + target: ClusterSecretStore openbao-nk-bind-executor-audit (serviceAccountRef external-secrets/external-secrets, + audience openbao) restricted to namespace sso; ExternalSecret and Secret sso/bounded-executor-tokens, + key audit-core, which the rapp-bounded-executor run Job already mounts at /var/run/secrets/bounded-executor/audit-core + (rapp docs/platform-handoffs.md names this delivery as railiance-platform's). + The platform carries the store and ExternalSecret in manifests/nk-bind-executor-eso.yaml, as it does for CCR-2026-0021/0022/0047. The executor pod (sso/nk-bind-executor, - uid bd15569c) mounts the Secret; the ServiceAccount has no Secret read in sso.' + uid bd15569c) mounts the Secret; the ServiceAccount has no Secret read in sso. manifest: manifests/nk-bind-executor-eso.yaml - custody_procedure: audit-core scripts/attended-seed-nk-bounded-executor-sender.sh (seed and receiver reload); railiance-platform scripts/nk_bind_executor_custody.py fence and verify + custody_procedure: audit-core scripts/attended-seed-nk-bounded-executor-sender.sh + (seed and receiver reload); railiance-platform scripts/nk_bind_executor_custody.py + fence and verify receiver: POST /v1/events to http://audit-core.audit-core.svc.cluster.local:8080; envelope source equals the sender scope source; Idempotency-Key is the envelope id and correlation_id is the run_id. Ingress audit-core-nk-bounded-executor-ingress