Implement issuer reader preparation and qualify blocked owner dependencies
Assistant: codex Assistant-Model: gpt-6.1-sol Assistant-Session: 01a1046b-5629-7f52-badd-f718eadb6042
This commit is contained in:
codex
parent
ecbe3b9dd5
commit
8c7c34e84b
15 changed files with 448 additions and 7 deletions
94
credential-change-requests/CCR-2026-0033.yaml
Normal file
94
credential-change-requests/CCR-2026-0033.yaml
Normal file
|
|
@ -0,0 +1,94 @@
|
|||
id: CCR-2026-0033
|
||||
kind: credential-change-request
|
||||
schema_version: 1
|
||||
request_type: workload-kv-read
|
||||
title: KeyCape secrets-engine-openbao issuer workload reader
|
||||
status: proposed
|
||||
created: '2026-10-04'
|
||||
updated: '2026-10-04'
|
||||
requester:
|
||||
agent: key-cape
|
||||
reason: KEY-WP-0037-T02 owner packet; proposed issuer-side read of separately approved
|
||||
service client custody
|
||||
review:
|
||||
required: true
|
||||
required_approvers:
|
||||
- platform-owner
|
||||
- key-cape-owner
|
||||
- net-kingdom-owner
|
||||
comments: []
|
||||
target:
|
||||
domain: financials
|
||||
tenant: platform
|
||||
workload: keycape
|
||||
environment: production
|
||||
purpose: Deliver separately approved secrets-engine-openbao client secret to issuer
|
||||
through sso-only ESO
|
||||
openbao:
|
||||
mount: platform
|
||||
kv_path: platform/services/keycape/secrets-engine-openbao
|
||||
fields:
|
||||
- CLIENT_SECRET
|
||||
policy_name: workload-kv-read-keycape-secrets-engine-openbao-eso
|
||||
policy_file: openbao/policies/workload-kv-read-keycape-secrets-engine-openbao-eso.hcl
|
||||
metadata_read: false
|
||||
auth:
|
||||
method: kubernetes
|
||||
mount: kubernetes
|
||||
role: external-secrets-keycape-secrets-engine-openbao
|
||||
audience: openbao
|
||||
ttl: 15m
|
||||
token_max_ttl: 15m
|
||||
token_explicit_max_ttl: 15m
|
||||
token_no_default_policy: true
|
||||
policies:
|
||||
- workload-kv-read-keycape-secrets-engine-openbao-eso
|
||||
bound_claims:
|
||||
service_account_names:
|
||||
- external-secrets
|
||||
service_account_namespaces:
|
||||
- external-secrets
|
||||
bound_claims_confirmed: false
|
||||
access_frontdoor:
|
||||
type: external-secrets
|
||||
catalog_id: keycape-secrets-engine-openbao-eso
|
||||
readiness: pending-review
|
||||
resolvable: false
|
||||
risk:
|
||||
classification: high
|
||||
notes:
|
||||
- Reads whole proposed path holding the secrets-engine-openbao confidential value;
|
||||
issuer and consumer copies need separate acceptance
|
||||
- Only ExternalSecrets in namespace sso may use the store; sso namespace writers
|
||||
are within this boundary
|
||||
- Issuer ESO does not deliver the separate secrets-engine consumer file or authorize
|
||||
client registration
|
||||
verification:
|
||||
positive:
|
||||
- Owner-reviewed native exact identity and exact path proof required
|
||||
negative:
|
||||
- Owner-reviewed wrong identity, sibling GET and parent LIST denials required
|
||||
activation_conditions:
|
||||
- Exact CCR approval, confirmed identity, attended custody and native receipt acceptance
|
||||
required
|
||||
lifecycle:
|
||||
deactivate: Owner-reviewed delivery withdrawal and token revocation; exact rollback
|
||||
receipt required
|
||||
rotate: Separate version-guarded owner approval and contained value delivery required
|
||||
compromised: Owner incident process; no automatic read, reseed or cleanup
|
||||
scaffold:
|
||||
draft_only: true
|
||||
consumer_repo: key-cape
|
||||
owner_repo: railiance-platform
|
||||
request_sha256: 380a5cbb6a5be887d77e7c9aa57eda18da8a7059568b2c5143e2555ed8ab9fdb
|
||||
catalog_request_sha256: null
|
||||
state_hub:
|
||||
workplan_id: RPF-WP-0035
|
||||
task_id: RPF-WP-0035-T02
|
||||
related_workplan: KEY-WP-0037
|
||||
delivery:
|
||||
surface: external-secrets
|
||||
target: sso/keycape-secrets-engine-openbao-client key client-secret; issuer-side
|
||||
delivery only
|
||||
review_bundle: docs/provisioning-windows/2026-10-04-1000/keycape
|
||||
consumer_file_delivery: not selected; requires secrets-engine source acceptance
|
||||
|
|
@ -0,0 +1,56 @@
|
|||
schema_version: 1
|
||||
lane_id: keycape-secrets-engine-openbao-eso
|
||||
ccr_id: CCR-2026-0033
|
||||
title: KeyCape secrets-engine-openbao issuer workload reader
|
||||
date: '2026-10-04'
|
||||
consumer_repo: key-cape
|
||||
owner_repo: railiance-platform
|
||||
requester:
|
||||
agent: key-cape
|
||||
reason: KEY-WP-0037-T02 owner packet; proposed issuer-side read of separately approved
|
||||
service client custody
|
||||
review_approvers:
|
||||
- platform-owner
|
||||
- key-cape-owner
|
||||
- net-kingdom-owner
|
||||
target:
|
||||
domain: financials
|
||||
tenant: platform
|
||||
workload: keycape
|
||||
environment: production
|
||||
purpose: Deliver separately approved secrets-engine-openbao client secret to issuer
|
||||
through sso-only ESO
|
||||
openbao:
|
||||
mount: platform
|
||||
kv_path: platform/services/keycape/secrets-engine-openbao
|
||||
fields:
|
||||
- CLIENT_SECRET
|
||||
policy_name: workload-kv-read-keycape-secrets-engine-openbao-eso
|
||||
auth:
|
||||
mount: kubernetes
|
||||
role: external-secrets-keycape-secrets-engine-openbao
|
||||
audience: openbao
|
||||
service_account_names:
|
||||
- external-secrets
|
||||
service_account_namespaces:
|
||||
- external-secrets
|
||||
ttl: 15m
|
||||
eso:
|
||||
store_name: openbao-keycape-secrets-engine-openbao
|
||||
server: http://openbao.openbao.svc:8200
|
||||
namespace: sso
|
||||
external_secret_name: keycape-secrets-engine-openbao-client
|
||||
secret_name: keycape-secrets-engine-openbao-client
|
||||
refresh_interval: 5m
|
||||
data:
|
||||
- secret_key: client-secret
|
||||
property: CLIENT_SECRET
|
||||
risk:
|
||||
classification: high
|
||||
notes:
|
||||
- Reads whole proposed path holding the secrets-engine-openbao confidential value;
|
||||
issuer and consumer copies need separate acceptance
|
||||
- Only ExternalSecrets in namespace sso may use the store; sso namespace writers
|
||||
are within this boundary
|
||||
- Issuer ESO does not deliver the separate secrets-engine consumer file or authorize
|
||||
client registration
|
||||
|
|
@ -129,3 +129,24 @@ claimed a live registration of `secrets-engine-openbao`, and its client-credenti
|
|||
custody has no owning task (KeyCape contract: "a separate approved custody
|
||||
action"). No reviewed child is written. RPF-WP-0035-T02 waits on key-cape naming
|
||||
that task.
|
||||
|
||||
## Owner return and blocked dependency contract — 2026-10-04
|
||||
|
||||
KEY-WP-0037-T02 now owns separately approved protected custody, T03 the actual
|
||||
deployment-owned registration operation, and T04 native issuance evidence.
|
||||
`key-cape/docs/secrets-engine-openbao-owner-packet.md` supplies the candidate
|
||||
issuer path and exact registration contract. Platform prepared proposed
|
||||
CCR-2026-0033 and exact-path issuer reader policy/auth/ESO/receipt artifacts;
|
||||
source generation does not allocate a value or establish registration.
|
||||
|
||||
secrets-engine must accept the actual consumer host/file owner/path, mode-0600
|
||||
delivery mechanism and rotation/revocation ownership before the bounded custody
|
||||
child is finalized. Issuer-side ESO is a separate copy. An owner source acceptance
|
||||
receipt, independent of full live service login completion, supplies this gate.
|
||||
KeyCape's current exact-primary receipt remains pending scoped repair of an
|
||||
existing grandfathered ADHOC task identity. Do not infer synchronization from
|
||||
its source contract or local managed IDs.
|
||||
|
||||
`docs/provisioning-windows/2026-10-04-1000/dependency-requirements.md` names all
|
||||
source/acceptance/reopen boundaries. RPF-WP-0035-T02 remains wait; its workplan
|
||||
is blocked on those real dependencies and separate attended execution approval.
|
||||
|
|
|
|||
40
docs/evidence/2026-10-04-blocked-task-review.json
Normal file
40
docs/evidence/2026-10-04-blocked-task-review.json
Normal file
|
|
@ -0,0 +1,40 @@
|
|||
{
|
||||
"schema": "railiance-platform.blocked-task-source-review.v1",
|
||||
"date": "2026-10-04",
|
||||
"scope": [
|
||||
"RPF-WP-0050-T03",
|
||||
"RPF-WP-0051-T02",
|
||||
"RPF-WP-0051-T03",
|
||||
"RPF-WP-0035-T02"
|
||||
],
|
||||
"local_issuer_reader_prepared": true,
|
||||
"source_validation_passed": true,
|
||||
"reader_helper_tests": 10,
|
||||
"scaffold_tests": 14,
|
||||
"window_tests": 7,
|
||||
"active_gitops_references": false,
|
||||
"workplan_states": {
|
||||
"RPF-WP-0050": "blocked",
|
||||
"RPF-WP-0051": "blocked",
|
||||
"RPF-WP-0035": "blocked"
|
||||
},
|
||||
"informed_decision_exact_primary_commit": "f06b7e9c53d3477f1e690ed8259f2eaab3661f91",
|
||||
"keycape_exact_primary_sync": "pending historical identity repair",
|
||||
"keycape_reviewed_source": "44cc067aa2c7dadffc75b631baa221a5f5caa531",
|
||||
"keycape_current_local_managed_commit": "f485d6fe9c7389b7f29d97e5da51b14eb0692eb3",
|
||||
"owner_source_phase_required_before_platform_delivery": true,
|
||||
"receiving_full_live_completion_used_as_predecessor": false,
|
||||
"credential_values_accessed": false,
|
||||
"token_minted": false,
|
||||
"production_changed": false,
|
||||
"source_sha256": {
|
||||
"credential-change-requests/CCR-2026-0033.yaml": "7090eaf6c7c5c5c084ad7433f1e77682927d81ffb6c6366d3cae19d6d8e0747d",
|
||||
"docs/credential-lane-designs/keycape-secrets-engine-openbao-issuer-input.yaml": "380a5cbb6a5be887d77e7c9aa57eda18da8a7059568b2c5143e2555ed8ab9fdb",
|
||||
"openbao/policies/workload-kv-read-keycape-secrets-engine-openbao-eso.hcl": "e2254d9ac9963922b435770e4fbf782943d43714b6a50a680add671654f245ec",
|
||||
"openbao/auth/external-secrets-keycape-secrets-engine-openbao.draft.json": "be265e829f3d025107bfe9495c01772900549ed9c1077fa12b7185c38d7e6984",
|
||||
"docs/provisioning-windows/2026-10-04-1000/keycape/eso.draft.yaml": "3940caac61ac931322606baba9f20f99a35b3a9e3243c1230921fa9b6a6fcb77",
|
||||
"docs/provisioning-windows/2026-10-04-1000/keycape/receipt-contract.json": "07299926448844d64dc0dccbabb2440e3f54792eea221a6f933129a0297a6ac2",
|
||||
"docs/provisioning-windows/2026-10-04-1000/dependency-requirements.md": "f543a64a46667f282438fb6bcf8cd6826a94c9dbaa8aa05e60082892957a8a99",
|
||||
"docs/evidence/2026-10-04-requester-eso-tokenrequest-review.json": "ce21124420ee5f6535e3172a0948bf143d566d8870e9818b160fe0aa681bfc82"
|
||||
}
|
||||
}
|
||||
|
|
@ -0,0 +1,11 @@
|
|||
{
|
||||
"cluster": "railiance01",
|
||||
"controller_serviceaccount": "external-secrets",
|
||||
"target_auth_serviceaccount": "informed-decision/informed-decision-eso",
|
||||
"namespace": "informed-decision",
|
||||
"tokenrequest_permission": true,
|
||||
"query_verified": true,
|
||||
"credential_values_accessed": false,
|
||||
"raw_errors_suppressed": true,
|
||||
"live_change": false
|
||||
}
|
||||
|
|
@ -1,5 +1,11 @@
|
|||
# Attended preparation — 4 October 2026, 10:00 Europe/Berlin
|
||||
|
||||
Current state: **blocked after available source implementation**. See
|
||||
`dependency-requirements.md` for reconciled worker receipts, exact remaining
|
||||
owner requirements and reopen conditions. Platform issuer reader CCR-2026-0033
|
||||
is drafted; actual ESO TokenRequest permission is verified without token minting.
|
||||
The historical preparation time supplies no standing live execution grant.
|
||||
|
||||
Owner: railiance-platform, RPF-WP-0050-T03. Founder instruction: “Pick lanes by
|
||||
relevance for today 10am.” This is a one-time preparation window, at 08:00 UTC,
|
||||
using the selected existing batched attended custody. No recurrence is selected.
|
||||
|
|
|
|||
|
|
@ -0,0 +1,79 @@
|
|||
# Remaining dependency requirements — 2026-10-04
|
||||
|
||||
Review scope: RPF-WP-0050-T03, RPF-WP-0051-T02/T03 and the selected
|
||||
RPF-WP-0035-T02 service-login lane. Source work is implemented where independent
|
||||
of receiving-owner facts. Both preparation workplans are blocked on the
|
||||
deliveries below. Completed design judgments are retained.
|
||||
|
||||
| Platform task | Receiving repo / owner task | Required independent delivery | Reopen condition |
|
||||
| --- | --- | --- | --- |
|
||||
| RPF-WP-0051-T02 | informed-decision / source phase of INFD-WP-0005-T05 | Process-owned private listener and explicit runtime configuration consuming compose_intake; authenticated bounded TokenReview transport using API-server CA; exact owner deploy renderer with private Service, NetworkPolicy, TokenReview RBAC and projected registries; final immutable image/config/source | Accept source composition and publication receipt, reviewed deployment proposal and named native verification/abort attendance. Do not require this owner's entire live T05 completion as a predecessor. |
|
||||
| RPF-WP-0051-T03 | informed-decision receiving runtime; founder execution gate | Complete T02 source packet, approve exact final live action, then native ESO/auth/file/exchange and revocation/rotation/cleanup receipts | Native delivery and owner runtime acceptance, after platform metadata and separately approved runtime promotion. Source proofs are already complete. |
|
||||
| RPF-WP-0035-T02 | secrets-engine / service-auth source acceptance in SECRETS-WP-0008-T06 | Explicit consumer host, protected file path and owner, mode-0600 delivery mechanism, refresh/rotation/revocation ownership and bounded validation interface | Source acceptance of those coordinates, independent of obtaining a working OpenBao service token. The entire live consumer task must not precede platform login provisioning. |
|
||||
| RPF-WP-0035-T02 | key-cape / KEY-WP-0037-T02/T03/T04; net-kingdom deployment authority | Accept proposed issuer coordinates and separate consumer delivery; reviewed single-client/env-preserving registration operation with immutable image/config; independently approved custody and actual registration/issuance receipts | Protected custody, real registration and validated provider claims are returned. Platform then performs its separately approved isolated JWT mount/role/self-policy operation and login proof. |
|
||||
| RPF-WP-0050-T03 | user-engine / USER-WP-0035-T02 and provider owner | Provider-supported single-use password-setup-link delivery contract and intended-recipient evidence; retained value-safe failure/retry behavior | Real handoff receipt. SMTP and invitation delivery already exist and are not reprovisioned. |
|
||||
|
||||
## Delivered owner work and platform checks
|
||||
|
||||
Informed-decision source acceptance: implementation
|
||||
`eb9614c2677c7f07c9d78eee7543f95f329d2c83`, exact-primary receipt
|
||||
`f06b7e9c53d3477f1e690ed8259f2eaab3661f91`. Requests/replies:
|
||||
`17bcfb39-f8c0-4cda-acce-de7af6d0afbc` and
|
||||
`d304e328-1e77-4a02-ae47-783a7290b6ce`. Its RequesterTokenProvider and
|
||||
compose_intake are implemented with 37 focused owner tests. Exact source
|
||||
binding/mount acceptance is supplied; live claims are not confirmed.
|
||||
|
||||
Platform independently verified railiance01's node address and the actual
|
||||
external-secrets controller ServiceAccount, then checked permission to create
|
||||
serviceaccounts/token in informed-decision through SubjectAccessReview.
|
||||
The explicit subresource query returned yes. Receipt:
|
||||
`docs/evidence/2026-10-04-requester-eso-tokenrequest-review.json`. This is an
|
||||
authorization check; no token was minted and it does not prove Secret delivery.
|
||||
The earlier slash-resource spelling gave a different result and is not accepted
|
||||
as the TokenRequest receipt. The explicit subresource query is authoritative.
|
||||
|
||||
KeyCape source packet: `44cc067aa2c7dadffc75b631baa221a5f5caa531`;
|
||||
managed IDs/index locally at `f485d6fe9c7389b7f29d97e5da51b14eb0692eb3`.
|
||||
Replies `58826056-55f2-4300-9b42-05ceeec9c26a` and
|
||||
`eb20a78c-0b9b-41e6-b349-dfaa9873633b` name the real owner tasks. Its latest
|
||||
exact-primary sync is pending: Repo Manager refused grandfathered
|
||||
ADHOC-2026-09-27-T02 without UUID. KeyCape/repo-manager must reconcile the
|
||||
source identity through the required scoped decision, then return an applied/noop
|
||||
receipt for the actual current commit. Platform does not invent UUIDs or bypass
|
||||
the refusal. This is separate from actual provider registration/custody.
|
||||
|
||||
## Implemented platform issuer-reader preparation
|
||||
|
||||
The KeyCape packet's candidate path is accepted here for proposed source review:
|
||||
`platform/services/keycape/secrets-engine-openbao`, field CLIENT_SECRET.
|
||||
Proposed CCR-2026-0033 and input
|
||||
`docs/credential-lane-designs/keycape-secrets-engine-openbao-issuer-input.yaml`
|
||||
declare only the issuer reader. Policy
|
||||
`workload-kv-read-keycape-secrets-engine-openbao-eso` reads exactly that data path.
|
||||
Role `external-secrets-keycape-secrets-engine-openbao` binds the existing
|
||||
external-secrets/external-secrets identity, audience openbao, 15-minute
|
||||
TTL/max/explicit max and no default policy. The proposed store admits only sso;
|
||||
target Secret keycape-secrets-engine-openbao-client projects client-secret.
|
||||
Target annotations are explicit. Auth payload, ESO and receipt checklist are
|
||||
prepared under this window's `keycape/` directory and outside active GitOps.
|
||||
|
||||
CCR-2026-0033 is proposed, claims unconfirmed and frontdoor unresolvable.
|
||||
No value exists by implication of this draft. The service client custody child
|
||||
cannot be finalized before the secrets-engine consumer coordinates are accepted:
|
||||
issuer-side ESO does not supply a host/path/mechanism for the consumer copy.
|
||||
No guessed runtime directory, automatic token seed or live registration is added.
|
||||
|
||||
## Dependency boundary
|
||||
|
||||
Owner source readiness precedes platform promotion. Platform native delivery
|
||||
proof follows its own authorized apply, and receiving live acceptance follows
|
||||
that delivery. Requiring a receiving repo's full live completion before platform
|
||||
supplies its credential would create a mutual wait. Where an owner composite
|
||||
task includes both phases, the wait is qualified as `message-from:<owner>` for
|
||||
the exact independent source receipt until that owner names a separate source
|
||||
task; no fabricated task ID or complete-task dependency is introduced.
|
||||
|
||||
Once source deliveries arrive, reopen only the affected platform task. The
|
||||
founder-approved informed-decision design needs no repeat decision unless scope
|
||||
changes. Live actions still require a fresh reviewed execution packet and go;
|
||||
the historical 10:00 preparation window is not a standing execution grant.
|
||||
|
|
@ -0,0 +1,54 @@
|
|||
# DRAFT REVIEW ARTIFACT. Do not apply. No custody/admission supplied.
|
||||
apiVersion: external-secrets.io/v1
|
||||
kind: ClusterSecretStore
|
||||
metadata:
|
||||
name: openbao-keycape-secrets-engine-openbao
|
||||
annotations:
|
||||
railiance.io/credential-change: CCR-2026-0033
|
||||
railiance.io/admission: pending-review
|
||||
spec:
|
||||
provider:
|
||||
vault:
|
||||
server: http://openbao.openbao.svc:8200
|
||||
path: platform
|
||||
version: v2
|
||||
auth:
|
||||
kubernetes:
|
||||
mountPath: kubernetes
|
||||
role: external-secrets-keycape-secrets-engine-openbao
|
||||
audiences:
|
||||
- openbao
|
||||
serviceAccountRef:
|
||||
name: external-secrets
|
||||
namespace: external-secrets
|
||||
conditions:
|
||||
- namespaces:
|
||||
- sso
|
||||
---
|
||||
apiVersion: external-secrets.io/v1
|
||||
kind: ExternalSecret
|
||||
metadata:
|
||||
name: keycape-secrets-engine-openbao-client
|
||||
namespace: sso
|
||||
annotations:
|
||||
railiance.io/credential-change: CCR-2026-0033
|
||||
railiance.io/admission: pending-review
|
||||
spec:
|
||||
refreshInterval: 5m
|
||||
secretStoreRef:
|
||||
kind: ClusterSecretStore
|
||||
name: openbao-keycape-secrets-engine-openbao
|
||||
target:
|
||||
name: keycape-secrets-engine-openbao-client
|
||||
creationPolicy: Owner
|
||||
deletionPolicy: Retain
|
||||
template:
|
||||
metadata:
|
||||
annotations:
|
||||
railiance.io/credential-change: CCR-2026-0033
|
||||
railiance.io/admission: pending-review
|
||||
data:
|
||||
- secretKey: client-secret
|
||||
remoteRef:
|
||||
key: services/keycape/secrets-engine-openbao
|
||||
property: CLIENT_SECRET
|
||||
|
|
@ -0,0 +1,16 @@
|
|||
{
|
||||
"schema_version": 1,
|
||||
"lane_id": "keycape-secrets-engine-openbao-eso",
|
||||
"ccr_id": "CCR-2026-0033",
|
||||
"status": "not-executed",
|
||||
"draft_only": true,
|
||||
"verified": false,
|
||||
"request_sha256": "380a5cbb6a5be887d77e7c9aa57eda18da8a7059568b2c5143e2555ed8ab9fdb",
|
||||
"required_owner_checks": [
|
||||
"Exact revision/digest and required owner reviews",
|
||||
"Identity/auth claims confirmed separately; no inferred workload identity",
|
||||
"Metadata/capability readback through reviewed output-suppressing owner tool",
|
||||
"No Secret bodies, values or raw subprocess errors in evidence",
|
||||
"Native scoped positive/negative, cleanup/revocation and rollback receipts after approval"
|
||||
]
|
||||
}
|
||||
|
|
@ -12,6 +12,13 @@ thread `f84637fa-2355-4971-a2dc-7f1fd01710a8` and reviewed platform commit
|
|||
remains outstanding. The user-engine/provider item below remains a prepared
|
||||
source request, outside this two-message authorization.
|
||||
|
||||
Owner responses are now received and reconciled in `dependency-requirements.md`:
|
||||
informed-decision 17bcfb39/d304e328 deliver source binding/mount and requester
|
||||
implementation; key-cape 58826056/eb20a78c name KEY-WP-0037's custody/registration
|
||||
phases. The remaining exact source requirements are recorded there. Platform
|
||||
issuer-reader draft CCR-2026-0033 is implemented; the client-side custody
|
||||
coordinates and receiving runtime/publication remain external deliveries.
|
||||
|
||||
## secrets-engine / KeyCape — RPF-WP-0035-T02
|
||||
|
||||
Platform already has exact proposed files `openbao/auth/keycape-services-config.json`,
|
||||
|
|
|
|||
|
|
@ -0,0 +1,19 @@
|
|||
{
|
||||
"draft_only": true,
|
||||
"status": "proposed",
|
||||
"bound_claims_confirmed": false,
|
||||
"auth_payload": {
|
||||
"bound_service_account_names": [
|
||||
"external-secrets"
|
||||
],
|
||||
"bound_service_account_namespaces": [
|
||||
"external-secrets"
|
||||
],
|
||||
"policies": "workload-kv-read-keycape-secrets-engine-openbao-eso",
|
||||
"ttl": "15m",
|
||||
"audience": "openbao",
|
||||
"token_max_ttl": "15m",
|
||||
"token_explicit_max_ttl": "15m",
|
||||
"token_no_default_policy": true
|
||||
}
|
||||
}
|
||||
|
|
@ -0,0 +1,3 @@
|
|||
path "platform/data/services/keycape/secrets-engine-openbao" {
|
||||
capabilities = ["read"]
|
||||
}
|
||||
|
|
@ -8,7 +8,7 @@ status: blocked
|
|||
flavor: implementation
|
||||
owner: codex
|
||||
created: "2026-09-05"
|
||||
updated: "2026-10-03"
|
||||
updated: "2026-10-04"
|
||||
related:
|
||||
- RPF-WP-0032
|
||||
- RPF-WP-0033
|
||||
|
|
@ -46,8 +46,9 @@ id: RPF-WP-0035-T02
|
|||
status: wait
|
||||
needs_human: true
|
||||
decision_id: 62aa95e4-3ccc-4867-8806-5e3db005b483
|
||||
blocked_on: message-from:key-cape
|
||||
blocking_reason: "SECRETS-WP-0007-T04 done 2026-09-27, so that gate is open. Real blocker: live KeyCape registration of client secrets-engine-openbao and its protected client-credential custody (contract: separate approved custody action; no owning task id yet, asked key-cape 2026-10-03). The design requires both before any write; then a reviewed child and the attended founder apply."
|
||||
depends_on: [KEY-WP-0037-T02, KEY-WP-0037-T03, KEY-WP-0037-T04]
|
||||
blocked_on: message-from:secrets-engine
|
||||
blocking_reason: "KEY-WP-0037 now owns protected custody, real registration and native issuance. Platform issuer-reader source CCR-2026-0033 is prepared. secrets-engine must accept exact consumer host/file/delivery/rotation coordinates before the separate custody child is finalized; KeyCape exact-primary identity repair and separate live go remain."
|
||||
priority: high
|
||||
state_hub_task_id: "e0c82ea9-05a5-537e-8fbf-67534263572e"
|
||||
```
|
||||
|
|
@ -83,6 +84,18 @@ protected-custody owning tasks/status/revisions and non-secret receipts. Source
|
|||
registration is not live custody; no value fetch or live registration was
|
||||
requested. T02 remains waiting on the owner return and separate execution gates.
|
||||
|
||||
2026-10-04 blocked-task review: KeyCape returns 58826056/eb20a78c now identify
|
||||
KEY-WP-0037-T02/T03/T04, replacing the unowned-registration wait with real
|
||||
dependencies. Prepared proposed CCR-2026-0033 and exact-path issuer policy/auth,
|
||||
sso-only ESO and evidence checklist from the returned candidate coordinates.
|
||||
No issuer/consumer value, registration or native issuance is supplied by them.
|
||||
secrets-engine must return independent source acceptance of consumer host/path,
|
||||
protected delivery and rotation/revocation ownership; awaiting that source phase
|
||||
does not depend on its full live service-login task. KeyCape's exact-primary sync
|
||||
remains pending its scoped historical identity repair. Requirements and acceptance
|
||||
boundaries: `docs/provisioning-windows/2026-10-04-1000/dependency-requirements.md`.
|
||||
This workplan was already blocked and remains blocked on its open owner/live gates.
|
||||
|
||||
## Implement the platform operator-write CCR contract and Fluid lane
|
||||
|
||||
```task
|
||||
|
|
|
|||
|
|
@ -4,7 +4,7 @@ type: workplan
|
|||
title: "Prepare generated attended windows and explicit value-custody choice"
|
||||
domain: financials
|
||||
repo: railiance-platform
|
||||
status: active
|
||||
status: blocked
|
||||
owner: codex
|
||||
topic_slug: platform-services
|
||||
created: "2026-10-03"
|
||||
|
|
@ -47,7 +47,7 @@ id: RPF-WP-0050-T03
|
|||
status: wait
|
||||
priority: medium
|
||||
depends_on: [RPF-WP-0051-T02, RPF-WP-0035-T02, USER-WP-0035-T02]
|
||||
blocking_reason: "Direct founder selection supplies the one-time date/scope. Informed-decision reader source is prepared under RPF-WP-0051; exact owner runtime/binding acceptance, KeyCape service registration/custody and provider setup-link handoff remain. Exact founder execution authorization remains separate."
|
||||
blocking_reason: "Platform preparation and founder design choice are complete. Independent informed-decision runtime source/publication, KeyCape custody/registration/issuance, secrets-engine consumer custody coordinates and provider setup-link handoff remain; dependency-requirements.md names the exact owner deliveries."
|
||||
state_hub_task_id: "1ae5a6b8-9c83-5813-982f-ca8ad24be8b5"
|
||||
```
|
||||
|
||||
|
|
@ -66,6 +66,15 @@ credential provisioning to the provider password-setup-link handoff: USER-WP-003
|
|||
names the actual three remaining owner acts. T03 depends on those returns rather
|
||||
than an already-supplied date. No applied requester/mail custody is replayed.
|
||||
|
||||
2026-10-04 blocked-task review: worker returns reconciled, platform issuer-reader
|
||||
CCR-2026-0033/policy/auth/ESO/receipt source implemented, and actual ESO controller
|
||||
TokenRequest authorization checked without minting a token. Required independent
|
||||
owner phases and reopen conditions are recorded in
|
||||
`docs/provisioning-windows/2026-10-04-1000/dependency-requirements.md`.
|
||||
T03 stays wait; the plan is blocked because remaining progress requires receiving
|
||||
repo source/registration/custody/handoff evidence. Existing date/design approvals
|
||||
are retained. No source receipt is substituted for native acceptance.
|
||||
|
||||
## Accept platform seam for catalog lane scaffold proposal
|
||||
|
||||
```task
|
||||
|
|
|
|||
|
|
@ -4,7 +4,7 @@ type: workplan
|
|||
title: "Prepare and admit informed-decision requester workload delivery"
|
||||
domain: financials
|
||||
repo: railiance-platform
|
||||
status: active
|
||||
status: blocked
|
||||
owner: codex
|
||||
topic_slug: platform-services
|
||||
created: "2026-10-04"
|
||||
|
|
@ -54,7 +54,7 @@ id: RPF-WP-0051-T02
|
|||
status: wait
|
||||
priority: high
|
||||
blocked_on: message-from:informed-decision
|
||||
blocking_reason: "Owner must accept the proposed informed-decision-eso binding, Secret mount and actual runtime client-credentials exchange; private intake composition and native proof remain."
|
||||
blocking_reason: "Binding/mount and requester exchange source accepted at informed-decision f06b7e9. Independent owner private-listener/runtime configuration, CA-verified TokenReview transport, deployment/RBAC/network proposal and immutable image/config source receipt remain; full live INFD-WP-0005-T05 completion is not a predecessor."
|
||||
state_hub_task_id: "dfc17e0a-9f63-5a97-b87e-13bd3a8325d6"
|
||||
```
|
||||
|
||||
|
|
@ -71,6 +71,19 @@ thread `f84637fa-2355-4971-a2dc-7f1fd01710a8`, reviewing source commit
|
|||
asks for exact binding/mount/runtime/verification ownership and remaining native
|
||||
evidence. Hub creation receipt is retained; owner acceptance is still outstanding.
|
||||
|
||||
2026-10-04 owner-return review: source binding/mount acceptance and rotating
|
||||
RequesterTokenProvider/compose_intake implementation are delivered at
|
||||
`eb9614c2677c7f07c9d78eee7543f95f329d2c83`; exact-primary source receipt is
|
||||
`f06b7e9c53d3477f1e690ed8259f2eaab3661f91`. Replies 17bcfb39 and d304e328
|
||||
and `informed-decision/docs/requester-workload-owner-review.md` retain 37 focused
|
||||
owner tests and remaining process/transport/publication gaps. Platform's explicit
|
||||
SubjectAccessReview of the actual controller confirms TokenRequest permission
|
||||
for the namespace without minting a token. T02 waits only on independent owner
|
||||
source readiness, not its entire live task (which needs platform delivery).
|
||||
Native custody/delivery acceptance remains T03. Plan moved to blocked after
|
||||
completing available local preparation; concrete requirements/reopen conditions
|
||||
are in this window's `dependency-requirements.md`.
|
||||
|
||||
## Apply and accept the scoped workload delivery
|
||||
|
||||
```task
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue