From 8c7c34e84b4bab327ef4f9bc77f35ce13bb56e3f Mon Sep 17 00:00:00 2001 From: codex Date: Sun, 4 Oct 2026 11:32:13 +0200 Subject: [PATCH] Implement issuer reader preparation and qualify blocked owner dependencies Assistant: codex Assistant-Model: gpt-6.1-sol Assistant-Session: 01a1046b-5629-7f52-badd-f718eadb6042 --- credential-change-requests/CCR-2026-0033.yaml | 94 +++++++++++++++++++ ...e-secrets-engine-openbao-issuer-input.yaml | 56 +++++++++++ .../secrets-engine-service-jwt.md | 21 +++++ .../2026-10-04-blocked-task-review.json | 40 ++++++++ ...-04-requester-eso-tokenrequest-review.json | 11 +++ .../2026-10-04-1000/README.md | 6 ++ .../dependency-requirements.md | 79 ++++++++++++++++ .../2026-10-04-1000/keycape/eso.draft.yaml | 54 +++++++++++ .../keycape/receipt-contract.json | 16 ++++ .../2026-10-04-1000/owner-returns.md | 7 ++ ...-keycape-secrets-engine-openbao.draft.json | 19 ++++ ...ead-keycape-secrets-engine-openbao-eso.hcl | 3 + ...-WP-0035-credential-lane-implementation.md | 19 +++- ...-0050-attended-provisioning-preparation.md | 13 ++- ...ed-decision-requester-workload-delivery.md | 17 +++- 15 files changed, 448 insertions(+), 7 deletions(-) create mode 100644 credential-change-requests/CCR-2026-0033.yaml create mode 100644 docs/credential-lane-designs/keycape-secrets-engine-openbao-issuer-input.yaml create mode 100644 docs/evidence/2026-10-04-blocked-task-review.json create mode 100644 docs/evidence/2026-10-04-requester-eso-tokenrequest-review.json create mode 100644 docs/provisioning-windows/2026-10-04-1000/dependency-requirements.md create mode 100644 docs/provisioning-windows/2026-10-04-1000/keycape/eso.draft.yaml create mode 100644 docs/provisioning-windows/2026-10-04-1000/keycape/receipt-contract.json create mode 100644 openbao/auth/external-secrets-keycape-secrets-engine-openbao.draft.json create mode 100644 openbao/policies/workload-kv-read-keycape-secrets-engine-openbao-eso.hcl diff --git a/credential-change-requests/CCR-2026-0033.yaml b/credential-change-requests/CCR-2026-0033.yaml new file mode 100644 index 0000000..b2828f1 --- /dev/null +++ b/credential-change-requests/CCR-2026-0033.yaml @@ -0,0 +1,94 @@ +id: CCR-2026-0033 +kind: credential-change-request +schema_version: 1 +request_type: workload-kv-read +title: KeyCape secrets-engine-openbao issuer workload reader +status: proposed +created: '2026-10-04' +updated: '2026-10-04' +requester: + agent: key-cape + reason: KEY-WP-0037-T02 owner packet; proposed issuer-side read of separately approved + service client custody +review: + required: true + required_approvers: + - platform-owner + - key-cape-owner + - net-kingdom-owner + comments: [] +target: + domain: financials + tenant: platform + workload: keycape + environment: production + purpose: Deliver separately approved secrets-engine-openbao client secret to issuer + through sso-only ESO +openbao: + mount: platform + kv_path: platform/services/keycape/secrets-engine-openbao + fields: + - CLIENT_SECRET + policy_name: workload-kv-read-keycape-secrets-engine-openbao-eso + policy_file: openbao/policies/workload-kv-read-keycape-secrets-engine-openbao-eso.hcl + metadata_read: false + auth: + method: kubernetes + mount: kubernetes + role: external-secrets-keycape-secrets-engine-openbao + audience: openbao + ttl: 15m + token_max_ttl: 15m + token_explicit_max_ttl: 15m + token_no_default_policy: true + policies: + - workload-kv-read-keycape-secrets-engine-openbao-eso + bound_claims: + service_account_names: + - external-secrets + service_account_namespaces: + - external-secrets + bound_claims_confirmed: false +access_frontdoor: + type: external-secrets + catalog_id: keycape-secrets-engine-openbao-eso + readiness: pending-review + resolvable: false +risk: + classification: high + notes: + - Reads whole proposed path holding the secrets-engine-openbao confidential value; + issuer and consumer copies need separate acceptance + - Only ExternalSecrets in namespace sso may use the store; sso namespace writers + are within this boundary + - Issuer ESO does not deliver the separate secrets-engine consumer file or authorize + client registration +verification: + positive: + - Owner-reviewed native exact identity and exact path proof required + negative: + - Owner-reviewed wrong identity, sibling GET and parent LIST denials required + activation_conditions: + - Exact CCR approval, confirmed identity, attended custody and native receipt acceptance + required +lifecycle: + deactivate: Owner-reviewed delivery withdrawal and token revocation; exact rollback + receipt required + rotate: Separate version-guarded owner approval and contained value delivery required + compromised: Owner incident process; no automatic read, reseed or cleanup +scaffold: + draft_only: true + consumer_repo: key-cape + owner_repo: railiance-platform + request_sha256: 380a5cbb6a5be887d77e7c9aa57eda18da8a7059568b2c5143e2555ed8ab9fdb + catalog_request_sha256: null +state_hub: + workplan_id: RPF-WP-0035 + task_id: RPF-WP-0035-T02 + related_workplan: KEY-WP-0037 +delivery: + surface: external-secrets + target: sso/keycape-secrets-engine-openbao-client key client-secret; issuer-side + delivery only + review_bundle: docs/provisioning-windows/2026-10-04-1000/keycape + consumer_file_delivery: not selected; requires secrets-engine source acceptance diff --git a/docs/credential-lane-designs/keycape-secrets-engine-openbao-issuer-input.yaml b/docs/credential-lane-designs/keycape-secrets-engine-openbao-issuer-input.yaml new file mode 100644 index 0000000..f4d85a5 --- /dev/null +++ b/docs/credential-lane-designs/keycape-secrets-engine-openbao-issuer-input.yaml @@ -0,0 +1,56 @@ +schema_version: 1 +lane_id: keycape-secrets-engine-openbao-eso +ccr_id: CCR-2026-0033 +title: KeyCape secrets-engine-openbao issuer workload reader +date: '2026-10-04' +consumer_repo: key-cape +owner_repo: railiance-platform +requester: + agent: key-cape + reason: KEY-WP-0037-T02 owner packet; proposed issuer-side read of separately approved + service client custody +review_approvers: +- platform-owner +- key-cape-owner +- net-kingdom-owner +target: + domain: financials + tenant: platform + workload: keycape + environment: production + purpose: Deliver separately approved secrets-engine-openbao client secret to issuer + through sso-only ESO +openbao: + mount: platform + kv_path: platform/services/keycape/secrets-engine-openbao + fields: + - CLIENT_SECRET + policy_name: workload-kv-read-keycape-secrets-engine-openbao-eso + auth: + mount: kubernetes + role: external-secrets-keycape-secrets-engine-openbao + audience: openbao + service_account_names: + - external-secrets + service_account_namespaces: + - external-secrets + ttl: 15m +eso: + store_name: openbao-keycape-secrets-engine-openbao + server: http://openbao.openbao.svc:8200 + namespace: sso + external_secret_name: keycape-secrets-engine-openbao-client + secret_name: keycape-secrets-engine-openbao-client + refresh_interval: 5m + data: + - secret_key: client-secret + property: CLIENT_SECRET +risk: + classification: high + notes: + - Reads whole proposed path holding the secrets-engine-openbao confidential value; + issuer and consumer copies need separate acceptance + - Only ExternalSecrets in namespace sso may use the store; sso namespace writers + are within this boundary + - Issuer ESO does not deliver the separate secrets-engine consumer file or authorize + client registration diff --git a/docs/credential-lane-designs/secrets-engine-service-jwt.md b/docs/credential-lane-designs/secrets-engine-service-jwt.md index 6724c6b..6d4b947 100644 --- a/docs/credential-lane-designs/secrets-engine-service-jwt.md +++ b/docs/credential-lane-designs/secrets-engine-service-jwt.md @@ -129,3 +129,24 @@ claimed a live registration of `secrets-engine-openbao`, and its client-credenti custody has no owning task (KeyCape contract: "a separate approved custody action"). No reviewed child is written. RPF-WP-0035-T02 waits on key-cape naming that task. + +## Owner return and blocked dependency contract — 2026-10-04 + +KEY-WP-0037-T02 now owns separately approved protected custody, T03 the actual +deployment-owned registration operation, and T04 native issuance evidence. +`key-cape/docs/secrets-engine-openbao-owner-packet.md` supplies the candidate +issuer path and exact registration contract. Platform prepared proposed +CCR-2026-0033 and exact-path issuer reader policy/auth/ESO/receipt artifacts; +source generation does not allocate a value or establish registration. + +secrets-engine must accept the actual consumer host/file owner/path, mode-0600 +delivery mechanism and rotation/revocation ownership before the bounded custody +child is finalized. Issuer-side ESO is a separate copy. An owner source acceptance +receipt, independent of full live service login completion, supplies this gate. +KeyCape's current exact-primary receipt remains pending scoped repair of an +existing grandfathered ADHOC task identity. Do not infer synchronization from +its source contract or local managed IDs. + +`docs/provisioning-windows/2026-10-04-1000/dependency-requirements.md` names all +source/acceptance/reopen boundaries. RPF-WP-0035-T02 remains wait; its workplan +is blocked on those real dependencies and separate attended execution approval. diff --git a/docs/evidence/2026-10-04-blocked-task-review.json b/docs/evidence/2026-10-04-blocked-task-review.json new file mode 100644 index 0000000..0ddbd0e --- /dev/null +++ b/docs/evidence/2026-10-04-blocked-task-review.json @@ -0,0 +1,40 @@ +{ + "schema": "railiance-platform.blocked-task-source-review.v1", + "date": "2026-10-04", + "scope": [ + "RPF-WP-0050-T03", + "RPF-WP-0051-T02", + "RPF-WP-0051-T03", + "RPF-WP-0035-T02" + ], + "local_issuer_reader_prepared": true, + "source_validation_passed": true, + "reader_helper_tests": 10, + "scaffold_tests": 14, + "window_tests": 7, + "active_gitops_references": false, + "workplan_states": { + "RPF-WP-0050": "blocked", + "RPF-WP-0051": "blocked", + "RPF-WP-0035": "blocked" + }, + "informed_decision_exact_primary_commit": "f06b7e9c53d3477f1e690ed8259f2eaab3661f91", + "keycape_exact_primary_sync": "pending historical identity repair", + "keycape_reviewed_source": "44cc067aa2c7dadffc75b631baa221a5f5caa531", + "keycape_current_local_managed_commit": "f485d6fe9c7389b7f29d97e5da51b14eb0692eb3", + "owner_source_phase_required_before_platform_delivery": true, + "receiving_full_live_completion_used_as_predecessor": false, + "credential_values_accessed": false, + "token_minted": false, + "production_changed": false, + "source_sha256": { + "credential-change-requests/CCR-2026-0033.yaml": "7090eaf6c7c5c5c084ad7433f1e77682927d81ffb6c6366d3cae19d6d8e0747d", + "docs/credential-lane-designs/keycape-secrets-engine-openbao-issuer-input.yaml": "380a5cbb6a5be887d77e7c9aa57eda18da8a7059568b2c5143e2555ed8ab9fdb", + "openbao/policies/workload-kv-read-keycape-secrets-engine-openbao-eso.hcl": "e2254d9ac9963922b435770e4fbf782943d43714b6a50a680add671654f245ec", + "openbao/auth/external-secrets-keycape-secrets-engine-openbao.draft.json": "be265e829f3d025107bfe9495c01772900549ed9c1077fa12b7185c38d7e6984", + "docs/provisioning-windows/2026-10-04-1000/keycape/eso.draft.yaml": "3940caac61ac931322606baba9f20f99a35b3a9e3243c1230921fa9b6a6fcb77", + "docs/provisioning-windows/2026-10-04-1000/keycape/receipt-contract.json": "07299926448844d64dc0dccbabb2440e3f54792eea221a6f933129a0297a6ac2", + "docs/provisioning-windows/2026-10-04-1000/dependency-requirements.md": "f543a64a46667f282438fb6bcf8cd6826a94c9dbaa8aa05e60082892957a8a99", + "docs/evidence/2026-10-04-requester-eso-tokenrequest-review.json": "ce21124420ee5f6535e3172a0948bf143d566d8870e9818b160fe0aa681bfc82" + } +} diff --git a/docs/evidence/2026-10-04-requester-eso-tokenrequest-review.json b/docs/evidence/2026-10-04-requester-eso-tokenrequest-review.json new file mode 100644 index 0000000..f635dfa --- /dev/null +++ b/docs/evidence/2026-10-04-requester-eso-tokenrequest-review.json @@ -0,0 +1,11 @@ +{ + "cluster": "railiance01", + "controller_serviceaccount": "external-secrets", + "target_auth_serviceaccount": "informed-decision/informed-decision-eso", + "namespace": "informed-decision", + "tokenrequest_permission": true, + "query_verified": true, + "credential_values_accessed": false, + "raw_errors_suppressed": true, + "live_change": false +} diff --git a/docs/provisioning-windows/2026-10-04-1000/README.md b/docs/provisioning-windows/2026-10-04-1000/README.md index 4bfa3c7..d001922 100644 --- a/docs/provisioning-windows/2026-10-04-1000/README.md +++ b/docs/provisioning-windows/2026-10-04-1000/README.md @@ -1,5 +1,11 @@ # Attended preparation — 4 October 2026, 10:00 Europe/Berlin +Current state: **blocked after available source implementation**. See +`dependency-requirements.md` for reconciled worker receipts, exact remaining +owner requirements and reopen conditions. Platform issuer reader CCR-2026-0033 +is drafted; actual ESO TokenRequest permission is verified without token minting. +The historical preparation time supplies no standing live execution grant. + Owner: railiance-platform, RPF-WP-0050-T03. Founder instruction: “Pick lanes by relevance for today 10am.” This is a one-time preparation window, at 08:00 UTC, using the selected existing batched attended custody. No recurrence is selected. diff --git a/docs/provisioning-windows/2026-10-04-1000/dependency-requirements.md b/docs/provisioning-windows/2026-10-04-1000/dependency-requirements.md new file mode 100644 index 0000000..21c62d1 --- /dev/null +++ b/docs/provisioning-windows/2026-10-04-1000/dependency-requirements.md @@ -0,0 +1,79 @@ +# Remaining dependency requirements — 2026-10-04 + +Review scope: RPF-WP-0050-T03, RPF-WP-0051-T02/T03 and the selected +RPF-WP-0035-T02 service-login lane. Source work is implemented where independent +of receiving-owner facts. Both preparation workplans are blocked on the +deliveries below. Completed design judgments are retained. + +| Platform task | Receiving repo / owner task | Required independent delivery | Reopen condition | +| --- | --- | --- | --- | +| RPF-WP-0051-T02 | informed-decision / source phase of INFD-WP-0005-T05 | Process-owned private listener and explicit runtime configuration consuming compose_intake; authenticated bounded TokenReview transport using API-server CA; exact owner deploy renderer with private Service, NetworkPolicy, TokenReview RBAC and projected registries; final immutable image/config/source | Accept source composition and publication receipt, reviewed deployment proposal and named native verification/abort attendance. Do not require this owner's entire live T05 completion as a predecessor. | +| RPF-WP-0051-T03 | informed-decision receiving runtime; founder execution gate | Complete T02 source packet, approve exact final live action, then native ESO/auth/file/exchange and revocation/rotation/cleanup receipts | Native delivery and owner runtime acceptance, after platform metadata and separately approved runtime promotion. Source proofs are already complete. | +| RPF-WP-0035-T02 | secrets-engine / service-auth source acceptance in SECRETS-WP-0008-T06 | Explicit consumer host, protected file path and owner, mode-0600 delivery mechanism, refresh/rotation/revocation ownership and bounded validation interface | Source acceptance of those coordinates, independent of obtaining a working OpenBao service token. The entire live consumer task must not precede platform login provisioning. | +| RPF-WP-0035-T02 | key-cape / KEY-WP-0037-T02/T03/T04; net-kingdom deployment authority | Accept proposed issuer coordinates and separate consumer delivery; reviewed single-client/env-preserving registration operation with immutable image/config; independently approved custody and actual registration/issuance receipts | Protected custody, real registration and validated provider claims are returned. Platform then performs its separately approved isolated JWT mount/role/self-policy operation and login proof. | +| RPF-WP-0050-T03 | user-engine / USER-WP-0035-T02 and provider owner | Provider-supported single-use password-setup-link delivery contract and intended-recipient evidence; retained value-safe failure/retry behavior | Real handoff receipt. SMTP and invitation delivery already exist and are not reprovisioned. | + +## Delivered owner work and platform checks + +Informed-decision source acceptance: implementation +`eb9614c2677c7f07c9d78eee7543f95f329d2c83`, exact-primary receipt +`f06b7e9c53d3477f1e690ed8259f2eaab3661f91`. Requests/replies: +`17bcfb39-f8c0-4cda-acce-de7af6d0afbc` and +`d304e328-1e77-4a02-ae47-783a7290b6ce`. Its RequesterTokenProvider and +compose_intake are implemented with 37 focused owner tests. Exact source +binding/mount acceptance is supplied; live claims are not confirmed. + +Platform independently verified railiance01's node address and the actual +external-secrets controller ServiceAccount, then checked permission to create +serviceaccounts/token in informed-decision through SubjectAccessReview. +The explicit subresource query returned yes. Receipt: +`docs/evidence/2026-10-04-requester-eso-tokenrequest-review.json`. This is an +authorization check; no token was minted and it does not prove Secret delivery. +The earlier slash-resource spelling gave a different result and is not accepted +as the TokenRequest receipt. The explicit subresource query is authoritative. + +KeyCape source packet: `44cc067aa2c7dadffc75b631baa221a5f5caa531`; +managed IDs/index locally at `f485d6fe9c7389b7f29d97e5da51b14eb0692eb3`. +Replies `58826056-55f2-4300-9b42-05ceeec9c26a` and +`eb20a78c-0b9b-41e6-b349-dfaa9873633b` name the real owner tasks. Its latest +exact-primary sync is pending: Repo Manager refused grandfathered +ADHOC-2026-09-27-T02 without UUID. KeyCape/repo-manager must reconcile the +source identity through the required scoped decision, then return an applied/noop +receipt for the actual current commit. Platform does not invent UUIDs or bypass +the refusal. This is separate from actual provider registration/custody. + +## Implemented platform issuer-reader preparation + +The KeyCape packet's candidate path is accepted here for proposed source review: +`platform/services/keycape/secrets-engine-openbao`, field CLIENT_SECRET. +Proposed CCR-2026-0033 and input +`docs/credential-lane-designs/keycape-secrets-engine-openbao-issuer-input.yaml` +declare only the issuer reader. Policy +`workload-kv-read-keycape-secrets-engine-openbao-eso` reads exactly that data path. +Role `external-secrets-keycape-secrets-engine-openbao` binds the existing +external-secrets/external-secrets identity, audience openbao, 15-minute +TTL/max/explicit max and no default policy. The proposed store admits only sso; +target Secret keycape-secrets-engine-openbao-client projects client-secret. +Target annotations are explicit. Auth payload, ESO and receipt checklist are +prepared under this window's `keycape/` directory and outside active GitOps. + +CCR-2026-0033 is proposed, claims unconfirmed and frontdoor unresolvable. +No value exists by implication of this draft. The service client custody child +cannot be finalized before the secrets-engine consumer coordinates are accepted: +issuer-side ESO does not supply a host/path/mechanism for the consumer copy. +No guessed runtime directory, automatic token seed or live registration is added. + +## Dependency boundary + +Owner source readiness precedes platform promotion. Platform native delivery +proof follows its own authorized apply, and receiving live acceptance follows +that delivery. Requiring a receiving repo's full live completion before platform +supplies its credential would create a mutual wait. Where an owner composite +task includes both phases, the wait is qualified as `message-from:` for +the exact independent source receipt until that owner names a separate source +task; no fabricated task ID or complete-task dependency is introduced. + +Once source deliveries arrive, reopen only the affected platform task. The +founder-approved informed-decision design needs no repeat decision unless scope +changes. Live actions still require a fresh reviewed execution packet and go; +the historical 10:00 preparation window is not a standing execution grant. diff --git a/docs/provisioning-windows/2026-10-04-1000/keycape/eso.draft.yaml b/docs/provisioning-windows/2026-10-04-1000/keycape/eso.draft.yaml new file mode 100644 index 0000000..221d0c3 --- /dev/null +++ b/docs/provisioning-windows/2026-10-04-1000/keycape/eso.draft.yaml @@ -0,0 +1,54 @@ +# DRAFT REVIEW ARTIFACT. Do not apply. No custody/admission supplied. +apiVersion: external-secrets.io/v1 +kind: ClusterSecretStore +metadata: + name: openbao-keycape-secrets-engine-openbao + annotations: + railiance.io/credential-change: CCR-2026-0033 + railiance.io/admission: pending-review +spec: + provider: + vault: + server: http://openbao.openbao.svc:8200 + path: platform + version: v2 + auth: + kubernetes: + mountPath: kubernetes + role: external-secrets-keycape-secrets-engine-openbao + audiences: + - openbao + serviceAccountRef: + name: external-secrets + namespace: external-secrets + conditions: + - namespaces: + - sso +--- +apiVersion: external-secrets.io/v1 +kind: ExternalSecret +metadata: + name: keycape-secrets-engine-openbao-client + namespace: sso + annotations: + railiance.io/credential-change: CCR-2026-0033 + railiance.io/admission: pending-review +spec: + refreshInterval: 5m + secretStoreRef: + kind: ClusterSecretStore + name: openbao-keycape-secrets-engine-openbao + target: + name: keycape-secrets-engine-openbao-client + creationPolicy: Owner + deletionPolicy: Retain + template: + metadata: + annotations: + railiance.io/credential-change: CCR-2026-0033 + railiance.io/admission: pending-review + data: + - secretKey: client-secret + remoteRef: + key: services/keycape/secrets-engine-openbao + property: CLIENT_SECRET diff --git a/docs/provisioning-windows/2026-10-04-1000/keycape/receipt-contract.json b/docs/provisioning-windows/2026-10-04-1000/keycape/receipt-contract.json new file mode 100644 index 0000000..7a87696 --- /dev/null +++ b/docs/provisioning-windows/2026-10-04-1000/keycape/receipt-contract.json @@ -0,0 +1,16 @@ +{ + "schema_version": 1, + "lane_id": "keycape-secrets-engine-openbao-eso", + "ccr_id": "CCR-2026-0033", + "status": "not-executed", + "draft_only": true, + "verified": false, + "request_sha256": "380a5cbb6a5be887d77e7c9aa57eda18da8a7059568b2c5143e2555ed8ab9fdb", + "required_owner_checks": [ + "Exact revision/digest and required owner reviews", + "Identity/auth claims confirmed separately; no inferred workload identity", + "Metadata/capability readback through reviewed output-suppressing owner tool", + "No Secret bodies, values or raw subprocess errors in evidence", + "Native scoped positive/negative, cleanup/revocation and rollback receipts after approval" + ] +} diff --git a/docs/provisioning-windows/2026-10-04-1000/owner-returns.md b/docs/provisioning-windows/2026-10-04-1000/owner-returns.md index 635f50e..1fd77ad 100644 --- a/docs/provisioning-windows/2026-10-04-1000/owner-returns.md +++ b/docs/provisioning-windows/2026-10-04-1000/owner-returns.md @@ -12,6 +12,13 @@ thread `f84637fa-2355-4971-a2dc-7f1fd01710a8` and reviewed platform commit remains outstanding. The user-engine/provider item below remains a prepared source request, outside this two-message authorization. +Owner responses are now received and reconciled in `dependency-requirements.md`: +informed-decision 17bcfb39/d304e328 deliver source binding/mount and requester +implementation; key-cape 58826056/eb20a78c name KEY-WP-0037's custody/registration +phases. The remaining exact source requirements are recorded there. Platform +issuer-reader draft CCR-2026-0033 is implemented; the client-side custody +coordinates and receiving runtime/publication remain external deliveries. + ## secrets-engine / KeyCape — RPF-WP-0035-T02 Platform already has exact proposed files `openbao/auth/keycape-services-config.json`, diff --git a/openbao/auth/external-secrets-keycape-secrets-engine-openbao.draft.json b/openbao/auth/external-secrets-keycape-secrets-engine-openbao.draft.json new file mode 100644 index 0000000..ca1eb7b --- /dev/null +++ b/openbao/auth/external-secrets-keycape-secrets-engine-openbao.draft.json @@ -0,0 +1,19 @@ +{ + "draft_only": true, + "status": "proposed", + "bound_claims_confirmed": false, + "auth_payload": { + "bound_service_account_names": [ + "external-secrets" + ], + "bound_service_account_namespaces": [ + "external-secrets" + ], + "policies": "workload-kv-read-keycape-secrets-engine-openbao-eso", + "ttl": "15m", + "audience": "openbao", + "token_max_ttl": "15m", + "token_explicit_max_ttl": "15m", + "token_no_default_policy": true + } +} diff --git a/openbao/policies/workload-kv-read-keycape-secrets-engine-openbao-eso.hcl b/openbao/policies/workload-kv-read-keycape-secrets-engine-openbao-eso.hcl new file mode 100644 index 0000000..3b3e4b1 --- /dev/null +++ b/openbao/policies/workload-kv-read-keycape-secrets-engine-openbao-eso.hcl @@ -0,0 +1,3 @@ +path "platform/data/services/keycape/secrets-engine-openbao" { + capabilities = ["read"] +} diff --git a/workplans/RPF-WP-0035-credential-lane-implementation.md b/workplans/RPF-WP-0035-credential-lane-implementation.md index 0881c3b..ace3add 100644 --- a/workplans/RPF-WP-0035-credential-lane-implementation.md +++ b/workplans/RPF-WP-0035-credential-lane-implementation.md @@ -8,7 +8,7 @@ status: blocked flavor: implementation owner: codex created: "2026-09-05" -updated: "2026-10-03" +updated: "2026-10-04" related: - RPF-WP-0032 - RPF-WP-0033 @@ -46,8 +46,9 @@ id: RPF-WP-0035-T02 status: wait needs_human: true decision_id: 62aa95e4-3ccc-4867-8806-5e3db005b483 -blocked_on: message-from:key-cape -blocking_reason: "SECRETS-WP-0007-T04 done 2026-09-27, so that gate is open. Real blocker: live KeyCape registration of client secrets-engine-openbao and its protected client-credential custody (contract: separate approved custody action; no owning task id yet, asked key-cape 2026-10-03). The design requires both before any write; then a reviewed child and the attended founder apply." +depends_on: [KEY-WP-0037-T02, KEY-WP-0037-T03, KEY-WP-0037-T04] +blocked_on: message-from:secrets-engine +blocking_reason: "KEY-WP-0037 now owns protected custody, real registration and native issuance. Platform issuer-reader source CCR-2026-0033 is prepared. secrets-engine must accept exact consumer host/file/delivery/rotation coordinates before the separate custody child is finalized; KeyCape exact-primary identity repair and separate live go remain." priority: high state_hub_task_id: "e0c82ea9-05a5-537e-8fbf-67534263572e" ``` @@ -83,6 +84,18 @@ protected-custody owning tasks/status/revisions and non-secret receipts. Source registration is not live custody; no value fetch or live registration was requested. T02 remains waiting on the owner return and separate execution gates. +2026-10-04 blocked-task review: KeyCape returns 58826056/eb20a78c now identify +KEY-WP-0037-T02/T03/T04, replacing the unowned-registration wait with real +dependencies. Prepared proposed CCR-2026-0033 and exact-path issuer policy/auth, +sso-only ESO and evidence checklist from the returned candidate coordinates. +No issuer/consumer value, registration or native issuance is supplied by them. +secrets-engine must return independent source acceptance of consumer host/path, +protected delivery and rotation/revocation ownership; awaiting that source phase +does not depend on its full live service-login task. KeyCape's exact-primary sync +remains pending its scoped historical identity repair. Requirements and acceptance +boundaries: `docs/provisioning-windows/2026-10-04-1000/dependency-requirements.md`. +This workplan was already blocked and remains blocked on its open owner/live gates. + ## Implement the platform operator-write CCR contract and Fluid lane ```task diff --git a/workplans/RPF-WP-0050-attended-provisioning-preparation.md b/workplans/RPF-WP-0050-attended-provisioning-preparation.md index 950a92b..930c6fb 100644 --- a/workplans/RPF-WP-0050-attended-provisioning-preparation.md +++ b/workplans/RPF-WP-0050-attended-provisioning-preparation.md @@ -4,7 +4,7 @@ type: workplan title: "Prepare generated attended windows and explicit value-custody choice" domain: financials repo: railiance-platform -status: active +status: blocked owner: codex topic_slug: platform-services created: "2026-10-03" @@ -47,7 +47,7 @@ id: RPF-WP-0050-T03 status: wait priority: medium depends_on: [RPF-WP-0051-T02, RPF-WP-0035-T02, USER-WP-0035-T02] -blocking_reason: "Direct founder selection supplies the one-time date/scope. Informed-decision reader source is prepared under RPF-WP-0051; exact owner runtime/binding acceptance, KeyCape service registration/custody and provider setup-link handoff remain. Exact founder execution authorization remains separate." +blocking_reason: "Platform preparation and founder design choice are complete. Independent informed-decision runtime source/publication, KeyCape custody/registration/issuance, secrets-engine consumer custody coordinates and provider setup-link handoff remain; dependency-requirements.md names the exact owner deliveries." state_hub_task_id: "1ae5a6b8-9c83-5813-982f-ca8ad24be8b5" ``` @@ -66,6 +66,15 @@ credential provisioning to the provider password-setup-link handoff: USER-WP-003 names the actual three remaining owner acts. T03 depends on those returns rather than an already-supplied date. No applied requester/mail custody is replayed. +2026-10-04 blocked-task review: worker returns reconciled, platform issuer-reader +CCR-2026-0033/policy/auth/ESO/receipt source implemented, and actual ESO controller +TokenRequest authorization checked without minting a token. Required independent +owner phases and reopen conditions are recorded in +`docs/provisioning-windows/2026-10-04-1000/dependency-requirements.md`. +T03 stays wait; the plan is blocked because remaining progress requires receiving +repo source/registration/custody/handoff evidence. Existing date/design approvals +are retained. No source receipt is substituted for native acceptance. + ## Accept platform seam for catalog lane scaffold proposal ```task diff --git a/workplans/RPF-WP-0051-informed-decision-requester-workload-delivery.md b/workplans/RPF-WP-0051-informed-decision-requester-workload-delivery.md index 321153c..87c8a52 100644 --- a/workplans/RPF-WP-0051-informed-decision-requester-workload-delivery.md +++ b/workplans/RPF-WP-0051-informed-decision-requester-workload-delivery.md @@ -4,7 +4,7 @@ type: workplan title: "Prepare and admit informed-decision requester workload delivery" domain: financials repo: railiance-platform -status: active +status: blocked owner: codex topic_slug: platform-services created: "2026-10-04" @@ -54,7 +54,7 @@ id: RPF-WP-0051-T02 status: wait priority: high blocked_on: message-from:informed-decision -blocking_reason: "Owner must accept the proposed informed-decision-eso binding, Secret mount and actual runtime client-credentials exchange; private intake composition and native proof remain." +blocking_reason: "Binding/mount and requester exchange source accepted at informed-decision f06b7e9. Independent owner private-listener/runtime configuration, CA-verified TokenReview transport, deployment/RBAC/network proposal and immutable image/config source receipt remain; full live INFD-WP-0005-T05 completion is not a predecessor." state_hub_task_id: "dfc17e0a-9f63-5a97-b87e-13bd3a8325d6" ``` @@ -71,6 +71,19 @@ thread `f84637fa-2355-4971-a2dc-7f1fd01710a8`, reviewing source commit asks for exact binding/mount/runtime/verification ownership and remaining native evidence. Hub creation receipt is retained; owner acceptance is still outstanding. +2026-10-04 owner-return review: source binding/mount acceptance and rotating +RequesterTokenProvider/compose_intake implementation are delivered at +`eb9614c2677c7f07c9d78eee7543f95f329d2c83`; exact-primary source receipt is +`f06b7e9c53d3477f1e690ed8259f2eaab3661f91`. Replies 17bcfb39 and d304e328 +and `informed-decision/docs/requester-workload-owner-review.md` retain 37 focused +owner tests and remaining process/transport/publication gaps. Platform's explicit +SubjectAccessReview of the actual controller confirms TokenRequest permission +for the namespace without minting a token. T02 waits only on independent owner +source readiness, not its entire live task (which needs platform delivery). +Native custody/delivery acceptance remains T03. Plan moved to blocked after +completing available local preparation; concrete requirements/reopen conditions +are in this window's `dependency-requirements.md`. + ## Apply and accept the scoped workload delivery ```task