Implement issuer reader preparation and qualify blocked owner dependencies
Assistant: codex Assistant-Model: gpt-6.1-sol Assistant-Session: 01a1046b-5629-7f52-badd-f718eadb6042
This commit is contained in:
codex
parent
ecbe3b9dd5
commit
8c7c34e84b
15 changed files with 448 additions and 7 deletions
|
|
@ -0,0 +1,56 @@
|
|||
schema_version: 1
|
||||
lane_id: keycape-secrets-engine-openbao-eso
|
||||
ccr_id: CCR-2026-0033
|
||||
title: KeyCape secrets-engine-openbao issuer workload reader
|
||||
date: '2026-10-04'
|
||||
consumer_repo: key-cape
|
||||
owner_repo: railiance-platform
|
||||
requester:
|
||||
agent: key-cape
|
||||
reason: KEY-WP-0037-T02 owner packet; proposed issuer-side read of separately approved
|
||||
service client custody
|
||||
review_approvers:
|
||||
- platform-owner
|
||||
- key-cape-owner
|
||||
- net-kingdom-owner
|
||||
target:
|
||||
domain: financials
|
||||
tenant: platform
|
||||
workload: keycape
|
||||
environment: production
|
||||
purpose: Deliver separately approved secrets-engine-openbao client secret to issuer
|
||||
through sso-only ESO
|
||||
openbao:
|
||||
mount: platform
|
||||
kv_path: platform/services/keycape/secrets-engine-openbao
|
||||
fields:
|
||||
- CLIENT_SECRET
|
||||
policy_name: workload-kv-read-keycape-secrets-engine-openbao-eso
|
||||
auth:
|
||||
mount: kubernetes
|
||||
role: external-secrets-keycape-secrets-engine-openbao
|
||||
audience: openbao
|
||||
service_account_names:
|
||||
- external-secrets
|
||||
service_account_namespaces:
|
||||
- external-secrets
|
||||
ttl: 15m
|
||||
eso:
|
||||
store_name: openbao-keycape-secrets-engine-openbao
|
||||
server: http://openbao.openbao.svc:8200
|
||||
namespace: sso
|
||||
external_secret_name: keycape-secrets-engine-openbao-client
|
||||
secret_name: keycape-secrets-engine-openbao-client
|
||||
refresh_interval: 5m
|
||||
data:
|
||||
- secret_key: client-secret
|
||||
property: CLIENT_SECRET
|
||||
risk:
|
||||
classification: high
|
||||
notes:
|
||||
- Reads whole proposed path holding the secrets-engine-openbao confidential value;
|
||||
issuer and consumer copies need separate acceptance
|
||||
- Only ExternalSecrets in namespace sso may use the store; sso namespace writers
|
||||
are within this boundary
|
||||
- Issuer ESO does not deliver the separate secrets-engine consumer file or authorize
|
||||
client registration
|
||||
|
|
@ -129,3 +129,24 @@ claimed a live registration of `secrets-engine-openbao`, and its client-credenti
|
|||
custody has no owning task (KeyCape contract: "a separate approved custody
|
||||
action"). No reviewed child is written. RPF-WP-0035-T02 waits on key-cape naming
|
||||
that task.
|
||||
|
||||
## Owner return and blocked dependency contract — 2026-10-04
|
||||
|
||||
KEY-WP-0037-T02 now owns separately approved protected custody, T03 the actual
|
||||
deployment-owned registration operation, and T04 native issuance evidence.
|
||||
`key-cape/docs/secrets-engine-openbao-owner-packet.md` supplies the candidate
|
||||
issuer path and exact registration contract. Platform prepared proposed
|
||||
CCR-2026-0033 and exact-path issuer reader policy/auth/ESO/receipt artifacts;
|
||||
source generation does not allocate a value or establish registration.
|
||||
|
||||
secrets-engine must accept the actual consumer host/file owner/path, mode-0600
|
||||
delivery mechanism and rotation/revocation ownership before the bounded custody
|
||||
child is finalized. Issuer-side ESO is a separate copy. An owner source acceptance
|
||||
receipt, independent of full live service login completion, supplies this gate.
|
||||
KeyCape's current exact-primary receipt remains pending scoped repair of an
|
||||
existing grandfathered ADHOC task identity. Do not infer synchronization from
|
||||
its source contract or local managed IDs.
|
||||
|
||||
`docs/provisioning-windows/2026-10-04-1000/dependency-requirements.md` names all
|
||||
source/acceptance/reopen boundaries. RPF-WP-0035-T02 remains wait; its workplan
|
||||
is blocked on those real dependencies and separate attended execution approval.
|
||||
|
|
|
|||
40
docs/evidence/2026-10-04-blocked-task-review.json
Normal file
40
docs/evidence/2026-10-04-blocked-task-review.json
Normal file
|
|
@ -0,0 +1,40 @@
|
|||
{
|
||||
"schema": "railiance-platform.blocked-task-source-review.v1",
|
||||
"date": "2026-10-04",
|
||||
"scope": [
|
||||
"RPF-WP-0050-T03",
|
||||
"RPF-WP-0051-T02",
|
||||
"RPF-WP-0051-T03",
|
||||
"RPF-WP-0035-T02"
|
||||
],
|
||||
"local_issuer_reader_prepared": true,
|
||||
"source_validation_passed": true,
|
||||
"reader_helper_tests": 10,
|
||||
"scaffold_tests": 14,
|
||||
"window_tests": 7,
|
||||
"active_gitops_references": false,
|
||||
"workplan_states": {
|
||||
"RPF-WP-0050": "blocked",
|
||||
"RPF-WP-0051": "blocked",
|
||||
"RPF-WP-0035": "blocked"
|
||||
},
|
||||
"informed_decision_exact_primary_commit": "f06b7e9c53d3477f1e690ed8259f2eaab3661f91",
|
||||
"keycape_exact_primary_sync": "pending historical identity repair",
|
||||
"keycape_reviewed_source": "44cc067aa2c7dadffc75b631baa221a5f5caa531",
|
||||
"keycape_current_local_managed_commit": "f485d6fe9c7389b7f29d97e5da51b14eb0692eb3",
|
||||
"owner_source_phase_required_before_platform_delivery": true,
|
||||
"receiving_full_live_completion_used_as_predecessor": false,
|
||||
"credential_values_accessed": false,
|
||||
"token_minted": false,
|
||||
"production_changed": false,
|
||||
"source_sha256": {
|
||||
"credential-change-requests/CCR-2026-0033.yaml": "7090eaf6c7c5c5c084ad7433f1e77682927d81ffb6c6366d3cae19d6d8e0747d",
|
||||
"docs/credential-lane-designs/keycape-secrets-engine-openbao-issuer-input.yaml": "380a5cbb6a5be887d77e7c9aa57eda18da8a7059568b2c5143e2555ed8ab9fdb",
|
||||
"openbao/policies/workload-kv-read-keycape-secrets-engine-openbao-eso.hcl": "e2254d9ac9963922b435770e4fbf782943d43714b6a50a680add671654f245ec",
|
||||
"openbao/auth/external-secrets-keycape-secrets-engine-openbao.draft.json": "be265e829f3d025107bfe9495c01772900549ed9c1077fa12b7185c38d7e6984",
|
||||
"docs/provisioning-windows/2026-10-04-1000/keycape/eso.draft.yaml": "3940caac61ac931322606baba9f20f99a35b3a9e3243c1230921fa9b6a6fcb77",
|
||||
"docs/provisioning-windows/2026-10-04-1000/keycape/receipt-contract.json": "07299926448844d64dc0dccbabb2440e3f54792eea221a6f933129a0297a6ac2",
|
||||
"docs/provisioning-windows/2026-10-04-1000/dependency-requirements.md": "f543a64a46667f282438fb6bcf8cd6826a94c9dbaa8aa05e60082892957a8a99",
|
||||
"docs/evidence/2026-10-04-requester-eso-tokenrequest-review.json": "ce21124420ee5f6535e3172a0948bf143d566d8870e9818b160fe0aa681bfc82"
|
||||
}
|
||||
}
|
||||
|
|
@ -0,0 +1,11 @@
|
|||
{
|
||||
"cluster": "railiance01",
|
||||
"controller_serviceaccount": "external-secrets",
|
||||
"target_auth_serviceaccount": "informed-decision/informed-decision-eso",
|
||||
"namespace": "informed-decision",
|
||||
"tokenrequest_permission": true,
|
||||
"query_verified": true,
|
||||
"credential_values_accessed": false,
|
||||
"raw_errors_suppressed": true,
|
||||
"live_change": false
|
||||
}
|
||||
|
|
@ -1,5 +1,11 @@
|
|||
# Attended preparation — 4 October 2026, 10:00 Europe/Berlin
|
||||
|
||||
Current state: **blocked after available source implementation**. See
|
||||
`dependency-requirements.md` for reconciled worker receipts, exact remaining
|
||||
owner requirements and reopen conditions. Platform issuer reader CCR-2026-0033
|
||||
is drafted; actual ESO TokenRequest permission is verified without token minting.
|
||||
The historical preparation time supplies no standing live execution grant.
|
||||
|
||||
Owner: railiance-platform, RPF-WP-0050-T03. Founder instruction: “Pick lanes by
|
||||
relevance for today 10am.” This is a one-time preparation window, at 08:00 UTC,
|
||||
using the selected existing batched attended custody. No recurrence is selected.
|
||||
|
|
|
|||
|
|
@ -0,0 +1,79 @@
|
|||
# Remaining dependency requirements — 2026-10-04
|
||||
|
||||
Review scope: RPF-WP-0050-T03, RPF-WP-0051-T02/T03 and the selected
|
||||
RPF-WP-0035-T02 service-login lane. Source work is implemented where independent
|
||||
of receiving-owner facts. Both preparation workplans are blocked on the
|
||||
deliveries below. Completed design judgments are retained.
|
||||
|
||||
| Platform task | Receiving repo / owner task | Required independent delivery | Reopen condition |
|
||||
| --- | --- | --- | --- |
|
||||
| RPF-WP-0051-T02 | informed-decision / source phase of INFD-WP-0005-T05 | Process-owned private listener and explicit runtime configuration consuming compose_intake; authenticated bounded TokenReview transport using API-server CA; exact owner deploy renderer with private Service, NetworkPolicy, TokenReview RBAC and projected registries; final immutable image/config/source | Accept source composition and publication receipt, reviewed deployment proposal and named native verification/abort attendance. Do not require this owner's entire live T05 completion as a predecessor. |
|
||||
| RPF-WP-0051-T03 | informed-decision receiving runtime; founder execution gate | Complete T02 source packet, approve exact final live action, then native ESO/auth/file/exchange and revocation/rotation/cleanup receipts | Native delivery and owner runtime acceptance, after platform metadata and separately approved runtime promotion. Source proofs are already complete. |
|
||||
| RPF-WP-0035-T02 | secrets-engine / service-auth source acceptance in SECRETS-WP-0008-T06 | Explicit consumer host, protected file path and owner, mode-0600 delivery mechanism, refresh/rotation/revocation ownership and bounded validation interface | Source acceptance of those coordinates, independent of obtaining a working OpenBao service token. The entire live consumer task must not precede platform login provisioning. |
|
||||
| RPF-WP-0035-T02 | key-cape / KEY-WP-0037-T02/T03/T04; net-kingdom deployment authority | Accept proposed issuer coordinates and separate consumer delivery; reviewed single-client/env-preserving registration operation with immutable image/config; independently approved custody and actual registration/issuance receipts | Protected custody, real registration and validated provider claims are returned. Platform then performs its separately approved isolated JWT mount/role/self-policy operation and login proof. |
|
||||
| RPF-WP-0050-T03 | user-engine / USER-WP-0035-T02 and provider owner | Provider-supported single-use password-setup-link delivery contract and intended-recipient evidence; retained value-safe failure/retry behavior | Real handoff receipt. SMTP and invitation delivery already exist and are not reprovisioned. |
|
||||
|
||||
## Delivered owner work and platform checks
|
||||
|
||||
Informed-decision source acceptance: implementation
|
||||
`eb9614c2677c7f07c9d78eee7543f95f329d2c83`, exact-primary receipt
|
||||
`f06b7e9c53d3477f1e690ed8259f2eaab3661f91`. Requests/replies:
|
||||
`17bcfb39-f8c0-4cda-acce-de7af6d0afbc` and
|
||||
`d304e328-1e77-4a02-ae47-783a7290b6ce`. Its RequesterTokenProvider and
|
||||
compose_intake are implemented with 37 focused owner tests. Exact source
|
||||
binding/mount acceptance is supplied; live claims are not confirmed.
|
||||
|
||||
Platform independently verified railiance01's node address and the actual
|
||||
external-secrets controller ServiceAccount, then checked permission to create
|
||||
serviceaccounts/token in informed-decision through SubjectAccessReview.
|
||||
The explicit subresource query returned yes. Receipt:
|
||||
`docs/evidence/2026-10-04-requester-eso-tokenrequest-review.json`. This is an
|
||||
authorization check; no token was minted and it does not prove Secret delivery.
|
||||
The earlier slash-resource spelling gave a different result and is not accepted
|
||||
as the TokenRequest receipt. The explicit subresource query is authoritative.
|
||||
|
||||
KeyCape source packet: `44cc067aa2c7dadffc75b631baa221a5f5caa531`;
|
||||
managed IDs/index locally at `f485d6fe9c7389b7f29d97e5da51b14eb0692eb3`.
|
||||
Replies `58826056-55f2-4300-9b42-05ceeec9c26a` and
|
||||
`eb20a78c-0b9b-41e6-b349-dfaa9873633b` name the real owner tasks. Its latest
|
||||
exact-primary sync is pending: Repo Manager refused grandfathered
|
||||
ADHOC-2026-09-27-T02 without UUID. KeyCape/repo-manager must reconcile the
|
||||
source identity through the required scoped decision, then return an applied/noop
|
||||
receipt for the actual current commit. Platform does not invent UUIDs or bypass
|
||||
the refusal. This is separate from actual provider registration/custody.
|
||||
|
||||
## Implemented platform issuer-reader preparation
|
||||
|
||||
The KeyCape packet's candidate path is accepted here for proposed source review:
|
||||
`platform/services/keycape/secrets-engine-openbao`, field CLIENT_SECRET.
|
||||
Proposed CCR-2026-0033 and input
|
||||
`docs/credential-lane-designs/keycape-secrets-engine-openbao-issuer-input.yaml`
|
||||
declare only the issuer reader. Policy
|
||||
`workload-kv-read-keycape-secrets-engine-openbao-eso` reads exactly that data path.
|
||||
Role `external-secrets-keycape-secrets-engine-openbao` binds the existing
|
||||
external-secrets/external-secrets identity, audience openbao, 15-minute
|
||||
TTL/max/explicit max and no default policy. The proposed store admits only sso;
|
||||
target Secret keycape-secrets-engine-openbao-client projects client-secret.
|
||||
Target annotations are explicit. Auth payload, ESO and receipt checklist are
|
||||
prepared under this window's `keycape/` directory and outside active GitOps.
|
||||
|
||||
CCR-2026-0033 is proposed, claims unconfirmed and frontdoor unresolvable.
|
||||
No value exists by implication of this draft. The service client custody child
|
||||
cannot be finalized before the secrets-engine consumer coordinates are accepted:
|
||||
issuer-side ESO does not supply a host/path/mechanism for the consumer copy.
|
||||
No guessed runtime directory, automatic token seed or live registration is added.
|
||||
|
||||
## Dependency boundary
|
||||
|
||||
Owner source readiness precedes platform promotion. Platform native delivery
|
||||
proof follows its own authorized apply, and receiving live acceptance follows
|
||||
that delivery. Requiring a receiving repo's full live completion before platform
|
||||
supplies its credential would create a mutual wait. Where an owner composite
|
||||
task includes both phases, the wait is qualified as `message-from:<owner>` for
|
||||
the exact independent source receipt until that owner names a separate source
|
||||
task; no fabricated task ID or complete-task dependency is introduced.
|
||||
|
||||
Once source deliveries arrive, reopen only the affected platform task. The
|
||||
founder-approved informed-decision design needs no repeat decision unless scope
|
||||
changes. Live actions still require a fresh reviewed execution packet and go;
|
||||
the historical 10:00 preparation window is not a standing execution grant.
|
||||
|
|
@ -0,0 +1,54 @@
|
|||
# DRAFT REVIEW ARTIFACT. Do not apply. No custody/admission supplied.
|
||||
apiVersion: external-secrets.io/v1
|
||||
kind: ClusterSecretStore
|
||||
metadata:
|
||||
name: openbao-keycape-secrets-engine-openbao
|
||||
annotations:
|
||||
railiance.io/credential-change: CCR-2026-0033
|
||||
railiance.io/admission: pending-review
|
||||
spec:
|
||||
provider:
|
||||
vault:
|
||||
server: http://openbao.openbao.svc:8200
|
||||
path: platform
|
||||
version: v2
|
||||
auth:
|
||||
kubernetes:
|
||||
mountPath: kubernetes
|
||||
role: external-secrets-keycape-secrets-engine-openbao
|
||||
audiences:
|
||||
- openbao
|
||||
serviceAccountRef:
|
||||
name: external-secrets
|
||||
namespace: external-secrets
|
||||
conditions:
|
||||
- namespaces:
|
||||
- sso
|
||||
---
|
||||
apiVersion: external-secrets.io/v1
|
||||
kind: ExternalSecret
|
||||
metadata:
|
||||
name: keycape-secrets-engine-openbao-client
|
||||
namespace: sso
|
||||
annotations:
|
||||
railiance.io/credential-change: CCR-2026-0033
|
||||
railiance.io/admission: pending-review
|
||||
spec:
|
||||
refreshInterval: 5m
|
||||
secretStoreRef:
|
||||
kind: ClusterSecretStore
|
||||
name: openbao-keycape-secrets-engine-openbao
|
||||
target:
|
||||
name: keycape-secrets-engine-openbao-client
|
||||
creationPolicy: Owner
|
||||
deletionPolicy: Retain
|
||||
template:
|
||||
metadata:
|
||||
annotations:
|
||||
railiance.io/credential-change: CCR-2026-0033
|
||||
railiance.io/admission: pending-review
|
||||
data:
|
||||
- secretKey: client-secret
|
||||
remoteRef:
|
||||
key: services/keycape/secrets-engine-openbao
|
||||
property: CLIENT_SECRET
|
||||
|
|
@ -0,0 +1,16 @@
|
|||
{
|
||||
"schema_version": 1,
|
||||
"lane_id": "keycape-secrets-engine-openbao-eso",
|
||||
"ccr_id": "CCR-2026-0033",
|
||||
"status": "not-executed",
|
||||
"draft_only": true,
|
||||
"verified": false,
|
||||
"request_sha256": "380a5cbb6a5be887d77e7c9aa57eda18da8a7059568b2c5143e2555ed8ab9fdb",
|
||||
"required_owner_checks": [
|
||||
"Exact revision/digest and required owner reviews",
|
||||
"Identity/auth claims confirmed separately; no inferred workload identity",
|
||||
"Metadata/capability readback through reviewed output-suppressing owner tool",
|
||||
"No Secret bodies, values or raw subprocess errors in evidence",
|
||||
"Native scoped positive/negative, cleanup/revocation and rollback receipts after approval"
|
||||
]
|
||||
}
|
||||
|
|
@ -12,6 +12,13 @@ thread `f84637fa-2355-4971-a2dc-7f1fd01710a8` and reviewed platform commit
|
|||
remains outstanding. The user-engine/provider item below remains a prepared
|
||||
source request, outside this two-message authorization.
|
||||
|
||||
Owner responses are now received and reconciled in `dependency-requirements.md`:
|
||||
informed-decision 17bcfb39/d304e328 deliver source binding/mount and requester
|
||||
implementation; key-cape 58826056/eb20a78c name KEY-WP-0037's custody/registration
|
||||
phases. The remaining exact source requirements are recorded there. Platform
|
||||
issuer-reader draft CCR-2026-0033 is implemented; the client-side custody
|
||||
coordinates and receiving runtime/publication remain external deliveries.
|
||||
|
||||
## secrets-engine / KeyCape — RPF-WP-0035-T02
|
||||
|
||||
Platform already has exact proposed files `openbao/auth/keycape-services-config.json`,
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue