Establish attended telemetry Grafana custody and record private activation

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a06ecb-456a-71c2-b41e-0755d336e883

docs/credential-lane-designs/telemetry-grafana.md

@@ -0,0 +1,44 @@
+# Grafana administrator custody
+
+This is the attended bootstrap lane for rapp-telemetry on railiance01, not a
+coding-agent credential vending interface or an accepted operator OIDC design.
+User authorized service activation on September 6, 2026.
+
+- KV: platform/workloads/telemetry/grafana-admin; ADMIN_USERNAME and ADMIN_PASSWORD.
+- ESO identity: telemetry/telemetry-grafana-eso, automount disabled.
+- Kubernetes auth role: telemetry-grafana-eso; policy telemetry-grafana-admin-eso.
+- Exact data-only read, self-lookup/revoke, audience openbao, 15-minute maximum;
+  no default policy, wildcard namespace, sibling grant or secret write.
+- ClusterSecretStore openbao-telemetry-grafana restricts consumers to telemetry;
+  ExternalSecret telemetry-grafana-admin refreshes every 5 minutes and retains
+  the delivered Secret. Grafana references admin-user and admin-password.
+- Coding-agent high-risk boundary denies both data and metadata, including when
+  combined with the ESO read policy. Cluster administration/ESO remain trusted.
+
+Source manifests belong to ../rapp-telemetry/manifests/. The platform writer
+scripts/telemetry_grafana_custody.py uses CAS zero, refuses existing role/policy
+or credential shape drift, preserves existing boundary policy text, and checks
+positive and negative login/access before verifying ESO delivery. Run only under
+scripts/openbao-attended-exec.py after warden route show
+openbao-platform-admin-login. A unique --receipt path is required; receipts contain
+metadata only. The bootstrap does not rotate existing credentials.
+
+scripts/telemetry_grafana_access.py checks anonymous and forged proxy-header
+denials, positive native-admin API access, datasource and dashboards inside the
+same attended envelope. It requires an operator-created localhost-only port
+forward on 13001 to the known Grafana service. Do not substitute an untrusted
+endpoint. It emits only a metadata receipt and never logs passwords or headers.
+
+Rotation must update the existing Grafana database administrator credential as
+well as OpenBao; changing ESO/environment alone does not reset an initialized
+Grafana admin password. Coordinate and test old-login rejection/new-login success
+before calling rotation complete. Disable the ESO role to revoke future delivery
+but remember the existing Kubernetes Secret and application password persist;
+revoke application access and remove the binding deliberately in a compromise.
+Do not delete retained recovery material as an implicit rollback.
+
+Accepted September 6 evidence: exact read and delivery match; wrong identity,
+namespace and audience denied; sibling/write denied; coding-agent deny wins;
+native login succeeds; anonymous/proxy-header requests denied. See
+../rapp-telemetry/evidence/live/2026-09-06-railiance01.json. Independent backup and
+isolated restore, operator OIDC and public production admission remain open.

docs/evidence/telemetry-grafana-access-2026-09-06.json

@@ -0,0 +1,9 @@
+{
+  "schema": "rapp-telemetry.access.v1",
+  "status": "verified",
+  "anonymous_denied": true,
+  "forged_proxy_denied": true,
+  "native_admin_authenticated": true,
+  "prometheus_datasource_present": true,
+  "dashboard_count": 20
+}

docs/evidence/telemetry-grafana-custody-2026-09-06.json

@@ -0,0 +1,14 @@
+{
+  "schema": "rapp-telemetry.custody.v1",
+  "status": "verified",
+  "coding_agent_deny_wins": true,
+  "exact_read": true,
+  "secret_write_and_sibling_denied": true,
+  "wrong_sa_denied": true,
+  "wrong_namespace_denied": true,
+  "wrong_audience_denied": true,
+  "bounded_ttl": true,
+  "kv_version": 1,
+  "custody": "platform/workloads/telemetry/grafana-admin",
+  "delivery_matches": true
+}