Prepare proposed KEY39 coding client custody admission
Assistant: codex Assistant-Model: gpt-6.1-sol Assistant-Session: 01a126e1-76f8-7643-8cf3-e93336539ade
This commit is contained in:
codex
parent
5ae70642a7
commit
9460f6f200
3 changed files with 169 additions and 1 deletions
|
|
@ -56,7 +56,7 @@ coordinates:
|
|||
| `aud` / client id | `codex-railiance-platform` |
|
||||
| `sub` | `service:codex:railiance-platform` |
|
||||
| `principal_type` | `service` |
|
||||
| `tenant` | `tenant:coulomb` |
|
||||
| `tenant` | `tenant:platform` |
|
||||
| `roles` | contains `coding-agent` |
|
||||
| requested scope | `openbao:login` |
|
||||
|
||||
|
|
@ -115,3 +115,16 @@ check. Revoke the issued OpenBao token if it remains live.
|
|||
differs from the reviewed body or its verifier fails.
|
||||
- Revoke the test OpenBao token, disable the KeyCape client, and rotate its
|
||||
confidential secret after suspected disclosure.
|
||||
|
||||
|
||||
## Source clarification — 2026-10-11
|
||||
|
||||
The tenant table now follows current `coding-agent-jwt-role.json`, KeyCape
|
||||
`config/service-clients.example.yaml` and the 2026-09-27 Platform tenant review.
|
||||
This correction grants no additional policy or custody access. Historical
|
||||
AppRole verification and earlier migration examples above do not establish
|
||||
current named coding-client registration, confidential-secret delivery or a
|
||||
KEY39 producer admission. The source-only candidate in
|
||||
`proposals/2026-10-11-key39-coding-client-custody-proposal.json` is not an installed
|
||||
CCR, grant, catalogue entry or credential request. Follow its separate owner
|
||||
and founder prerequisites before any client-secret retrieval or JWT exchange.
|
||||
|
|
|
|||
|
|
@ -0,0 +1,128 @@
|
|||
{
|
||||
"schema": "platform-key39-coding-client-custody-proposal/v1",
|
||||
"status": "proposed_source_only",
|
||||
"formal_owner_agreement": false,
|
||||
"native_authorized": false,
|
||||
"credential_access_authorized": false,
|
||||
"source_pins": [
|
||||
{
|
||||
"path": "/home/worsch/railiance-platform/AGENTS.md",
|
||||
"sha256": "8d2f1a165e3f4eecf2e6e1d6a19c4bac9e8dcb64a76650e7185d55722f233c8b"
|
||||
},
|
||||
{
|
||||
"path": "/home/worsch/railiance-platform/INTENT.md",
|
||||
"sha256": "12c6540735af591f7a4a9fe85ff10d3cd00eec55b5b6b1ddf148abf2d3ac9a9c"
|
||||
},
|
||||
{
|
||||
"path": "/home/worsch/railiance-platform/openbao/auth/coding-agent-jwt-role.json",
|
||||
"sha256": "c72e836ab72713a49aa8fb84faa26e824ff1263b5a184600fca0c0284720ee3b"
|
||||
},
|
||||
{
|
||||
"path": "/home/worsch/railiance-platform/openbao/policies/agent-high-risk-boundary.hcl",
|
||||
"sha256": "ca3f27d8c099011ca44498ba1f50dea3eb6063c4a3bbbf9130e6881dd4e972f5"
|
||||
},
|
||||
{
|
||||
"path": "/home/worsch/railiance-platform/openbao/policies/workload-kv-read-issue-core-runtime.hcl",
|
||||
"sha256": "54b9f864f3435910143a860352aac5ecb3aa2cd7afb5e161bb304c12d821c55e"
|
||||
},
|
||||
{
|
||||
"path": "/home/worsch/railiance-platform/docs/platform-tenant-essentials-review.md",
|
||||
"sha256": "0b023c7a1bd58b1fac9b7ae746645dcf80fd3e5224c8399447fb90acbaba5c5c"
|
||||
},
|
||||
{
|
||||
"path": "/home/worsch/key-cape/config/service-clients.example.yaml",
|
||||
"sha256": "b7e17698a0946f387c481b7e27fe9ddea22cdd9db2e34e32a50457e02a34b18e"
|
||||
},
|
||||
{
|
||||
"path": "/home/worsch/key-cape/src/internal/authclient/cli.go",
|
||||
"sha256": "376a8e0d1d60825a8b3ef21d371e3fc353c0a34e461712a6899e264278edbe7f"
|
||||
},
|
||||
{
|
||||
"path": "/home/worsch/key-cape/src/internal/authclient/client.go",
|
||||
"sha256": "61fb150349c5d3714450a90834c59af9a579a8a649c4149297a402cfcf6e39c5"
|
||||
},
|
||||
{
|
||||
"path": "/home/worsch/key-cape/docs/proposals/2026-10-11-key39-next-execution-prerequisites.json",
|
||||
"sha256": "78288f6991910715b7ee8fdb2a32654418dd9becd5fccd254bab8d150420cfd3"
|
||||
},
|
||||
{
|
||||
"path": "/home/worsch/net-kingdom/sso-mfa/k8s/keycape/deployment.yaml",
|
||||
"sha256": "b21c04841245263861273133ac8bde06653deb88be3afef9596ed2fba9db631b"
|
||||
},
|
||||
{
|
||||
"path": "/home/worsch/ops-warden/registry/routing/catalog.yaml",
|
||||
"sha256": "09ee40df21b0ad8cad420be4613afcb1731967f68128631a94f9b96f3f31b318"
|
||||
}
|
||||
],
|
||||
"identity": {
|
||||
"issuer": "https://kc.coulomb.social",
|
||||
"client_id": "codex-railiance-platform",
|
||||
"audience": "codex-railiance-platform",
|
||||
"subject": "service:codex:railiance-platform",
|
||||
"tenant": "tenant:platform",
|
||||
"principal_type": "service",
|
||||
"roles": [
|
||||
"coding-agent"
|
||||
],
|
||||
"scope": "openbao:login",
|
||||
"max_lifetime_seconds": 900,
|
||||
"issuer_env_reference": "KEYCAPE_CODEX_RAILIANCE_PLATFORM_CLIENT_SECRET"
|
||||
},
|
||||
"existing_role": {
|
||||
"path": "auth/netkingdom/role/coding-agent",
|
||||
"policies": [
|
||||
"agent-high-risk-boundary",
|
||||
"workload-kv-read-issue-core-runtime"
|
||||
],
|
||||
"ttl_seconds": 900,
|
||||
"max_uses": 8,
|
||||
"no_default_policy": true,
|
||||
"source_is_not_native_observation": true
|
||||
},
|
||||
"proposed_coordinates": {
|
||||
"binding_status": "new_candidate_not_admitted_or_observed",
|
||||
"kv_mount": "platform",
|
||||
"kv_path": "workloads/keycape/codex-railiance-platform",
|
||||
"field": "CLIENT_SECRET",
|
||||
"issuer_namespace": "sso",
|
||||
"issuer_secret_name": "keycape-codex-railiance-platform-client",
|
||||
"issuer_secret_key": "client-secret",
|
||||
"issuer_serviceaccount_candidate": "keycape-codex-client-eso",
|
||||
"coding_secret_direct_delivery_to_agent": false,
|
||||
"founder_delivery": "separate exact attended one-use private custody-to-service-token invocation; only verified coding JWT JSON participates in reviewed KEY39 paired handoff"
|
||||
},
|
||||
"source_observations": {
|
||||
"deployment_has_named_env_reference": false,
|
||||
"exact_named_CCR_grant_catalog_receipt_found_in_bounded_search": false,
|
||||
"current_live_client_registration_proven": false,
|
||||
"current_custody_version_proven": false,
|
||||
"current_issuer_matching_version_proven": false,
|
||||
"current_delivery_host_profile_admitted": false,
|
||||
"new_CCR_assigned": false
|
||||
},
|
||||
"missing_admission_gates": [
|
||||
"Platform exact CCR/grant/catalogue and approved source revision for named client; no reuse of CCR0040 browser generation",
|
||||
"Net issuer registration and exact env Secret reference; live value-free matched-version projection",
|
||||
"Net dedicated namespace SecretStore/ExternalSecret serviceaccount, TokenRequest RBAC, issuer controller and Argo readiness ownership",
|
||||
"Platform exact founder custody-reader role/capability denial and token budget/cleanup; no standing coding-role read grant",
|
||||
"Founder host/process isolation from coding runtime, exact session/cert profile, continuous exclusive tmpfs and private environment/file custody",
|
||||
"Key exact verified claim producer including all identity coordinates and finite lifetime; existing CLI alone does not bind subject/tenant/type/roles/max900",
|
||||
"Fresh authenticated founder native revision and production maintenance exception when required",
|
||||
"Actual node route/role/plugin and all effective leeway observation, negative refusal correlation, known-token revoke and unknown recovery"
|
||||
],
|
||||
"candidate_value_free_receipt_fields": [
|
||||
"source_revision",
|
||||
"CCR_id_and_digest",
|
||||
"grant_id_and_digest",
|
||||
"catalogue_id_and_digest",
|
||||
"issuer_client_projection_digest",
|
||||
"issuer_Secret_UID_resourceVersion_key_name_only",
|
||||
"custody_logical_path_and_version_only",
|
||||
"matched_version_attestation_no_value_or_secret_hash",
|
||||
"ESO_role_ServiceAccount_namespace_UID_audience_policy_digests",
|
||||
"founder_host_profile_process_isolation_attestation",
|
||||
"exact_execution_envelope_digest",
|
||||
"cleanup_status_and_unknown_effects"
|
||||
],
|
||||
"standing_doc_correction": "tenant:coulomb -> tenant:platform only; dated historical proof unchanged"
|
||||
}
|
||||
|
|
@ -92,3 +92,30 @@ full ExecutionContract matching with authoritative grant/baseline/estate/deadlin
|
|||
journal dispatch, restricted native adapter, token custody/revoke/cleanup and
|
||||
owner-private unknown recovery are not implemented by this component. No native,
|
||||
credential, Secret read, API access, owner checkout write or full adoption claim.
|
||||
|
||||
|
||||
## Complete bounded KEY39 coding-client custody source inspection and proposal preparation
|
||||
|
||||
```task
|
||||
id: RPF-WP-ADHOC-2026-10-11-T03
|
||||
status: done
|
||||
priority: low
|
||||
```
|
||||
|
||||
2026-10-11: completed bounded public-source inspection and proposed owner
|
||||
projection for existing KEY39/RPF35 dependency. Key client source and Platform
|
||||
JWT-role source agree on codex-railiance-platform, service:codex:railiance-platform
|
||||
and tenant:platform; standing identity table still says tenant:coulomb. Checked
|
||||
Deployment source has no named coding-client env reference. Scoped CCR/grant/
|
||||
routing source search found no exact named admission receipt; this does not
|
||||
assert live absence. Warden route lookup returned unrelated pointers then its
|
||||
local memory append refused read-only filesystem; no credential request/fetch.
|
||||
Prepared explicitly NEW CANDIDATE custody/issuer/founder delivery coordinates,
|
||||
existing-policy pins and exact missing owner/value-free receipt gates. No CCR
|
||||
number or runtime binding invented. Existing CLI validates signature/issuer/
|
||||
audience/expiry/requested scope but not exact coding subject/tenant/type/roles
|
||||
or 900-second maximum: additional reviewed producer verification remains needed.
|
||||
This bounded source preparation is completed before any formal owner agreement;
|
||||
root must persist this record before that entry. Parent KEY39 native and RPF35
|
||||
owner gates remain unchanged. No residual promotion, source policy widening,
|
||||
Secret contents, credential/native call, owner checkout write or native grant.
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue