diff --git a/credential-change-requests/CCR-2026-0062-mas-backup-primary.yaml b/credential-change-requests/CCR-2026-0062-mas-backup-primary.yaml index b36086f..f9e80d7 100644 --- a/credential-change-requests/CCR-2026-0062-mas-backup-primary.yaml +++ b/credential-change-requests/CCR-2026-0062-mas-backup-primary.yaml @@ -6,7 +6,7 @@ "title": "MAS evidence archive node-delivery reader", "status": "applied", "created": "2026-11-02", - "updated": "2026-11-02", + "updated": "2026-11-03", "requester": { "agent": "grok", "reason": "Founder asked to prepare the MAS prefix publisher under RPF-WP-0070. Preparation is not a live grant." @@ -93,17 +93,17 @@ "directory_mode": "0700", "procedure": "scripts/application_backup_credentials.py", "admission": { - "node_executor_approved": false, - "provider_scope_verified": false, - "reader_boundary_verified": false, - "source_ref": "" + "node_executor_approved": true, + "provider_scope_verified": true, + "reader_boundary_verified": true, + "source_ref": "founder-node-admission-2026-11-03" } }, "provider": { "endpoint": "https://s3.nl-ams.scw.cloud", "bucket": "railiance-platform-pg-backup", "prefix": "platform-pg/application-archives/mas/", - "identity": "IAM application mas-evidence-backup-primary 25a4cbca-220e-40c0-9af5-6c7713000174; founder stored the API key at platform/suppliers/scaleway/mas-evidence-backup-primary, preferred project mail-address-semantics; this workload path has no pair; bucket policy source allows only platform-pg/application-archives/mas/ and withholds object delete", + "identity": "IAM application mas-evidence-backup-primary 25a4cbca-220e-40c0-9af5-6c7713000174. The founder holds the supplier key at platform/suppliers/scaleway/mas-evidence-backup-primary. The workload pair is a separately minted second key, preferred project reef-storage, stored CAS=0 at version 1. The bucket policy allows only platform-pg/application-archives/mas/ and withholds object delete.", "retained_delete": false }, "risk": { @@ -149,6 +149,35 @@ "ops-mason custody row and ops-warden catalog id scaleway-mas-evidence-backup-primary record that path. The value was not read. The workload pair remains empty and delivery admission stays false.", "Metadata read of that path with the local token returned HTTP 403, so the version was not confirmed from this workstation." ] + }, + { + "at": "2026-11-03T04:45:02Z", + "actor": "claude-code", + "kind": "pair_provision_and_provider_scope", + "result": "passed", + "details": [ + "The attended gate minted a second key on the MAS application, without reading or copying the supplier key, and wrote it CAS=0 at platform/workloads/mas/backup-primary version 1.", + "Provider proof with that key: MAS prefix list HTTP 200; sibling prefix, retained delete, and bucket administration HTTP 403 AccessDenied. Receipt docs/evidence/mas-evidence-workload-pair-2026-11-03.json." + ] + }, + { + "at": "2026-11-03T04:51:03Z", + "actor": "claude-code", + "kind": "reader_boundary", + "result": "passed", + "details": [ + "Live mas/backup-primary-delivery login with audience openbao held only workload-kv-read-mas-backup-primary, lease 300, explicit max 300, period 0, no identity policy, and read KV version 1 with exactly the two fields.", + "A wrong audience and a foreign role could not log in. Sibling data (two applications), metadata GET, parent LIST, KV write, and sys/policies/acl returned 403. All tokens were revoked. Receipt docs/evidence/mas-backup-reader-boundary-2026-11-03.json." + ] + }, + { + "at": "2026-11-03T04:55:00Z", + "actor": "User (platform-owner)", + "kind": "node_execution_admission", + "result": "approved", + "details": [ + "Founder approved node execution for this delivery in an attended session. source_ref founder-node-admission-2026-11-03." + ] } ], "activation_conditions": [ @@ -166,7 +195,7 @@ }, "state_hub": { "workplan_id": "RPF-WP-0070", - "task_id": "RPF-WP-0070-T01" + "task_id": "RPF-WP-0070-T02" }, "related": { "workplan": "RPF-WP-0070", diff --git a/docs/evidence/mas-backup-reader-boundary-2026-11-03.json b/docs/evidence/mas-backup-reader-boundary-2026-11-03.json new file mode 100644 index 0000000..4ec53ac --- /dev/null +++ b/docs/evidence/mas-backup-reader-boundary-2026-11-03.json @@ -0,0 +1,56 @@ +{ + "application": "mas", + "checked_at": "2026-11-03T04:51:03.273085+00:00", + "cluster_uid": "a553c742-0115-43d4-99a4-a5ca56fe0786", + "expected_kv_version": 1, + "jwt_binding": true, + "kv_path": "platform/data/workloads/mas/backup-primary", + "negative": { + "admin_policy_list": 403, + "foreign_role_login": 403, + "kv_write": 403, + "metadata_read": 403, + "parent_list": 403, + "passed": true, + "second_sibling_data_read": 403, + "sibling_data_read": 403, + "tokens_revoked": true, + "wrong_audience_login": 403 + }, + "passed": true, + "policy": "workload-kv-read-mas-backup-primary", + "positive": { + "encoding_ok": true, + "field_names": [ + "AWS_ACCESS_KEY_ID", + "AWS_SECRET_ACCESS_KEY" + ], + "fields_distinct": true, + "kv_deleted": false, + "kv_destroyed": false, + "kv_version": 1, + "lease_duration": 300, + "login_policies": [ + "workload-kv-read-mas-backup-primary" + ], + "login_status": 200, + "passed": true, + "read_status": 200, + "token": { + "explicit_max_ttl": 300, + "identity_policies": [], + "num_uses": 3, + "period": 0, + "policies": [ + "workload-kv-read-mas-backup-primary" + ], + "ttl": 300 + }, + "token_revoked": true + }, + "role": "mas-backup-primary-workload-kv-read", + "runner": "attended: founder ran scripts/backup_reader_boundary_probe.py (d41c5ac) as root on railiance01", + "schema": "platform.backup-reader-boundary.v1", + "service_account": "mas/backup-primary-delivery", + "values_recorded": false +} diff --git a/workplans/RPF-WP-0070-mas-evidence-recovery.md b/workplans/RPF-WP-0070-mas-evidence-recovery.md index ab28c5b..69622af 100644 --- a/workplans/RPF-WP-0070-mas-evidence-recovery.md +++ b/workplans/RPF-WP-0070-mas-evidence-recovery.md @@ -144,7 +144,7 @@ status: progress priority: medium needs_human: true depends_on: [RPF-WP-0070-T01] -intervention_note: "Founder approved node execution for CCR-2026-0062 on 2026-11-03. Next: run scripts/backup_reader_boundary_probe.py --application mas --expected-kv-version 1 as root on railiance01 and record the receipt. Then set the admission flags, export the CCR and pin its SHA256, and run the node delivery." +intervention_note: "Admission set 2026-11-03; admitted CCR export SHA256 16dbfe197b6f42e24bcd7d23e81e5d699ec7d3eb17e7a5177415e5d757a1a372. Next: attended root run of scripts/application_backup_credentials.py --application mas --expected-kv-version 1 --execute on railiance01, then record the metadata receipt." state_hub_task_id: "c8a9ba31-9fb6-5412-90b7-dea658943053" ``` @@ -168,6 +168,20 @@ parent LIST, a KV write, and `sys/policies/acl`. The write probe uses CAS=0 on the existing path, so it cannot replace the pair. Every token is revoked, and the receipt holds statuses and names only. +2026-11-03 04:51Z: the founder ran the probe on railiance01, and it +passed. KV version 1 was readable with exactly the two fields under the +single reader policy (lease 300, explicit max 300, period 0, no identity +policy). All eight denials returned 403, and every token was revoked. +Receipt: `docs/evidence/mas-backup-reader-boundary-2026-11-03.json`. +CCR-2026-0062 delivery admission is now `node_executor_approved`, +`provider_scope_verified` and `reader_boundary_verified`, with source_ref +`founder-node-admission-2026-11-03`. The admitted export from +`scripts/render_backup_credential_contract.py` has SHA256 +`16dbfe197b6f42e24bcd7d23e81e5d699ec7d3eb17e7a5177415e5d757a1a372`. It +passes the delivery helper's execute-mode contract check. The delivery +helper source is `b4a9622f2afe122b3aadbb7d2a818b8b7a92d248f2c9d6a9105460f452b2872e`. +`/etc/mas-backup` does not exist on the node yet. + ## Install the worker and publish the first offsite copy ```task