Add attended signer adapter with phase-aware read-only recovery

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a140c4-354a-7823-8f0d-8f717397f786

credential-change-requests/CCR-2026-0050-flex-auth-envelope-signing.yaml

@@ -0,0 +1,128 @@
+id: CCR-2026-0050
+kind: credential-change-request
+schema_version: 1
+request_type: workload-kv-read
+title: Retained flex-auth lifecycle PDP Ed25519 seed ESO read lane
+status: proposed
+created: '2026-10-16'
+updated: '2026-10-16'
+requester:
+  agent: railiance-platform
+  reason: CUST-WP-0080 / RPF-WP-0035-T12 / FLEX-WP-0024-T06 source proposal. Exact
+    new custody/read scope requires founder review; no approval or native binding
+    is inferred.
+review:
+  required: true
+  required_approvers:
+  - founder
+  - railiance-platform-owner
+  - access-engine-owner
+  - secrets-engine-owner
+  - cluster-gitops-owner
+  comments: []
+target:
+  domain: infotech
+  tenant: platform
+  workload: flex-auth-secrets-engine
+  environment: production
+  purpose: Deliver the Ed25519 seed only to the retained lifecycle PDP startup file.
+    No taskpilot enablement, caller policy changes or private consumer trust discovery.
+openbao:
+  mount: platform
+  kv_path: platform/workloads/flex-auth/envelope-signing
+  fields:
+  - ED25519_PRIVATE_KEY
+  metadata_read: false
+  token_self_lifecycle: true
+  policy_name: workload-kv-read-flex-auth-envelope-signing
+  policy_file: openbao/policies/workload-kv-read-flex-auth-envelope-signing.hcl
+  auth:
+    method: kubernetes
+    mount: kubernetes
+    role: external-secrets-flex-auth-envelope-signing
+    bound_claims:
+      service_account_names:
+      - flex-auth-envelope-signing-eso
+      service_account_namespaces:
+      - flex-auth
+    bound_claims_confirmed: false
+    policies:
+    - workload-kv-read-flex-auth-envelope-signing
+    ttl: 15m
+    audience: openbao
+    token_max_ttl: 15m
+    token_explicit_max_ttl: 15m
+    token_no_default_policy: true
+access_frontdoor:
+  type: external-secrets
+  catalog_id: flex-auth-decision-envelope-signing-key
+  selector: Retained flex-auth/flex-auth-secrets-engine signer only
+  readiness: pending-review
+  resolvable: false
+delivery:
+  surface: external-secrets
+  target: Namespace flex-auth; dedicated SA flex-auth-envelope-signing-eso; SecretStore
+    openbao-flex-auth-envelope-signing; ExternalSecret/Secret flex-auth-secrets-engine-envelope-signing;
+    seed property only -> startup file /var/run/secrets/decision-envelope-signing/seed0440,
+    readOnly uid/gid/fsGroup65532; no envFrom
+  bootstrap_command: Attended writer is a distinct exact-source action proposal in
+    docs/credential-lane-designs/flex-auth-envelope-signing-native-plan.json; this
+    read CCR authorizes neither seed writes nor any execution by itself.
+risk:
+  classification: high
+  notes:
+  - Possession of seed can forge lifecycle PDP envelopes; independent consumer public
+    trust admission and fixed policy pins remain required.
+  - 'KV read is document-granular: dedicated ESO identity can read all three fields;
+    only private field is projected. Signer and Secrets consumer have no KV read role.'
+  - No parent/list/metadata/write/delete capability on ESO role. No token/Secret read
+    or ExternalSecret mutation granted to signer/consumer.
+  - Dedicated role is new scope; founder approval required. No workload rapp tuple
+    invented; absent managed package declaration remains explicit migration debt.
+  - Controlled outage fence stops every signer pod and disables autoscaling before
+    creation/rotation. Recreate single writer and retained PVC remain Access-owned
+    review gates.
+  - fields declares only projected ED25519_PRIVATE_KEY. The same KV document also
+    has public key/kid, and OpenBao data-read is not field-filtered; do not claim
+    field-level authorization.
+verification:
+  positive:
+  - Exact SA/namespace/audience login; native exact data read; ESO Ready/SecretSynced;
+    safe metadata resourceVersion and admitted KV version correspondence.
+  - All retained signer replicas restart with admitted kid/source/image and seed/public
+    correspondence; signed non-effect lifecycle allow/deny with durable originals
+    and independent consumer signature verification.
+  negative:
+  - Wrong SA/namespace/audience login refused; sibling/list/metadata/write/delete
+    denied; signer/consumer TokenRequest and Secret/ExternalSecret mutation denied.
+  - Unknown/old kid, wrong policy, tamper, expired/unsigned envelope, wrong caller
+    and missing seed refuse; no taskpilot activation.
+  - Receipt write failure/lost backend response retained unknown; no blind retry/remint;
+    stale CAS cannot overwrite version.
+  activation_conditions:
+  - All five required approvers independently dispose the exact CCR and native writer/fence
+    proposal; founder exact new custody scope approved.
+  - Current retained identity919ce25, immutable published producer image and explicit
+    new flex-auth-secrets-engine-outbox PVC1Gi/local-path, retention/reclaim and bounded-runtime
+    plan reviewed by Access; missing managed package migration debt explicitly accepted
+    for this retained workload only.
+  - Exact native bound claims verified without printing JWT/Secret; read grant policy
+    and role native readback match source.
+  - Protected child source pinned, silent attended OIDC context verified, target cluster/backend
+    pinned, fence verified and durable receipt custody installed.
+  - Consumer independently admits owner-authenticated public receipt and exact policy/image/trust
+    pins before protected acceptance.
+  evidence: []
+lifecycle:
+  deactivate: Fence all retained signer processes, stop consumers, disable delivery
+    role/ESO and online trust; retain private KV and audit receipts under explicit
+    owner retention until reviewed destruction.
+  rotate: Pre-admit successor public receipt offline; fence consumers/all signer replicas/no
+    HPA; CAS exact version with new in-memory seed; wait exact ESO version, restart
+    single writer, verify native allow/deny and old-key refusal before reopening.
+  compromised: Immediately remove old online trust and stop all signer processes;
+    forward-only CAS recovery with independently approved successor. Never restore
+    compromised seed; archive historical public keys for offline audit only.
+state_hub:
+  workplan_id: RPF-WP-0035
+  task_id: RPF-WP-0035-T12