coulomb/railiance-platform
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

RPF-WP-0054: record T04 done, drop custom_metadata from T03, T05 apply commands
All checks were successful
CI Smoke / host-smoke (push) Successful in 1s
Details
CI Smoke / container-smoke (push) Successful in 2s
Details

Browse source 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 469992@bnt-lap001
Assistant-Session: e4b8e420-df0a-441d-83ae-7f19130594d9
This commit is contained in:
codex 2026-10-09 19:09:00 +02:00
parent 857be4695f
commit a595db9f7f
1 changed files with 34 additions and 12 deletions
Download patch file Download diff file Expand all files Collapse all files

46
workplans/RPF-WP-0054-keycape-client-secret-generate-lane.md
View file

@ -119,10 +119,12 @@ Add `credential.py generate --grant keycape/client-secret-generate --client-id
3. Prove absence: metadata read returns 404. Anything else refuses (exit 3 if
present).
4. Generate in process and write
`{"options":{"cas":0},"data":{"CLIENT_SECRET":...}}` through stdin, then set
`custom_metadata` (case-ref, generator, schema).
5. Verify by metadata only: current_version 1, not deleted, custom_metadata
matches. Never read the data path.
`{"options":{"cas":0},"data":{"CLIENT_SECRET":...}}` through stdin.
5. Verify by metadata only: current_version 1, not deleted. Never read the data
path. The case-ref goes in the receipt and the hub metadata, not in OpenBao
`custom_metadata`: writing that needs metadata `update`, which would also let
the token change `delete_version_after`/`max_versions` of other clients'
entries (decided while doing T04, 2026-10-09).
6. Revoke the lease. Write the receipt (0600, O_EXCL, versions, booleans and
outcome only). stdout/stderr stay silent apart from the fixed outcome code.
@ -135,7 +137,7 @@ text appears in any receipt.
```task
id: RPF-WP-0054-T04
status: todo
status: done
priority: high
depends_on: [RPF-WP-0054-T02]
state_hub_task_id: "74eb1309-df16-5163-9840-ffb88072d09e"
@ -149,6 +151,18 @@ the existing `agent-high-risk-boundary` lane entries need a `keycape/+` deny
and run `make agent-high-risk-boundary-check`. `make credential-grants-validate`
and the token-grant dry-runs must pass.
2026-10-09 done: CCR-2026-0040 (request type `custody-generate-grant`,
`scripts/broker_grant_lane.py`) writes the grant policy
`keycape-client-secret-generate` (create on `keycape/+` data, read on `keycape/+`
metadata, deny on `keycape/secrets-engine-openbao`, revoke-self), the issuer
policy `credential-broker-keycape-client-secret-generate-issuer` and the token
role (5m, orphan, non-renewable, no default policy), then reads all three back.
The catalog grant is `pilot`/`approval-required`, exec-env only. The apply binds
the issuer policy to no identity, so it is inert until T01 names the caller.
Agent boundary: no coding-agent policy grants any `keycape/` path, and the
create-only grant is never attached to an agent identity. No new boundary deny
is needed.
## T05 — Attended apply and disposable probe
```task
@ -160,13 +174,21 @@ depends_on: [RPF-WP-0054-T03, RPF-WP-0054-T04]
state_hub_task_id: "a21d1915-fee9-5c31-89e7-a4560c645950"
```
Founder session:
1. Apply the CCR.
2. Run `generate` once for a disposable client_id `probe-secret-generate-<date>`.
3. Verify metadata-only that it is version 1 with custom_metadata present.
4. Confirm a second run refuses, and that the grant token is denied `read` on the
data path, `update`, `delete`, and every path outside `keycape/`.
5. Metadata-delete the probe.
The CCR apply can run any time; it is inert until the issuer binding exists:
```bash
cd ~/railiance-platform
export BAO_ADDR=http://127.0.0.1:18200 VAULT_ADDR=http://127.0.0.1:18200
python3 scripts/credential-change.py approve CCR-2026-0040 --reviewer "platform-owner, key-cape-owner (founder Bernd Worsch)" --comment "Approve create-only broker grant keycape/client-secret-generate (RPF-WP-0054-T02 option A)." \
&& warden access openbao-platform-admin-login --exec -- python3 scripts/credential-change.py applier-apply CCR-2026-0040 --confirm "DELEGATED APPLY CCR-2026-0040" --actor founder --record-state-hub --quiet
```
After T01 and T03 (separate session): review and apply the issuer binding for
the named caller, then run `generate` once for a disposable client_id
`probe-secret-generate-<date>`. Verify by metadata only that it is version 1.
Confirm that a second run refuses, and that the grant token is denied a data
read, `update`, `delete` and every path outside `keycape/`. Metadata-delete the
probe.
Record the receipts under `docs/evidence/`.