From a595db9f7f54f2f9bdf0cfcc788d8d75596424b9 Mon Sep 17 00:00:00 2001 From: codex Date: Fri, 9 Oct 2026 19:09:00 +0200 Subject: [PATCH] RPF-WP-0054: record T04 done, drop custom_metadata from T03, T05 apply commands Co-Authored-By: Claude Opus 5.5 Assistant: claude-code Assistant-Model: opus Assistant-Process: 469992@bnt-lap001 Assistant-Session: e4b8e420-df0a-441d-83ae-7f19130594d9 --- ...054-keycape-client-secret-generate-lane.md | 46 ++++++++++++++----- 1 file changed, 34 insertions(+), 12 deletions(-) diff --git a/workplans/RPF-WP-0054-keycape-client-secret-generate-lane.md b/workplans/RPF-WP-0054-keycape-client-secret-generate-lane.md index 6bd0e8a..93eddbe 100644 --- a/workplans/RPF-WP-0054-keycape-client-secret-generate-lane.md +++ b/workplans/RPF-WP-0054-keycape-client-secret-generate-lane.md @@ -119,10 +119,12 @@ Add `credential.py generate --grant keycape/client-secret-generate --client-id 3. Prove absence: metadata read returns 404. Anything else refuses (exit 3 if present). 4. Generate in process and write - `{"options":{"cas":0},"data":{"CLIENT_SECRET":...}}` through stdin, then set - `custom_metadata` (case-ref, generator, schema). -5. Verify by metadata only: current_version 1, not deleted, custom_metadata - matches. Never read the data path. + `{"options":{"cas":0},"data":{"CLIENT_SECRET":...}}` through stdin. +5. Verify by metadata only: current_version 1, not deleted. Never read the data + path. The case-ref goes in the receipt and the hub metadata, not in OpenBao + `custom_metadata`: writing that needs metadata `update`, which would also let + the token change `delete_version_after`/`max_versions` of other clients' + entries (decided while doing T04, 2026-10-09). 6. Revoke the lease. Write the receipt (0600, O_EXCL, versions, booleans and outcome only). stdout/stderr stay silent apart from the fixed outcome code. @@ -135,7 +137,7 @@ text appears in any receipt. ```task id: RPF-WP-0054-T04 -status: todo +status: done priority: high depends_on: [RPF-WP-0054-T02] state_hub_task_id: "74eb1309-df16-5163-9840-ffb88072d09e" @@ -149,6 +151,18 @@ the existing `agent-high-risk-boundary` lane entries need a `keycape/+` deny and run `make agent-high-risk-boundary-check`. `make credential-grants-validate` and the token-grant dry-runs must pass. +2026-10-09 done: CCR-2026-0040 (request type `custody-generate-grant`, +`scripts/broker_grant_lane.py`) writes the grant policy +`keycape-client-secret-generate` (create on `keycape/+` data, read on `keycape/+` +metadata, deny on `keycape/secrets-engine-openbao`, revoke-self), the issuer +policy `credential-broker-keycape-client-secret-generate-issuer` and the token +role (5m, orphan, non-renewable, no default policy), then reads all three back. +The catalog grant is `pilot`/`approval-required`, exec-env only. The apply binds +the issuer policy to no identity, so it is inert until T01 names the caller. +Agent boundary: no coding-agent policy grants any `keycape/` path, and the +create-only grant is never attached to an agent identity. No new boundary deny +is needed. + ## T05 — Attended apply and disposable probe ```task @@ -160,13 +174,21 @@ depends_on: [RPF-WP-0054-T03, RPF-WP-0054-T04] state_hub_task_id: "a21d1915-fee9-5c31-89e7-a4560c645950" ``` -Founder session: -1. Apply the CCR. -2. Run `generate` once for a disposable client_id `probe-secret-generate-`. -3. Verify metadata-only that it is version 1 with custom_metadata present. -4. Confirm a second run refuses, and that the grant token is denied `read` on the - data path, `update`, `delete`, and every path outside `keycape/`. -5. Metadata-delete the probe. +The CCR apply can run any time; it is inert until the issuer binding exists: + +```bash +cd ~/railiance-platform +export BAO_ADDR=http://127.0.0.1:18200 VAULT_ADDR=http://127.0.0.1:18200 +python3 scripts/credential-change.py approve CCR-2026-0040 --reviewer "platform-owner, key-cape-owner (founder Bernd Worsch)" --comment "Approve create-only broker grant keycape/client-secret-generate (RPF-WP-0054-T02 option A)." \ + && warden access openbao-platform-admin-login --exec -- python3 scripts/credential-change.py applier-apply CCR-2026-0040 --confirm "DELEGATED APPLY CCR-2026-0040" --actor founder --record-state-hub --quiet +``` + +After T01 and T03 (separate session): review and apply the issuer binding for +the named caller, then run `generate` once for a disposable client_id +`probe-secret-generate-`. Verify by metadata only that it is version 1. +Confirm that a second run refuses, and that the grant token is denied a data +read, `update`, `delete` and every path outside `keycape/`. Metadata-delete the +probe. Record the receipts under `docs/evidence/`.