Record approved requester delivery and attended execution packet
Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a10780-6d41-7952-9718-dfbc1f41236f
This commit is contained in:
parent
267814b90c
commit
a7bc33b867
4 changed files with 75 additions and 21 deletions
|
|
@ -3,7 +3,7 @@ kind: credential-change-request
|
|||
schema_version: 1
|
||||
request_type: workload-kv-read
|
||||
title: Informed Decision create-only requester workload read
|
||||
status: proposed
|
||||
status: approved
|
||||
created: '2026-10-04'
|
||||
updated: '2026-10-04'
|
||||
requester:
|
||||
|
|
@ -19,13 +19,33 @@ review:
|
|||
- at: '2026-10-04'
|
||||
reviewer: Bernd Worsch
|
||||
decision: design_boundary_approved
|
||||
comment: 'Founder answered "I approve" to the prepared requester-delivery design
|
||||
comment: Founder answered "I approve" to the prepared requester-delivery design
|
||||
for owner integration. Approves the exact existing-path reader, dedicated ESO
|
||||
identity, informed-decision namespace boundary, 15-minute reader tokens and
|
||||
read-only credential projection; namespace writer exposure and persistence
|
||||
beyond reader-token lifetime were disclosed. Owner runtime/binding acceptance
|
||||
and separate live deployment go remain; status stays proposed until those
|
||||
gates are satisfied. This does not resolve the broader intake rollout decision.'
|
||||
read-only credential projection; namespace writer exposure and persistence beyond
|
||||
reader-token lifetime were disclosed. Owner runtime/binding acceptance and separate
|
||||
live deployment go remain; status stays proposed until those gates are satisfied.
|
||||
This does not resolve the broader intake rollout decision.
|
||||
- at: '2026-10-04T21:01:27+00:00'
|
||||
reviewer: codex
|
||||
decision: binding_confirmed
|
||||
comment: Owner source review confirmed exact intended Kubernetes binding informed-decision/informed-decision-eso
|
||||
and audience openbao; runtime source accepted in informed-decision c084600,
|
||||
immutable service 2768bd1 and dispatcher 410fb6b. Existing namespace and ESO
|
||||
controller account verified live; prior explicit SubjectAccessReview permits
|
||||
TokenRequest. Dedicated account deployment and native auth positive/negative
|
||||
receipts remain pending; this confirms the reviewed binding configuration, not
|
||||
a completed native login.
|
||||
- at: '2026-10-04T21:01:27+00:00'
|
||||
reviewer: Bernd Worsch
|
||||
decision: approved
|
||||
comment: 'Founder answered I approve to the concrete requester-delivery approval
|
||||
request after review of the release packet: dedicated ESO identity, existing
|
||||
exact requester path, 15-minute reader tokens and read-only projection into
|
||||
informed-decision. This is the separate live delivery go following prior design
|
||||
approval. Attended OpenBao OIDC/MFA and native verification remain required;
|
||||
broader lifecycle cutover and separate issuer rotation are not approved by this
|
||||
record.'
|
||||
target:
|
||||
domain: financials
|
||||
tenant: platform
|
||||
|
|
@ -57,7 +77,7 @@ openbao:
|
|||
- informed-decision-eso
|
||||
service_account_namespaces:
|
||||
- informed-decision
|
||||
bound_claims_confirmed: false
|
||||
bound_claims_confirmed: true
|
||||
access_frontdoor:
|
||||
type: external-secrets
|
||||
catalog_id: informed-decision-sitting-requester-eso
|
||||
|
|
|
|||
|
|
@ -0,0 +1 @@
|
|||
c54dd86fd1bd754e64b135f02cac8d9a8f4db314cb3ca44c9645565aa816eee7 credential-change-requests/CCR-2026-0032.yaml
|
||||
|
|
@ -1,9 +1,32 @@
|
|||
# Attended provisioning preparation: 2026-10-04
|
||||
Decision: 0d6792b6-59e4-4fa0-887a-c4e51ea8e131
|
||||
Preparation only. Founder window approval and each exact CCR revision remain required.
|
||||
1. INFD-WP-0005-T05: NOT READY (CCR is not approved; never replay applied custody)
|
||||
CCR: credential-change-requests/CCR-2026-0032.yaml
|
||||
Lane: docs/credential-lane-designs/informed-decision-requester-workload.md
|
||||
Owner receipt contract: docs/provisioning-windows/2026-10-04-1000/informed-decision/receipt-contract.json
|
||||
Revalidate exact digest, upstream gates and native readiness before attended execution.
|
||||
Checklist complete: false
|
||||
# Requester delivery: approved, awaiting attended execution
|
||||
|
||||
CCR-2026-0032 was approved by Bernd Worsch in the informed-decision session on
|
||||
2026-10-04 after owner runtime acceptance at c084600. This is the exact requester
|
||||
delivery approval; broader service cutover and issuer rotation remain separate.
|
||||
|
||||
Approved CCR SHA256:
|
||||
`c54dd86fd1bd754e64b135f02cac8d9a8f4db314cb3ca44c9645565aa816eee7`
|
||||
|
||||
The metadata child validates this digest, approved status, confirmed reviewed
|
||||
binding, policy and role before execution. It compares both live objects before
|
||||
writing missing metadata, refuses conflicts, and reads back exact configuration.
|
||||
It neither reads credential values nor deploys Kubernetes objects.
|
||||
|
||||
Run from the founder's terminal with the existing OpenBao tunnel and browser:
|
||||
|
||||
```sh
|
||||
BAO_ADDR=http://127.0.0.1:18200 VAULT_ADDR=http://127.0.0.1:18200 \
|
||||
warden access openbao-platform-admin-login --exec -- \
|
||||
python3 /home/worsch/railiance-platform/scripts/informed_decision_requester_metadata.py \
|
||||
--expected-ccr-sha256 c54dd86fd1bd754e64b135f02cac8d9a8f4db314cb3ca44c9645565aa816eee7
|
||||
```
|
||||
|
||||
Warden performs OIDC/MFA, runs the silent child, revokes its session and removes
|
||||
private custody. Return only the exit code. Exit zero confirms this metadata
|
||||
operation and Warden cleanup; it does not prove workload delivery or acceptance.
|
||||
On nonzero exit, inspect bounded native metadata before any retry.
|
||||
|
||||
After successful metadata execution, continue owner-controlled ESO deployment,
|
||||
exact workload positive/negative proof, mounted projection and requester exchange.
|
||||
Keep the receipt-contract checks pending until observed. No credential rotation
|
||||
is included. Checklist complete: false; no live metadata applied by the agent.
|
||||
|
|
|
|||
|
|
@ -4,7 +4,7 @@ type: workplan
|
|||
title: "Prepare and admit informed-decision requester workload delivery"
|
||||
domain: financials
|
||||
repo: railiance-platform
|
||||
status: blocked
|
||||
status: active
|
||||
owner: codex
|
||||
topic_slug: platform-services
|
||||
created: "2026-10-04"
|
||||
|
|
@ -51,10 +51,8 @@ CCR/lane/receipt contract and remains NOT READY. No live action or issuer change
|
|||
|
||||
```task
|
||||
id: RPF-WP-0051-T02
|
||||
status: wait
|
||||
status: done
|
||||
priority: high
|
||||
blocked_on: message-from:informed-decision
|
||||
blocking_reason: "Binding/mount and requester exchange source accepted at informed-decision f06b7e9. Independent owner private-listener/runtime configuration, CA-verified TokenReview transport, deployment/RBAC/network proposal and immutable image/config source receipt remain; full live INFD-WP-0005-T05 completion is not a predecessor."
|
||||
state_hub_task_id: "dfc17e0a-9f63-5a97-b87e-13bd3a8325d6"
|
||||
```
|
||||
|
||||
|
|
@ -93,7 +91,7 @@ priority: high
|
|||
depends_on: [RPF-WP-0051-T02]
|
||||
needs_human: true
|
||||
decision_id: "0d6792b6-59e4-4fa0-887a-c4e51ea8e131"
|
||||
blocking_reason: "Founder approved the design boundary for owner integration on 2026-10-04. Exact owner runtime/binding acceptance, final execution packet and separate founder live go remain before attended metadata apply and ESO/runtime promotion."
|
||||
blocking_reason: "Exact requester delivery approved by founder. Await attended OpenBao OIDC/MFA execution, then native custody/delivery receipts; broader lifecycle cutover remains separate."
|
||||
state_hub_task_id: "abbe62c9-8520-563a-9f8a-e12b5209af77"
|
||||
```
|
||||
|
||||
|
|
@ -112,3 +110,15 @@ in CCR-2026-0032 and the lane contract. Owner binding/runtime acceptance and the
|
|||
separate concrete live go remain; no repeated design decision is required unless
|
||||
scope materially changes. The broader INFD-WP-0005-T05 decision remains open for
|
||||
runtime/listener acceptance and deployment. No credential action occurred.
|
||||
|
||||
## Exact live delivery approval — 2026-10-04
|
||||
|
||||
Founder answered "I approve" to the concrete CCR-2026-0032 requester delivery
|
||||
following informed-decision c084600 release review. Source/runtime acceptance
|
||||
closes T02: private listener, CA-verified TokenReview, requester exchange and
|
||||
separate audience tokens are composed; immutable service 2768bd1 and worker
|
||||
410fb6b passed recorded tests/scans. Approved CCR retains only the existing path,
|
||||
exact ESO identity, audience openbao, 900-second limits and read-only projection.
|
||||
The metadata child still requires the founder terminal OIDC/MFA. Native claims,
|
||||
delivery, negative proofs and revocation remain unproven under T03. No broader
|
||||
cutover or issuer rotation approval is inferred.
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue