From a7bc33b86751b3b889f4d185a1f9dce8529f51fa Mon Sep 17 00:00:00 2001 From: tegwick Date: Sun, 4 Oct 2026 23:02:28 +0200 Subject: [PATCH] Record approved requester delivery and attended execution packet Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a10780-6d41-7952-9718-dfbc1f41236f --- credential-change-requests/CCR-2026-0032.yaml | 34 +++++++++++---- .../informed-decision/approved-ccr.sha256 | 1 + .../informed-decision/checklist.md | 41 +++++++++++++++---- ...ed-decision-requester-workload-delivery.md | 20 ++++++--- 4 files changed, 75 insertions(+), 21 deletions(-) create mode 100644 docs/provisioning-windows/2026-10-04-1000/informed-decision/approved-ccr.sha256 diff --git a/credential-change-requests/CCR-2026-0032.yaml b/credential-change-requests/CCR-2026-0032.yaml index 3dfd77c..ffa5fe6 100644 --- a/credential-change-requests/CCR-2026-0032.yaml +++ b/credential-change-requests/CCR-2026-0032.yaml @@ -3,7 +3,7 @@ kind: credential-change-request schema_version: 1 request_type: workload-kv-read title: Informed Decision create-only requester workload read -status: proposed +status: approved created: '2026-10-04' updated: '2026-10-04' requester: @@ -19,13 +19,33 @@ review: - at: '2026-10-04' reviewer: Bernd Worsch decision: design_boundary_approved - comment: 'Founder answered "I approve" to the prepared requester-delivery design + comment: Founder answered "I approve" to the prepared requester-delivery design for owner integration. Approves the exact existing-path reader, dedicated ESO identity, informed-decision namespace boundary, 15-minute reader tokens and - read-only credential projection; namespace writer exposure and persistence - beyond reader-token lifetime were disclosed. Owner runtime/binding acceptance - and separate live deployment go remain; status stays proposed until those - gates are satisfied. This does not resolve the broader intake rollout decision.' + read-only credential projection; namespace writer exposure and persistence beyond + reader-token lifetime were disclosed. Owner runtime/binding acceptance and separate + live deployment go remain; status stays proposed until those gates are satisfied. + This does not resolve the broader intake rollout decision. + - at: '2026-10-04T21:01:27+00:00' + reviewer: codex + decision: binding_confirmed + comment: Owner source review confirmed exact intended Kubernetes binding informed-decision/informed-decision-eso + and audience openbao; runtime source accepted in informed-decision c084600, + immutable service 2768bd1 and dispatcher 410fb6b. Existing namespace and ESO + controller account verified live; prior explicit SubjectAccessReview permits + TokenRequest. Dedicated account deployment and native auth positive/negative + receipts remain pending; this confirms the reviewed binding configuration, not + a completed native login. + - at: '2026-10-04T21:01:27+00:00' + reviewer: Bernd Worsch + decision: approved + comment: 'Founder answered I approve to the concrete requester-delivery approval + request after review of the release packet: dedicated ESO identity, existing + exact requester path, 15-minute reader tokens and read-only projection into + informed-decision. This is the separate live delivery go following prior design + approval. Attended OpenBao OIDC/MFA and native verification remain required; + broader lifecycle cutover and separate issuer rotation are not approved by this + record.' target: domain: financials tenant: platform @@ -57,7 +77,7 @@ openbao: - informed-decision-eso service_account_namespaces: - informed-decision - bound_claims_confirmed: false + bound_claims_confirmed: true access_frontdoor: type: external-secrets catalog_id: informed-decision-sitting-requester-eso diff --git a/docs/provisioning-windows/2026-10-04-1000/informed-decision/approved-ccr.sha256 b/docs/provisioning-windows/2026-10-04-1000/informed-decision/approved-ccr.sha256 new file mode 100644 index 0000000..75af4b9 --- /dev/null +++ b/docs/provisioning-windows/2026-10-04-1000/informed-decision/approved-ccr.sha256 @@ -0,0 +1 @@ +c54dd86fd1bd754e64b135f02cac8d9a8f4db314cb3ca44c9645565aa816eee7 credential-change-requests/CCR-2026-0032.yaml diff --git a/docs/provisioning-windows/2026-10-04-1000/informed-decision/checklist.md b/docs/provisioning-windows/2026-10-04-1000/informed-decision/checklist.md index 6b5262e..8f4729b 100644 --- a/docs/provisioning-windows/2026-10-04-1000/informed-decision/checklist.md +++ b/docs/provisioning-windows/2026-10-04-1000/informed-decision/checklist.md @@ -1,9 +1,32 @@ -# Attended provisioning preparation: 2026-10-04 -Decision: 0d6792b6-59e4-4fa0-887a-c4e51ea8e131 -Preparation only. Founder window approval and each exact CCR revision remain required. -1. INFD-WP-0005-T05: NOT READY (CCR is not approved; never replay applied custody) - CCR: credential-change-requests/CCR-2026-0032.yaml - Lane: docs/credential-lane-designs/informed-decision-requester-workload.md - Owner receipt contract: docs/provisioning-windows/2026-10-04-1000/informed-decision/receipt-contract.json - Revalidate exact digest, upstream gates and native readiness before attended execution. -Checklist complete: false +# Requester delivery: approved, awaiting attended execution + +CCR-2026-0032 was approved by Bernd Worsch in the informed-decision session on +2026-10-04 after owner runtime acceptance at c084600. This is the exact requester +delivery approval; broader service cutover and issuer rotation remain separate. + +Approved CCR SHA256: +`c54dd86fd1bd754e64b135f02cac8d9a8f4db314cb3ca44c9645565aa816eee7` + +The metadata child validates this digest, approved status, confirmed reviewed +binding, policy and role before execution. It compares both live objects before +writing missing metadata, refuses conflicts, and reads back exact configuration. +It neither reads credential values nor deploys Kubernetes objects. + +Run from the founder's terminal with the existing OpenBao tunnel and browser: + +```sh +BAO_ADDR=http://127.0.0.1:18200 VAULT_ADDR=http://127.0.0.1:18200 \ + warden access openbao-platform-admin-login --exec -- \ + python3 /home/worsch/railiance-platform/scripts/informed_decision_requester_metadata.py \ + --expected-ccr-sha256 c54dd86fd1bd754e64b135f02cac8d9a8f4db314cb3ca44c9645565aa816eee7 +``` + +Warden performs OIDC/MFA, runs the silent child, revokes its session and removes +private custody. Return only the exit code. Exit zero confirms this metadata +operation and Warden cleanup; it does not prove workload delivery or acceptance. +On nonzero exit, inspect bounded native metadata before any retry. + +After successful metadata execution, continue owner-controlled ESO deployment, +exact workload positive/negative proof, mounted projection and requester exchange. +Keep the receipt-contract checks pending until observed. No credential rotation +is included. Checklist complete: false; no live metadata applied by the agent. diff --git a/workplans/RPF-WP-0051-informed-decision-requester-workload-delivery.md b/workplans/RPF-WP-0051-informed-decision-requester-workload-delivery.md index 87c8a52..4e872a8 100644 --- a/workplans/RPF-WP-0051-informed-decision-requester-workload-delivery.md +++ b/workplans/RPF-WP-0051-informed-decision-requester-workload-delivery.md @@ -4,7 +4,7 @@ type: workplan title: "Prepare and admit informed-decision requester workload delivery" domain: financials repo: railiance-platform -status: blocked +status: active owner: codex topic_slug: platform-services created: "2026-10-04" @@ -51,10 +51,8 @@ CCR/lane/receipt contract and remains NOT READY. No live action or issuer change ```task id: RPF-WP-0051-T02 -status: wait +status: done priority: high -blocked_on: message-from:informed-decision -blocking_reason: "Binding/mount and requester exchange source accepted at informed-decision f06b7e9. Independent owner private-listener/runtime configuration, CA-verified TokenReview transport, deployment/RBAC/network proposal and immutable image/config source receipt remain; full live INFD-WP-0005-T05 completion is not a predecessor." state_hub_task_id: "dfc17e0a-9f63-5a97-b87e-13bd3a8325d6" ``` @@ -93,7 +91,7 @@ priority: high depends_on: [RPF-WP-0051-T02] needs_human: true decision_id: "0d6792b6-59e4-4fa0-887a-c4e51ea8e131" -blocking_reason: "Founder approved the design boundary for owner integration on 2026-10-04. Exact owner runtime/binding acceptance, final execution packet and separate founder live go remain before attended metadata apply and ESO/runtime promotion." +blocking_reason: "Exact requester delivery approved by founder. Await attended OpenBao OIDC/MFA execution, then native custody/delivery receipts; broader lifecycle cutover remains separate." state_hub_task_id: "abbe62c9-8520-563a-9f8a-e12b5209af77" ``` @@ -112,3 +110,15 @@ in CCR-2026-0032 and the lane contract. Owner binding/runtime acceptance and the separate concrete live go remain; no repeated design decision is required unless scope materially changes. The broader INFD-WP-0005-T05 decision remains open for runtime/listener acceptance and deployment. No credential action occurred. + +## Exact live delivery approval — 2026-10-04 + +Founder answered "I approve" to the concrete CCR-2026-0032 requester delivery +following informed-decision c084600 release review. Source/runtime acceptance +closes T02: private listener, CA-verified TokenReview, requester exchange and +separate audience tokens are composed; immutable service 2768bd1 and worker +410fb6b passed recorded tests/scans. Approved CCR retains only the existing path, +exact ESO identity, audience openbao, 900-second limits and read-only projection. +The metadata child still requires the founder terminal OIDC/MFA. Native claims, +delivery, negative proofs and revocation remain unproven under T03. No broader +cutover or issuer rotation approval is inferred.