Close RPF-WP-0067: value-safe OpenBao and PostgreSQL identity metadata for NK-WP-0054-T04.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 236506@bnt-lap001 Assistant-Session: 09087018-91e1-48c5-ab2f-acfbb62c92e4
This commit is contained in:
codex
parent
bb08f98d14
commit
b0b6c0cf46
4 changed files with 6840 additions and 5 deletions
|
|
@ -47,7 +47,7 @@
|
|||
| workplan | RPF-WP-0064 | active | — | workplans/RPF-WP-0064-isolated-original-openbao-restore.md |
|
||||
| workplan | RPF-WP-0065 | proposed | — | workplans/RPF-WP-0065-netkingdom-role-claim-bindings.md |
|
||||
| workplan | RPF-WP-0066 | proposed | — | workplans/RPF-WP-0066-openbao-durable-audit-snapshots-conformance.md |
|
||||
| workplan | RPF-WP-0067 | active | — | workplans/RPF-WP-0067-netkingdom-identity-receipt-and-metadata-answers.md |
|
||||
| workplan | RPF-WP-0067 | finished | — | workplans/RPF-WP-0067-netkingdom-identity-receipt-and-metadata-answers.md |
|
||||
| workplan | RPF-WP-0068 | finished | — | workplans/RPF-WP-0068-email-connect-platform-smtp.md |
|
||||
| workplan | RPF-WP-0069 | active | — | workplans/RPF-WP-0069-bounded-executor-lanes.md |
|
||||
| workplan | RPF-WP-0070 | finished | — | workplans/RPF-WP-0070-mas-evidence-recovery.md |
|
||||
|
|
@ -228,7 +228,7 @@
|
|||
| task | RPF-WP-0066-T06 | todo | — | workplans/RPF-WP-0066-openbao-durable-audit-snapshots-conformance.md |
|
||||
| task | RPF-WP-0067-T01 | done | — | workplans/RPF-WP-0067-netkingdom-identity-receipt-and-metadata-answers.md |
|
||||
| task | RPF-WP-0067-T02 | done | — | workplans/RPF-WP-0067-netkingdom-identity-receipt-and-metadata-answers.md |
|
||||
| task | RPF-WP-0067-T03 | wait | — | workplans/RPF-WP-0067-netkingdom-identity-receipt-and-metadata-answers.md |
|
||||
| task | RPF-WP-0067-T03 | done | — | workplans/RPF-WP-0067-netkingdom-identity-receipt-and-metadata-answers.md |
|
||||
| task | RPF-WP-0068-T01 | done | — | workplans/RPF-WP-0068-email-connect-platform-smtp.md |
|
||||
| task | RPF-WP-0068-T02 | done | — | workplans/RPF-WP-0068-email-connect-platform-smtp.md |
|
||||
| task | RPF-WP-0068-T03 | done | — | workplans/RPF-WP-0068-email-connect-platform-smtp.md |
|
||||
|
|
|
|||
File diff suppressed because it is too large
Load diff
|
|
@ -0,0 +1,97 @@
|
|||
{
|
||||
"collected_at": "2026-11-03T20:18:54Z",
|
||||
"postgresql": {
|
||||
"cluster": "net-kingdom-pg",
|
||||
"databases": [
|
||||
{
|
||||
"name": "interhub",
|
||||
"owner": "interhub"
|
||||
},
|
||||
{
|
||||
"name": "postgres",
|
||||
"owner": "postgres"
|
||||
},
|
||||
{
|
||||
"name": "privacyidea_db",
|
||||
"owner": "privacyidea"
|
||||
},
|
||||
{
|
||||
"name": "probe",
|
||||
"owner": "probe"
|
||||
}
|
||||
],
|
||||
"namespace": "databases",
|
||||
"roles": [
|
||||
{
|
||||
"bypass_rls": false,
|
||||
"can_login": true,
|
||||
"connection_limit": -1,
|
||||
"create_db": false,
|
||||
"create_role": false,
|
||||
"inherit": true,
|
||||
"member_of": [],
|
||||
"name": "interhub",
|
||||
"replication": false,
|
||||
"superuser": false,
|
||||
"valid_until": null
|
||||
},
|
||||
{
|
||||
"bypass_rls": true,
|
||||
"can_login": true,
|
||||
"connection_limit": -1,
|
||||
"create_db": true,
|
||||
"create_role": true,
|
||||
"inherit": true,
|
||||
"member_of": [],
|
||||
"name": "postgres",
|
||||
"replication": true,
|
||||
"superuser": true,
|
||||
"valid_until": null
|
||||
},
|
||||
{
|
||||
"bypass_rls": false,
|
||||
"can_login": true,
|
||||
"connection_limit": -1,
|
||||
"create_db": false,
|
||||
"create_role": false,
|
||||
"inherit": true,
|
||||
"member_of": [],
|
||||
"name": "privacyidea",
|
||||
"replication": false,
|
||||
"superuser": false,
|
||||
"valid_until": null
|
||||
},
|
||||
{
|
||||
"bypass_rls": false,
|
||||
"can_login": true,
|
||||
"connection_limit": -1,
|
||||
"create_db": false,
|
||||
"create_role": false,
|
||||
"inherit": true,
|
||||
"member_of": [],
|
||||
"name": "probe",
|
||||
"replication": false,
|
||||
"superuser": false,
|
||||
"valid_until": null
|
||||
},
|
||||
{
|
||||
"bypass_rls": false,
|
||||
"can_login": true,
|
||||
"connection_limit": -1,
|
||||
"create_db": false,
|
||||
"create_role": false,
|
||||
"inherit": true,
|
||||
"member_of": [],
|
||||
"name": "streaming_replica",
|
||||
"replication": true,
|
||||
"superuser": false,
|
||||
"valid_until": null
|
||||
}
|
||||
],
|
||||
"server_version": "16.13 (Debian 16.13-1.pgdg11+1)"
|
||||
},
|
||||
"schema": "railiance-platform.service-identity-metadata.v1",
|
||||
"service": "postgresql",
|
||||
"source_kind": "live",
|
||||
"value_safe": true
|
||||
}
|
||||
|
|
@ -4,7 +4,7 @@ type: workplan
|
|||
title: "NetKingdom owner answers: execution-attribution receipt emitter and service-identity metadata export"
|
||||
domain: financials
|
||||
repo: railiance-platform
|
||||
status: active
|
||||
status: finished
|
||||
flavor: implementation
|
||||
owner: claude
|
||||
created: "2026-10-28"
|
||||
|
|
@ -124,9 +124,8 @@ Proven from source for net-kingdom `tools/service-identity/declarations/openbao.
|
|||
|
||||
```task
|
||||
id: RPF-WP-0067-T03
|
||||
status: wait
|
||||
status: done
|
||||
priority: medium
|
||||
blocking_reason: "Live read-only export needs the founder's OpenBao platform-admin login and cluster access."
|
||||
state_hub_task_id: "23ea4894-120a-556e-bf24-4b01cb2ddcfb"
|
||||
```
|
||||
|
||||
|
|
@ -154,3 +153,18 @@ python3 scripts/service_identity_metadata_export.py postgresql-sql \
|
|||
Exit 0 writes the file; exit 3 means a secret-shaped value was found and nothing
|
||||
was written; exit 2 is a read failure. Return both JSON files to NetKingdom; they
|
||||
hold no secret values.
|
||||
|
||||
**Live export run 2026-11-03.** The founder ran both exports at 21:18
|
||||
(workstation time) using the contained `openbao-platform-admin-login` and the
|
||||
attended admin kubeconfig. Both exited 0.
|
||||
- OpenBao: 6 auth mounts, 67 policies, 73 roles.
|
||||
- PostgreSQL `net-kingdom-pg` 16.13: 5 roles (`interhub`, `postgres`,
|
||||
`privacyidea`, `probe`, `streaming_replica`), 4 databases.
|
||||
A scan for secret-shaped values (Vault tokens, PEM, SCRAM/md5 hashes, JWTs)
|
||||
found none, and no Secret was read. Files:
|
||||
`docs/evidence/2026-11-03-nk-wp-0054-t04-identity-metadata/`
|
||||
- `openbao-identity-metadata.json`, sha256 `60da6df0…aa1b`
|
||||
- `postgresql-identity-metadata.json`, sha256 `e627278b…541a`
|
||||
They were sent to NetKingdom as a reply to brief `f5d366f5`. T03 is done, and
|
||||
RPF-WP-0067 is finished. T01's open items belong to the runner owners,
|
||||
NetKingdom and audit-core.
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue