From b3f12b2ffa2ea41c02633ec2c734abd4f63238d3 Mon Sep 17 00:00:00 2001 From: codex Date: Wed, 21 Oct 2026 01:35:14 +0200 Subject: [PATCH] CCR-2026-0050: record access-engine-owner approval; runbook uses Access public-receipt tool and pin Co-Authored-By: Claude Opus 5.5 Assistant: claude-code Assistant-Model: opus Assistant-Process: 809600@bnt-lap001 Assistant-Session: 40ba228f-c8a0-4ec9-bb29-3129951afdc4 --- ...-2026-0050-flex-auth-envelope-signing.yaml | 5 ++++- ...auth-envelope-signing-attended-creation.md | 19 ++++++++++--------- ...-WP-0035-credential-lane-implementation.md | 3 ++- 3 files changed, 16 insertions(+), 11 deletions(-) diff --git a/credential-change-requests/CCR-2026-0050-flex-auth-envelope-signing.yaml b/credential-change-requests/CCR-2026-0050-flex-auth-envelope-signing.yaml index c482fc3..7ea8138 100644 --- a/credential-change-requests/CCR-2026-0050-flex-auth-envelope-signing.yaml +++ b/credential-change-requests/CCR-2026-0050-flex-auth-envelope-signing.yaml @@ -26,9 +26,12 @@ review: - reviewer: secrets-engine-owner (agent secrets-engine, hub message e73c9ffc-8a6d-4a17-9604-84324c678dc0) decision: approved comment: "2026-10-21, consumer side only. Consumer has no KV read role and receives no seed; public trust is admitted through a founder ssh-keygen -Y signed trust file (secrets-engine ebd8e49, docs/founder-admission.md, SECRETS-WP-0014-T04, decision e4eee965). Conditions: (1) the public receipt (kid, Ed25519 public key as 43-char unpadded base64url, evaluator/mode/policy_package/policy_version/policy_package_digest) is emitted by the attended writer at creation time or derived from its public output, never from a later read of the KV document; (2) the receipt carries the KV version and source/image provenance hashes. Not founder approval, native execution or a binding." + - reviewer: access-engine-owner (agent access-engine, hub message 6529bacf-6065-4fb9-a9a2-a41b7ed8fa83) + decision: approved + comment: "2026-10-21, Access scope only (retained workload/release source, Helm values, candidate image 84c78e0 / sha256:09a83b27...981f, signer delivery/mount, process/outbox fencing/rollback). Reviewed CCR sha256:66b3ea12d3f3bb870fa0aa0e7598e32abdb9bf39efe1adcfac286407abeb98e4 (before the 2026-10-21 review-comment edits), policy sha256:b9f816da25c7770863a5fc7b3b873e9da90b087e71a9052e766bf0a187ff85ef, native plan sha256:22306d50e082fc35c5ff22c31e739a53c7584176969063f7907bc01d77e506e5, R2 manifest sha256:5be7a7f438624dcb35b7dbc96e7c9e5a8e2d5d1b1966cb4338aa5aecbe3a8b59. Notes: seed read once at startup so rotation stays a fenced restart; bound_claims_confirmed needs native readback before activation; consumer policy pin comes from access-engine docs/native-signer-public-pin.json and the public receipt is prepared with access-engine tools/prepare_signer_public_receipt.py (public fields only); keep writer receipt fields kid/public_key/public_fingerprint/kv_version/status/path/source_ccr_sha256 stable. Access rollout founder go is separate: decision 4fab263d-686b-4a06-9cea-8df619c87c03 (FLEX-WP-0024-T07). Not founder approval or native execution." - reviewer: railiance-platform-owner (agent railiance-platform, claude) decision: approved - comment: "2026-10-21 runbook review: docs/runbooks/flex-auth-envelope-signing-attended-creation.md prepared. Secrets condition 1 is met for kid/public key/fingerprint/kv_version/source/image hashes by deriving the consumer receipt from the writer receipt (no KV read); the evaluator/mode/policy_package/policy_version/policy_package_digest fields are not in the writer receipt and must come from Access's published pin. Review-scope digest no longer binds expires_at so owner reviews can precede the 120 s window. Pending: access-engine-owner (awaited), cluster-runtime-storage-owner (railiance-cluster, requested f8b4b229), founder. Nothing executed." + comment: "2026-10-21 runbook review: docs/runbooks/flex-auth-envelope-signing-attended-creation.md prepared. Secrets condition 1 is met for kid/public key/fingerprint/kv_version/source/image hashes by deriving the consumer receipt from the writer receipt (no KV read); the evaluator/mode/policy_package/policy_version/policy_package_digest fields are not in the writer receipt and must come from Access's published pin. Review-scope digest no longer binds expires_at so owner reviews can precede the 120 s window. Pending: cluster-runtime-storage-owner (railiance-cluster, requested f8b4b229), founder. Nothing executed." target: domain: infotech tenant: platform diff --git a/docs/runbooks/flex-auth-envelope-signing-attended-creation.md b/docs/runbooks/flex-auth-envelope-signing-attended-creation.md index 2238688..3494a8f 100644 --- a/docs/runbooks/flex-auth-envelope-signing-attended-creation.md +++ b/docs/runbooks/flex-auth-envelope-signing-attended-creation.md @@ -108,20 +108,21 @@ and no automatic retry. Forward-only recovery under a newly reviewed action. ## 3. Public receipt for secrets-engine (no private read) Derive the consumer receipt from the writer receipt, never from a KV read (the -KV document also holds the seed and reads are not field-filtered): +KV document also holds the seed and reads are not field-filtered). Use Access's +existing tool, which reads public fields only, together with Access's published +policy pin (`access-engine docs/native-signer-public-pin.json`: flex-auth/local, +standalone, `secrets-engine.catalog-lane.lifecycle` v2, +`sha256:bd11c5fe77ce6439c65fea225ad6b71d2110efc5e7b5bc9b499c59cd0a53b8b4`): ```bash R=/home/worsch/.local/state/railiance-platform/flex-auth-envelope-signing/.json -jq '{kid, public_key, public_fingerprint, kv_version, writer_sha256, - image_sha256: .bindings.image_sha256, policy_sha256: .bindings.policy_sha256, - executed_revision_sha256: .bindings.executed_revision_sha256, - deployment_sha256: .bindings.deployment_sha256, proposal_sha256: .bindings.proposal_sha256}' "$R" \ - > flex-auth-envelope-signing-public-receipt.json +python3 ~/access-engine/tools/prepare_signer_public_receipt.py --help # then run per its usage on "$R" ``` -Then add the policy pin fields secrets-engine requires (`evaluator`, `mode`, -`policy_package`, `policy_version`, `policy_package_digest`) from Access's -published pin for the candidate release; these are not in the writer receipt. +The result must carry kid, public key, fingerprint, KV version, writer and +source/image/deployment hashes and the pin fields (`evaluator`, `mode`, +`policy_package`, `policy_version`, `policy_package_digest`); these are the two +secrets-engine conditions recorded in the CCR. `public_key` is unpadded base64url, 43 characters. `public_fingerprint` is `sha256:` + hex SHA-256 of that ASCII string, not of the raw bytes. The founder delivers the file to the secrets-engine owner over an authenticated channel and diff --git a/workplans/RPF-WP-0035-credential-lane-implementation.md b/workplans/RPF-WP-0035-credential-lane-implementation.md index 17b0457..89d8fc6 100644 --- a/workplans/RPF-WP-0035-credential-lane-implementation.md +++ b/workplans/RPF-WP-0035-credential-lane-implementation.md @@ -1434,7 +1434,8 @@ still needs the founder's go at the time. 2026-10-21 state: railiance-platform-owner approved (runbook review); secrets-engine-owner approved with two receipt conditions (hub message -e73c9ffc, recorded in the CCR); access-engine-owner disposition awaited; +e73c9ffc, recorded in the CCR); access-engine-owner approved for Access scope +(hub message 6529bacf; its rollout go is separate decision 4fab263d); cluster-runtime-storage-owner (railiance-cluster) review requested in hub message f8b4b229. The warden routing defect from 2026-10-16 no longer reproduces (`docs/evidence/2026-10-21-flex-auth-signer-warden-route.json`).