Prepare scoped factory audit custody and enforce receiver compatibility
Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a07ff8-19d0-7820-b4d0-1353833cb7fc
This commit is contained in:
codex
parent
d3a502b45c
commit
bfe65a5b05
11 changed files with 1053 additions and 1 deletions
|
|
@ -0,0 +1,110 @@
|
|||
id: CCR-2026-0021
|
||||
kind: credential-change-request
|
||||
schema_version: 1
|
||||
request_type: workload-kv-read
|
||||
title: approval-engine load-bearing audit sender custody and delivery
|
||||
status: proposed
|
||||
created: '2026-09-11'
|
||||
updated: '2026-09-11'
|
||||
requester:
|
||||
agent: codex
|
||||
reason: AUDIT-WP-0009-T09 and HFACT-WP-0001-T03 require the existing exact sender declaration. This
|
||||
request supplies the missing platform custody and ESO delivery; receiver compatibility and service
|
||||
rollout remain explicit gates.
|
||||
review:
|
||||
required: true
|
||||
required_approvers:
|
||||
- platform-operator
|
||||
- audit-core-owner
|
||||
- approval-engine-owner
|
||||
comments: []
|
||||
target:
|
||||
domain: financials
|
||||
tenant: platform
|
||||
workload: approval-engine
|
||||
environment: production
|
||||
purpose: Provide only the approval-engine sender with source=approval-engine, tenants=[tenant:platform],
|
||||
may_write=true, may_read=false, evidence_kind=load-bearing, secret_policy=redact. Preserve the
|
||||
existing receiver registry and every other sender.
|
||||
openbao:
|
||||
mount: platform
|
||||
kv_path: platform/workloads/approval-engine/audit-sender
|
||||
fields:
|
||||
- AUDIT_TOKEN
|
||||
- CUSTODY_REQUEST
|
||||
policy_name: workload-kv-read-approval-engine-audit
|
||||
policy_file: openbao/policies/workload-kv-read-approval-engine-audit.hcl
|
||||
metadata_read: false
|
||||
auth:
|
||||
method: kubernetes
|
||||
mount: kubernetes
|
||||
role: external-secrets-approval-engine-audit
|
||||
bound_claims:
|
||||
service_account_names:
|
||||
- external-secrets
|
||||
service_account_namespaces:
|
||||
- external-secrets
|
||||
bound_claims_confirmed: true
|
||||
policies:
|
||||
- workload-kv-read-approval-engine-audit
|
||||
ttl: 15m
|
||||
access_frontdoor:
|
||||
type: external-secrets
|
||||
catalog_id: approval-engine-audit
|
||||
readiness: pending-review
|
||||
resolvable: false
|
||||
delivery:
|
||||
surface: external-secrets
|
||||
target: 'ClusterSecretStore openbao-approval-engine-audit restricted to namespace approval-engine;
|
||||
ExternalSecret and Secret approval-engine/approval-engine-audit, key audit-token. Source: manifests/factory-audit-senders.yaml.
|
||||
A missing namespace stays a workload-owner prerequisite; this packet creates none.'
|
||||
risk:
|
||||
classification: high
|
||||
notes:
|
||||
- A bearer permits append for its exact sender and tenant, never reading or changing stored evidence.
|
||||
- The registry update reads existing sender credentials inside the attended platform process only.
|
||||
No registry is delivered to a producer.
|
||||
- OpenBao login TTL limits the ESO reader session, not the audit bearer. Revocation must remove
|
||||
the sender token from the receiver registry and prove refusal.
|
||||
- New paths extend the existing coding-agent deny boundary. No existing high-risk grant is widened.
|
||||
verification:
|
||||
positive:
|
||||
- Independent CAS=0 token creation and exact sender merge with registry-version compare-and-set;
|
||||
repeated runs preserve both tokens and other registry fields.
|
||||
- ESO delivers only AUDIT_TOKEN into approval-engine/approval-engine-audit:audit-token; source and
|
||||
receiver copies agree without displaying values.
|
||||
- Compatible deployed receiver accepts and deduplicates a declared synthetic event for the exact
|
||||
sender and tenant, retaining load-bearing/redact declarations.
|
||||
negative:
|
||||
- Sibling sender path, full registry and parent listing are denied to each workload reader. Wrong
|
||||
service account/namespace and disallowed store namespace fail.
|
||||
- Receiver denies sibling source, wrong tenant, every read route and revoked token. No existing
|
||||
sender is removed or re-scoped.
|
||||
- Proposed or altered CCR, legacy receiver, malformed/duplicate registry identity, token collision,
|
||||
stale registry version or partial/conflicting custody refuses without overwriting.
|
||||
activation_conditions:
|
||||
- All three named owner reviews are approved before any native credential mutation.
|
||||
- A current image supporting evidence_kind is published/admitted by audit-core and deployed with
|
||||
its source scope and network policy; current c2fe39a image fails compatibility.
|
||||
- Use the Warden attended platform-admin login envelope; preserve independent receipt and revoke
|
||||
the session on exit.
|
||||
- Apply reviewed policy/auth metadata and ESO projection only after receiver compatibility and namespace
|
||||
readiness. An interrupted seed resumes from durable KV values, never blindly rotates or deletes.
|
||||
- Record native positive/negative evidence before declaring verified or active. Custody alone does
|
||||
not admit UI, human approval or factory execution.
|
||||
lifecycle:
|
||||
deactivate: Stop the exact producer; remove only its admitted token from the registry using CAS
|
||||
and reload/verify receiver refusal. Then detach its reader policy and remove its ExternalSecret/projection,
|
||||
retaining KV versions for investigation. Do not delete audit events or other sender entries.
|
||||
rotate: 'Reviewed overlap-first rotation: append a replacement to this sender only, deliver it,
|
||||
prove acceptance, then remove the predecessor and prove refusal. The first-provision helper refuses
|
||||
rotation and unexpected existing values.'
|
||||
compromised: Stop affected producer and revoke the exact receiver token first; inspect affected
|
||||
source/tenant events, rotate through a separate reviewed action, and preserve the independent
|
||||
audit trail.
|
||||
state_hub:
|
||||
workplan_id: RPF-WP-0035
|
||||
task_id: RPF-WP-0035-T08
|
||||
related_workplan: AUDIT-WP-0009-T09
|
||||
decision_id: 2c9fe9f0-034a-41d7-9d49-b99df488fdc8
|
||||
decision_api_url: http://127.0.0.1:8000/decisions/2c9fe9f0-034a-41d7-9d49-b99df488fdc8
|
||||
|
|
@ -0,0 +1,110 @@
|
|||
id: CCR-2026-0022
|
||||
kind: credential-change-request
|
||||
schema_version: 1
|
||||
request_type: workload-kv-read
|
||||
title: informed-decision load-bearing audit sender custody and delivery
|
||||
status: proposed
|
||||
created: '2026-09-11'
|
||||
updated: '2026-09-11'
|
||||
requester:
|
||||
agent: codex
|
||||
reason: AUDIT-WP-0009-T11 and HFACT-WP-0001-T03 require the existing exact sender declaration. This
|
||||
request supplies the missing platform custody and ESO delivery; receiver compatibility and service
|
||||
rollout remain explicit gates.
|
||||
review:
|
||||
required: true
|
||||
required_approvers:
|
||||
- platform-operator
|
||||
- audit-core-owner
|
||||
- informed-decision-owner
|
||||
comments: []
|
||||
target:
|
||||
domain: financials
|
||||
tenant: platform
|
||||
workload: informed-decision
|
||||
environment: production
|
||||
purpose: Provide only the informed-decision sender with source=informed-decision, tenants=[tenant:platform],
|
||||
may_write=true, may_read=false, evidence_kind=load-bearing, secret_policy=redact. Preserve the
|
||||
existing receiver registry and every other sender.
|
||||
openbao:
|
||||
mount: platform
|
||||
kv_path: platform/workloads/informed-decision/audit-sender
|
||||
fields:
|
||||
- AUDIT_TOKEN
|
||||
- CUSTODY_REQUEST
|
||||
policy_name: workload-kv-read-informed-decision-audit
|
||||
policy_file: openbao/policies/workload-kv-read-informed-decision-audit.hcl
|
||||
metadata_read: false
|
||||
auth:
|
||||
method: kubernetes
|
||||
mount: kubernetes
|
||||
role: external-secrets-informed-decision-audit
|
||||
bound_claims:
|
||||
service_account_names:
|
||||
- external-secrets
|
||||
service_account_namespaces:
|
||||
- external-secrets
|
||||
bound_claims_confirmed: true
|
||||
policies:
|
||||
- workload-kv-read-informed-decision-audit
|
||||
ttl: 15m
|
||||
access_frontdoor:
|
||||
type: external-secrets
|
||||
catalog_id: informed-decision-audit
|
||||
readiness: pending-review
|
||||
resolvable: false
|
||||
delivery:
|
||||
surface: external-secrets
|
||||
target: 'ClusterSecretStore openbao-informed-decision-audit restricted to namespace informed-decision;
|
||||
ExternalSecret and Secret informed-decision/informed-decision-audit, key token. Source: manifests/factory-audit-senders.yaml.
|
||||
A missing namespace stays a workload-owner prerequisite; this packet creates none.'
|
||||
risk:
|
||||
classification: high
|
||||
notes:
|
||||
- A bearer permits append for its exact sender and tenant, never reading or changing stored evidence.
|
||||
- The registry update reads existing sender credentials inside the attended platform process only.
|
||||
No registry is delivered to a producer.
|
||||
- OpenBao login TTL limits the ESO reader session, not the audit bearer. Revocation must remove
|
||||
the sender token from the receiver registry and prove refusal.
|
||||
- New paths extend the existing coding-agent deny boundary. No existing high-risk grant is widened.
|
||||
verification:
|
||||
positive:
|
||||
- Independent CAS=0 token creation and exact sender merge with registry-version compare-and-set;
|
||||
repeated runs preserve both tokens and other registry fields.
|
||||
- ESO delivers only AUDIT_TOKEN into informed-decision/informed-decision-audit:token; source and
|
||||
receiver copies agree without displaying values.
|
||||
- Compatible deployed receiver accepts and deduplicates a declared synthetic event for the exact
|
||||
sender and tenant, retaining load-bearing/redact declarations.
|
||||
negative:
|
||||
- Sibling sender path, full registry and parent listing are denied to each workload reader. Wrong
|
||||
service account/namespace and disallowed store namespace fail.
|
||||
- Receiver denies sibling source, wrong tenant, every read route and revoked token. No existing
|
||||
sender is removed or re-scoped.
|
||||
- Proposed or altered CCR, legacy receiver, malformed/duplicate registry identity, token collision,
|
||||
stale registry version or partial/conflicting custody refuses without overwriting.
|
||||
activation_conditions:
|
||||
- All three named owner reviews are approved before any native credential mutation.
|
||||
- A current image supporting evidence_kind is published/admitted by audit-core and deployed with
|
||||
its source scope and network policy; current c2fe39a image fails compatibility.
|
||||
- Use the Warden attended platform-admin login envelope; preserve independent receipt and revoke
|
||||
the session on exit.
|
||||
- Apply reviewed policy/auth metadata and ESO projection only after receiver compatibility and namespace
|
||||
readiness. An interrupted seed resumes from durable KV values, never blindly rotates or deletes.
|
||||
- Record native positive/negative evidence before declaring verified or active. Custody alone does
|
||||
not admit UI, human approval or factory execution.
|
||||
lifecycle:
|
||||
deactivate: Stop the exact producer; remove only its admitted token from the registry using CAS
|
||||
and reload/verify receiver refusal. Then detach its reader policy and remove its ExternalSecret/projection,
|
||||
retaining KV versions for investigation. Do not delete audit events or other sender entries.
|
||||
rotate: 'Reviewed overlap-first rotation: append a replacement to this sender only, deliver it,
|
||||
prove acceptance, then remove the predecessor and prove refusal. The first-provision helper refuses
|
||||
rotation and unexpected existing values.'
|
||||
compromised: Stop affected producer and revoke the exact receiver token first; inspect affected
|
||||
source/tenant events, rotate through a separate reviewed action, and preserve the independent
|
||||
audit trail.
|
||||
state_hub:
|
||||
workplan_id: RPF-WP-0035
|
||||
task_id: RPF-WP-0035-T08
|
||||
related_workplan: AUDIT-WP-0009-T11
|
||||
decision_id: ee4ff001-256a-4406-9cb8-51be2cd5d31b
|
||||
decision_api_url: http://127.0.0.1:8000/decisions/ee4ff001-256a-4406-9cb8-51be2cd5d31b
|
||||
121
docs/credential-lane-designs/factory-audit-senders-review.md
Normal file
121
docs/credential-lane-designs/factory-audit-senders-review.md
Normal file
|
|
@ -0,0 +1,121 @@
|
|||
# Factory audit senders: concrete custody review
|
||||
|
||||
CCR-2026-0021 and CCR-2026-0022 are **proposed**. RPF-WP-0035-T08 owns the
|
||||
platform work; AUDIT-WP-0009-T09/T11 retain receiver admission. This packet
|
||||
requires the named platform operator, Audit Core owner and each producer owner
|
||||
to approve its request before native credential mutation.
|
||||
|
||||
## Scope to approve
|
||||
|
||||
| Request | Producer / exact source | OpenBao path | Producer Secret / key |
|
||||
| --- | --- | --- | --- |
|
||||
| CCR-2026-0021 | approval-engine | platform/workloads/approval-engine/audit-sender | approval-engine/approval-engine-audit / audit-token |
|
||||
| CCR-2026-0022 | informed-decision | platform/workloads/informed-decision/audit-sender | informed-decision/informed-decision-audit / token |
|
||||
|
||||
Each sender is limited to `tenant:platform`, write true, read false,
|
||||
`evidence_kind: load-bearing`, `secret_policy: redact`. The producer receives
|
||||
only its own `AUDIT_TOKEN`. `CUSTODY_REQUEST` is a non-secret provenance marker
|
||||
stored beside that token, enabling an interrupted first provision to identify
|
||||
its own version-1 value. It is not projected to the producer.
|
||||
|
||||
Each lane has its own exact-path policy, Kubernetes auth role and namespace-
|
||||
restricted ClusterSecretStore. Only `external-secrets/external-secrets` may
|
||||
log in to the reader role (15-minute session). Neither producer can read the
|
||||
full sender registry or its sibling's token. The coding-agent boundary gains
|
||||
exact denies on the two new data/metadata paths; existing rules are preserved.
|
||||
|
||||
The approved first-provision operation would generate two independent values
|
||||
in the attended platform process, store them with CAS=0, and append the exact
|
||||
identities to `platform/workloads/audit-core/senders` with compare-and-set on
|
||||
its observed KV version. That process necessarily reads the existing registry
|
||||
in memory; it never emits its credentials or gives it to a producer. No token
|
||||
passes through Git, a Hub record, command arguments or stdout/stderr.
|
||||
|
||||
## Blocking receiver finding
|
||||
|
||||
On 2026-09-11 the native receiver is 1/1 Ready on
|
||||
`forgejo.coulomb.social/coulomb/audit-core@sha256:c2fe39a0185b99be3fc0cb14d2de69772b8e66e20490097c9d11d90cc39719a6`.
|
||||
Its `SenderIdentity` has **no evidence_kind support**. A synthetic registration
|
||||
probe in the native pod fails the load-bearing contract; the same probe against
|
||||
current Audit Core source passes. Readiness did not detect this contract gap.
|
||||
|
||||
`factory_audit_custody.py receiver-check` now enforces that contract before any
|
||||
credential access. An approved CCR alone cannot bypass it. Audit Core must
|
||||
build, publish, admit and roll out its current implementation and source scope
|
||||
first. Its existing AUDIT-WP-0009-T09/T11 tasks retain that work; no completed
|
||||
source task is reopened. No receiver restart or deployment was done here.
|
||||
|
||||
Approval Engine's namespace is also absent. Three of four ESO objects passed
|
||||
server dry-run in their intended namespaces; its ExternalSecret was refused
|
||||
because that namespace does not exist. This packet creates no namespace,
|
||||
workload or network permission. Its owner must supply that prerequisite.
|
||||
|
||||
## Executable sequence
|
||||
|
||||
Review the source and exact policies:
|
||||
|
||||
```sh
|
||||
python3 scripts/credential-change.py render CCR-2026-0021
|
||||
python3 scripts/credential-change.py render CCR-2026-0022
|
||||
python3 scripts/factory_audit_custody.py plan
|
||||
```
|
||||
|
||||
After a compatible receiver release, the credential-free check is:
|
||||
|
||||
```sh
|
||||
python3 scripts/factory_audit_custody.py receiver-check \
|
||||
--kubeconfig /operator/railiance-kubeconfig \
|
||||
--expected-receiver-image forgejo.coulomb.social/coulomb/audit-core@sha256:ADMITTED_DIGEST \
|
||||
--receipt /operator/unique-receiver-receipt.json
|
||||
```
|
||||
|
||||
The seed command requires approved CCR files with all named owner reviews,
|
||||
the expected image, exact Railiance cluster UID, ready/current pod, both target
|
||||
namespaces and the Warden attended platform-admin login envelope. Route via
|
||||
`warden route show openbao-platform-admin-login --json` before arranging access.
|
||||
Use its installed attended wrapper; do not copy a token into the command.
|
||||
|
||||
Inside that envelope, invoke:
|
||||
|
||||
```sh
|
||||
python3 scripts/factory_audit_custody.py seed \
|
||||
--kubeconfig /operator/railiance-kubeconfig \
|
||||
--expected-receiver-image forgejo.coulomb.social/coulomb/audit-core@sha256:ADMITTED_DIGEST \
|
||||
--confirm 'PROVISION CCR-2026-0021 CCR-2026-0022' \
|
||||
--receipt /operator/unique-custody-receipt.json
|
||||
```
|
||||
|
||||
A successful seed deliberately reports
|
||||
`custody_seeded_pending_delivery_and_receiver_reload`. It applies the exact
|
||||
reader metadata and seeds custody, but does not apply ESO objects, reload the
|
||||
shared receiver or claim live ingestion. Preserve that receipt. After an
|
||||
interruption, review it and use `--resume` with a new receipt: only exact
|
||||
request-owned version-1 custody is reused. Changed tokens, source scopes,
|
||||
provenance, unknown duplicate identities and concurrent registry writes refuse.
|
||||
No automatic deletion or rotation is attempted on failure.
|
||||
|
||||
Under the same reviewed lane, the subsequent attended delivery uses
|
||||
`manifests/factory-audit-senders.yaml`; verify both stores/ExternalSecrets and
|
||||
exact token equality inside the protected process. Sync the existing registry
|
||||
ExternalSecret, verify its update, and reload Audit Core through its owner
|
||||
runbook. Then run each real producer's accepted/duplicate and wrong-source,
|
||||
wrong-tenant/read-refusal checks and retrieve evidence with the independent
|
||||
operator reader. The script does not yet automate these owner acceptance steps.
|
||||
Do not mark either CCR verified/active until those receipts exist.
|
||||
|
||||
## Revocation and limits
|
||||
|
||||
ESO login expiry does **not** expire an audit bearer. Stop the affected producer,
|
||||
remove only its token from the receiver registry using CAS, reload the receiver
|
||||
and prove refusal, then disable its reader/projection. Retain stored events and
|
||||
KV provenance. Rotation is separately reviewed and overlap-first. Existing
|
||||
senders and reader permissions remain intact.
|
||||
|
||||
`warden route show audit-core-senders` still points to the older Mason bootstrap.
|
||||
The receiver runbook records the later OpenBao migration; this packet uses that
|
||||
current authority and the platform's existing attended custody mechanics. It
|
||||
creates no second registry or generic credential broker.
|
||||
|
||||
Factory policy/caller admission, registered human binding, CCR-2026-0019's
|
||||
operator group, native runtime delivery and spending/operating acceptance stay
|
||||
with their existing records. Sender approval does not admit any of those acts.
|
||||
81
docs/evidence/2026-09-11-factory-audit-custody.json
Normal file
81
docs/evidence/2026-09-11-factory-audit-custody.json
Normal file
|
|
@ -0,0 +1,81 @@
|
|||
{
|
||||
"schema": "platform.factory-audit-custody-preparation.v1",
|
||||
"observed_at": "2026-09-11T00:00:15.014528+00:00",
|
||||
"platform_base_commit": "d3a502b45cebc0a658d0ee7499f1cfcf2a5902a4",
|
||||
"owner_task": "RPF-WP-0035-T08",
|
||||
"source_records": [
|
||||
"CCR-2026-0021",
|
||||
"CCR-2026-0022",
|
||||
"AUDIT-WP-0009-T09",
|
||||
"AUDIT-WP-0009-T11"
|
||||
],
|
||||
"status": "proposed_custody_with_receiver_release_prerequisite",
|
||||
"verification": {
|
||||
"new_tests_passed": 17,
|
||||
"existing_credential_change_tests_passed": 53,
|
||||
"tests_skipped": 0,
|
||||
"local_openbao_test_cases": 11,
|
||||
"actual_receiver_source_contract_passed": true,
|
||||
"all_22_ccrs_valid": true,
|
||||
"server_dry_run": {
|
||||
"objects": 4,
|
||||
"exact_namespace_passed": 3,
|
||||
"refusal": "approval-engine namespace absent",
|
||||
"cluster_changes_applied": 0
|
||||
}
|
||||
},
|
||||
"native_receiver": {
|
||||
"image": "forgejo.coulomb.social/coulomb/audit-core@sha256:c2fe39a0185b99be3fc0cb14d2de69772b8e66e20490097c9d11d90cc39719a6",
|
||||
"ready_replicas": 1,
|
||||
"replicas": 1,
|
||||
"evidence_kind_supported": false,
|
||||
"probe": "synthetic SenderRegistry contract in exact deployed pod; no environment registry read",
|
||||
"entry_refusal": "receiver_lacks_sender_contract",
|
||||
"credential_reads": 0,
|
||||
"source_contract_commit": "5c0ad522fb36092aa7ec2e8d72f63a5a91853b5b"
|
||||
},
|
||||
"recovery_proven": [
|
||||
"interruption after first token write reuses the same value",
|
||||
"lost registry write reply reconciles without another write",
|
||||
"concurrent registry change is preserved by CAS refusal then deliberate resume",
|
||||
"wrong provenance/scope/duplicate names/token collisions refuse",
|
||||
"each exact read policy denies sibling data, full registry and metadata",
|
||||
"all named approvals and exact credential coordinates are enforced"
|
||||
],
|
||||
"routing_finding": {
|
||||
"catalog": "audit-core-senders",
|
||||
"status": "draft",
|
||||
"catalog_points_to": "ops-mason bootstrap",
|
||||
"current_authority": "platform/workloads/audit-core/senders per audit-core operator runbook",
|
||||
"execution_owner": "railiance-platform attended custody; existing platform helper pattern"
|
||||
},
|
||||
"pending_decisions": [
|
||||
{
|
||||
"ccr": "CCR-2026-0021",
|
||||
"status": 201,
|
||||
"decision_id": "2c9fe9f0-034a-41d7-9d49-b99df488fdc8"
|
||||
},
|
||||
{
|
||||
"ccr": "CCR-2026-0022",
|
||||
"status": 201,
|
||||
"decision_id": "ee4ff001-256a-4406-9cb8-51be2cd5d31b"
|
||||
}
|
||||
],
|
||||
"source_sha256": {
|
||||
"scripts/factory_audit_custody.py": "77b5bd7bd1b27a642d87d73d799b8896ebca1808b7c95fc47dd603ba74d8d30e",
|
||||
"tests/test_factory_audit_custody.py": "aef55cb98862dd62e2202fe4d2348aa8915f23d059331fd07d5644598452dc9f",
|
||||
"manifests/factory-audit-senders.yaml": "3d682dfd517b516dcb20c40373aae2557e4d8d2b49b3392d75c2cb36cd80785d",
|
||||
"openbao/policies/agent-high-risk-boundary.hcl": "9d863886c815740e65458417949c73a616b6e038594979b343ea07d08c585f64",
|
||||
"openbao/policies/workload-kv-read-approval-engine-audit.hcl": "a527c3bdfe7bf356fcd19f499ebc3ad75a71256a22c19882ad0dfdd09e0f0eb9",
|
||||
"openbao/policies/workload-kv-read-informed-decision-audit.hcl": "389e952546d32692e87b4f249752a9bee0fafa9fc58bf50ab8904110bf6b3780",
|
||||
"credential-change-requests/CCR-2026-0021-approval-engine-audit.yaml": "33f3bb5d32f2dbada864e1b89cdb47fcb9742dfe313eb391ca2f342be6bc119a",
|
||||
"credential-change-requests/CCR-2026-0022-informed-decision-audit.yaml": "7656519a7be847e6cf1b4e3e03200c68f5a36d87db8c81b84a16511b5dfe5d3a",
|
||||
"docs/credential-lane-designs/factory-audit-senders-review.md": "70e7a3568821672c84e0ce0388f7b8bc7d1b920354b38153995ec45022c53e52"
|
||||
},
|
||||
"native_credentials_created": 0,
|
||||
"native_secret_reads": 0,
|
||||
"native_policy_writes": 0,
|
||||
"native_deployments": 0,
|
||||
"factory_attempts": 0,
|
||||
"paid_model_calls": 0
|
||||
}
|
||||
94
manifests/factory-audit-senders.yaml
Normal file
94
manifests/factory-audit-senders.yaml
Normal file
|
|
@ -0,0 +1,94 @@
|
|||
# CCR-2026-0021/0022. Review only; no credentials or namespaces.
|
||||
apiVersion: external-secrets.io/v1
|
||||
kind: ClusterSecretStore
|
||||
metadata:
|
||||
name: openbao-approval-engine-audit
|
||||
annotations:
|
||||
railiance.io/credential-change: CCR-2026-0021
|
||||
railiance.io/admission: proposed
|
||||
spec:
|
||||
provider:
|
||||
vault:
|
||||
server: http://openbao.openbao.svc:8200
|
||||
path: platform
|
||||
version: v2
|
||||
auth:
|
||||
kubernetes:
|
||||
mountPath: kubernetes
|
||||
role: external-secrets-approval-engine-audit
|
||||
serviceAccountRef:
|
||||
name: external-secrets
|
||||
namespace: external-secrets
|
||||
conditions:
|
||||
- namespaces:
|
||||
- approval-engine
|
||||
---
|
||||
apiVersion: external-secrets.io/v1
|
||||
kind: ExternalSecret
|
||||
metadata:
|
||||
name: approval-engine-audit
|
||||
namespace: approval-engine
|
||||
annotations:
|
||||
railiance.io/credential-change: CCR-2026-0021
|
||||
railiance.io/admission: proposed
|
||||
spec:
|
||||
refreshInterval: 5m
|
||||
secretStoreRef:
|
||||
kind: ClusterSecretStore
|
||||
name: openbao-approval-engine-audit
|
||||
target:
|
||||
name: approval-engine-audit
|
||||
creationPolicy: Owner
|
||||
deletionPolicy: Retain
|
||||
data:
|
||||
- secretKey: audit-token
|
||||
remoteRef:
|
||||
key: workloads/approval-engine/audit-sender
|
||||
property: AUDIT_TOKEN
|
||||
---
|
||||
apiVersion: external-secrets.io/v1
|
||||
kind: ClusterSecretStore
|
||||
metadata:
|
||||
name: openbao-informed-decision-audit
|
||||
annotations:
|
||||
railiance.io/credential-change: CCR-2026-0022
|
||||
railiance.io/admission: proposed
|
||||
spec:
|
||||
provider:
|
||||
vault:
|
||||
server: http://openbao.openbao.svc:8200
|
||||
path: platform
|
||||
version: v2
|
||||
auth:
|
||||
kubernetes:
|
||||
mountPath: kubernetes
|
||||
role: external-secrets-informed-decision-audit
|
||||
serviceAccountRef:
|
||||
name: external-secrets
|
||||
namespace: external-secrets
|
||||
conditions:
|
||||
- namespaces:
|
||||
- informed-decision
|
||||
---
|
||||
apiVersion: external-secrets.io/v1
|
||||
kind: ExternalSecret
|
||||
metadata:
|
||||
name: informed-decision-audit
|
||||
namespace: informed-decision
|
||||
annotations:
|
||||
railiance.io/credential-change: CCR-2026-0022
|
||||
railiance.io/admission: proposed
|
||||
spec:
|
||||
refreshInterval: 5m
|
||||
secretStoreRef:
|
||||
kind: ClusterSecretStore
|
||||
name: openbao-informed-decision-audit
|
||||
target:
|
||||
name: informed-decision-audit
|
||||
creationPolicy: Owner
|
||||
deletionPolicy: Retain
|
||||
data:
|
||||
- secretKey: token
|
||||
remoteRef:
|
||||
key: workloads/informed-decision/audit-sender
|
||||
property: AUDIT_TOKEN
|
||||
|
|
@ -129,3 +129,9 @@ path "platform/data/workloads/secrets-engine/approval-client" { capabilities = [
|
|||
path "platform/data/workloads/approval-engine/operator-client" { capabilities = ["deny"] }
|
||||
path "platform/metadata/workloads/secrets-engine/approval-client" { capabilities = ["deny"] }
|
||||
path "platform/metadata/workloads/approval-engine/operator-client" { capabilities = ["deny"] }
|
||||
|
||||
# Proposed factory audit sender custody: CCR-2026-0021 / CCR-2026-0022.
|
||||
path "platform/data/workloads/approval-engine/audit-sender" { capabilities = ["deny"] }
|
||||
path "platform/metadata/workloads/approval-engine/audit-sender" { capabilities = ["deny"] }
|
||||
path "platform/data/workloads/informed-decision/audit-sender" { capabilities = ["deny"] }
|
||||
path "platform/metadata/workloads/informed-decision/audit-sender" { capabilities = ["deny"] }
|
||||
|
|
|
|||
|
|
@ -0,0 +1,3 @@
|
|||
path "platform/data/workloads/approval-engine/audit-sender" {
|
||||
capabilities = ["read"]
|
||||
}
|
||||
|
|
@ -0,0 +1,3 @@
|
|||
path "platform/data/workloads/informed-decision/audit-sender" {
|
||||
capabilities = ["read"]
|
||||
}
|
||||
268
scripts/factory_audit_custody.py
Normal file
268
scripts/factory_audit_custody.py
Normal file
|
|
@ -0,0 +1,268 @@
|
|||
#!/usr/bin/env python3
|
||||
"""Attended first-provision custody for the two factory audit senders.
|
||||
|
||||
Plan and receiver-check never read credential values. Seed needs the reviewed
|
||||
CCRs and a compatible receiver; it does not deploy or reload any workload.
|
||||
"""
|
||||
from __future__ import annotations
|
||||
|
||||
import argparse
|
||||
import copy
|
||||
import hashlib
|
||||
import importlib.util
|
||||
import json
|
||||
import os
|
||||
from pathlib import Path
|
||||
import re
|
||||
import secrets
|
||||
from datetime import datetime, timezone
|
||||
|
||||
from state_hub_preflight_lane import ROOT, LaneError, assert_cluster, bao, command, data
|
||||
from keycape_approval_custody import read_optional, role_matches
|
||||
|
||||
REGISTRY = 'platform/data/workloads/audit-core/senders'
|
||||
BOUNDARY = 'sys/policies/acl/agent-high-risk-boundary'
|
||||
LANES = (('CCR-2026-0021', 'approval-engine', 'audit-token'),
|
||||
('CCR-2026-0022', 'informed-decision', 'token'))
|
||||
CONFIRM = 'PROVISION CCR-2026-0021 CCR-2026-0022'
|
||||
# This probes synthetic identities only; no environment-backed registry is read.
|
||||
RECEIVER_PROBE = '''import json
|
||||
from audit_core.senders import SenderRegistry
|
||||
entry={"name":"compatibility-fixture","tokens":["fixture-only"],"sources":["compatibility-fixture"],"tenants":["tenant:platform"],"may_write":True,"may_read":False,"evidence_kind":"load-bearing","secret_policy":"redact"}
|
||||
r=SenderRegistry.from_env({"AUDIT_CORE_SENDERS":json.dumps([entry])})
|
||||
s=r.authenticate("Bearer fixture-only")
|
||||
print(json.dumps({"load_bearing":getattr(s,"evidence_kind",None)=="load-bearing","redact":s.secret_policy=="redact","write_only":s.may_write and not s.may_read,"source_exact":s.permits_source("compatibility-fixture") and not s.permits_source("sibling"),"tenant_exact":s.permits_tenant("tenant:platform") and not s.permits_tenant("tenant:sibling")}))
|
||||
'''
|
||||
|
||||
|
||||
def require(condition, code):
|
||||
if not condition:
|
||||
raise LaneError(code)
|
||||
|
||||
|
||||
def credential_module():
|
||||
spec = importlib.util.spec_from_file_location('factory_ccr', ROOT / 'scripts/credential-change.py')
|
||||
module = importlib.util.module_from_spec(spec); spec.loader.exec_module(module)
|
||||
return module
|
||||
|
||||
|
||||
def contracts(*, approved=False):
|
||||
module = credential_module()
|
||||
result = []
|
||||
for ref, name, secret_key in LANES:
|
||||
path = module.resolve_ccr(ref)
|
||||
ccr, errors, _ = module.validate_ccr(path)
|
||||
require(not errors, 'invalid_credential_request')
|
||||
if approved:
|
||||
require(ccr['status'] in {'approved', 'applied', 'verified', 'active'}, 'approved_ccrs_required')
|
||||
for owner in ('platform-operator', 'audit-core-owner', name + '-owner'):
|
||||
require(any(x.get('decision') == 'approved' and owner in x.get('reviewer', '')
|
||||
for x in ccr['review']['comments']), 'named_owner_reviews_required')
|
||||
suffix = name + '-audit'; policy = 'workload-kv-read-' + suffix
|
||||
expected_role = {'bound_service_account_names':['external-secrets'],
|
||||
'bound_service_account_namespaces':['external-secrets'],
|
||||
'policies':policy,'ttl':'15m'}
|
||||
expected_path = f'platform/workloads/{name}/audit-sender'
|
||||
require(ccr['openbao']['kv_path'] == expected_path
|
||||
and ccr['openbao']['fields'] == ['AUDIT_TOKEN', 'CUSTODY_REQUEST']
|
||||
and ccr['openbao']['policy_name'] == policy
|
||||
and ccr['openbao']['metadata_read'] is False
|
||||
and ccr['openbao']['auth']['role'] == 'external-secrets-' + suffix
|
||||
and ccr['openbao']['auth']['mount'] == 'kubernetes'
|
||||
and ccr['openbao']['auth']['bound_claims_confirmed'] is True
|
||||
and module.auth_payload(ccr) == expected_role, 'exact_contract_required')
|
||||
hcl = module.generated_policy_hcl(ccr)
|
||||
require((ROOT / ccr['openbao']['policy_file']).read_text() == hcl, 'policy_source_drift')
|
||||
result.append({'ccr':ref,'name':name,'kv':expected_path.replace('platform/','platform/data/',1),
|
||||
'metadata':expected_path.replace('platform/','platform/metadata/',1),
|
||||
'policy':policy,'hcl':hcl,'role':'external-secrets-'+suffix,
|
||||
'role_payload':expected_role,'store':'openbao-'+suffix,'secret':suffix,
|
||||
'secret_key':secret_key,'source_sha256':hashlib.sha256(path.read_bytes()).hexdigest()})
|
||||
return result
|
||||
|
||||
|
||||
def receiver_check(kube, expected_image):
|
||||
require(re.fullmatch(r'forgejo\.coulomb\.social/coulomb/audit-core@sha256:[0-9a-f]{64}', expected_image), 'receiver_digest_required')
|
||||
assert_cluster(kube)
|
||||
dep = data(command(kube + ['-n','audit-core','get','deployment','audit-core','-o','json']))
|
||||
require(dep['spec']['replicas'] == 1 and dep.get('status',{}).get('readyReplicas') == 1
|
||||
and dep['status'].get('observedGeneration',0) >= dep['metadata']['generation'], 'receiver_not_ready')
|
||||
containers = dep['spec']['template']['spec']['containers']
|
||||
require(len(containers) == 1 and containers[0]['image'] == expected_image, 'receiver_image_mismatch')
|
||||
pods = data(command(kube + ['-n','audit-core','get','pods','-l','app.kubernetes.io/name=audit-core','-o','json']))['items']
|
||||
require(len(pods) == 1 and not pods[0]['metadata'].get('deletionTimestamp'), 'receiver_rollout_in_progress')
|
||||
pod = pods[0]
|
||||
require(pod['spec']['containers'][0]['image'] == expected_image
|
||||
and all(x.get('ready') for x in pod.get('status',{}).get('containerStatuses',[]))
|
||||
and pod.get('status',{}).get('containerStatuses'), 'receiver_pod_not_current')
|
||||
proof = data(command(kube + ['-n','audit-core','exec',pod['metadata']['name'],'-c',containers[0]['name'],
|
||||
'--','python','-c',RECEIVER_PROBE]))
|
||||
require(set(proof) == {'load_bearing','redact','write_only','source_exact','tenant_exact'}
|
||||
and all(v is True for v in proof.values()), 'receiver_lacks_sender_contract')
|
||||
return {'image':expected_image,'deployment_uid':dep['metadata']['uid'],
|
||||
'deployment_resource_version':dep['metadata']['resourceVersion'],'pod_uid':pod['metadata']['uid'],
|
||||
'capabilities':proof,'synthetic_probe_only':True,'credential_reads':0}
|
||||
|
||||
|
||||
def snapshot():
|
||||
raw = data(bao(['read','-format=json',REGISTRY]))['data']
|
||||
require(type(raw['metadata']['version']) is int and raw['metadata']['version'] > 0, 'registry_version_missing')
|
||||
body = raw['data']; require(isinstance(body,dict) and isinstance(body.get('senders.json'),str), 'registry_shape_invalid')
|
||||
try:
|
||||
rows = json.loads(body['senders.json'])
|
||||
except (ValueError, TypeError):
|
||||
raise LaneError('registry_shape_invalid') from None
|
||||
require(isinstance(rows,list) and bool(rows), 'registry_must_preserve_existing_senders')
|
||||
names = set(); tokens = set()
|
||||
for row in rows:
|
||||
require(isinstance(row,dict) and isinstance(row.get('name'),str) and row['name']
|
||||
and row['name'] not in names, 'registry_identity_invalid_or_duplicate')
|
||||
names.add(row['name'])
|
||||
values = row.get('tokens') or ([row['token']] if row.get('token') else [])
|
||||
require(isinstance(values,list) and bool(values), 'registry_tokens_invalid')
|
||||
for value in values:
|
||||
require(isinstance(value,str) and bool(value) and value not in tokens, 'registry_token_collision')
|
||||
tokens.add(value)
|
||||
return raw['metadata']['version'], body, rows, tokens
|
||||
|
||||
|
||||
def desired(lane, token):
|
||||
return {'name':lane['name'],'tokens':[token],'sources':[lane['name']],
|
||||
'tenants':['tenant:platform'],'may_write':True,'may_read':False,
|
||||
'evidence_kind':'load-bearing','secret_policy':'redact'}
|
||||
|
||||
|
||||
def seed(lanes, receipt, save, *, resume=False):
|
||||
version, body, rows, used_tokens = snapshot()
|
||||
originals = copy.deepcopy(rows)
|
||||
found = {r['name']:r for r in rows}
|
||||
values = {}; pending = []
|
||||
# Validate every existing custody object before any write. Only this exact
|
||||
# request's version-1 values can be reused after interruption.
|
||||
for lane in lanes:
|
||||
old = read_optional(lane['metadata'])
|
||||
if old is None:
|
||||
require(lane['name'] not in found, 'registry_sender_without_custody')
|
||||
pending.append(lane)
|
||||
else:
|
||||
require(resume and old['current_version'] == 1
|
||||
and not old['versions']['1'].get('destroyed')
|
||||
and not old['versions']['1'].get('deletion_time'), 'existing_custody_requires_reviewed_resume')
|
||||
existing = data(bao(['read','-format=json',lane['kv']]))['data']
|
||||
require(existing['metadata']['version'] == 1
|
||||
and set(existing['data']) == {'AUDIT_TOKEN','CUSTODY_REQUEST'}
|
||||
and existing['data']['CUSTODY_REQUEST'] == lane['ccr'], 'custody_provenance_mismatch')
|
||||
token = existing['data']['AUDIT_TOKEN']
|
||||
require(isinstance(token,str) and re.fullmatch(r'[A-Za-z0-9_-]{64}',token), 'custody_token_shape')
|
||||
require(token not in values.values(), 'sender_token_collision')
|
||||
if lane['name'] in found:
|
||||
require(found[lane['name']] == desired(lane,token), 'registered_sender_drift')
|
||||
else:
|
||||
require(token not in used_tokens, 'sender_token_collision')
|
||||
values[lane['name']] = token
|
||||
receipt.update(registry_version_before=version,phase='custody_seed')
|
||||
save()
|
||||
for lane in pending:
|
||||
token = secrets.token_urlsafe(48)
|
||||
require(token not in used_tokens and token not in values.values(), 'sender_token_collision')
|
||||
result = data(bao(['write','-format=json',lane['kv'],'-'],payload={
|
||||
'options':{'cas':0},'data':{'AUDIT_TOKEN':token,'CUSTODY_REQUEST':lane['ccr']}}))
|
||||
require(result['data']['version'] == 1,'initial_custody_version_mismatch')
|
||||
values[lane['name']] = token
|
||||
receipt.setdefault('seeded',[]).append({'ccr':lane['ccr'],'version':1,'request_id':result.get('request_id')})
|
||||
save()
|
||||
updated = list(rows)
|
||||
for lane in lanes:
|
||||
if lane['name'] not in found:
|
||||
updated.append(desired(lane,values[lane['name']]))
|
||||
if updated != rows:
|
||||
receipt['phase']='registry_cas'; save()
|
||||
payload = dict(body, **{'senders.json':json.dumps(updated,separators=(',',':'))})
|
||||
result = data(bao(['write','-format=json',REGISTRY,'-'],payload={'options':{'cas':version},'data':payload}))
|
||||
receipt['registry_write_request_id']=result.get('request_id')
|
||||
# Readback also catches a concurrent removal rather than claiming a success.
|
||||
after_version, after_body, after_rows, _ = snapshot()
|
||||
require(all(x in after_rows for x in originals)
|
||||
and all(desired(lane,values[lane['name']]) in after_rows for lane in lanes)
|
||||
and all(after_body.get(k)==v for k,v in body.items() if k!='senders.json'), 'registry_readback_mismatch')
|
||||
receipt.update(registry_version_after=after_version,unchanged_other_senders=True,
|
||||
unchanged_other_registry_fields=True,credentials_reused=resume,
|
||||
status='custody_seeded_pending_delivery_and_receiver_reload')
|
||||
save()
|
||||
|
||||
|
||||
def prepare_metadata(lanes):
|
||||
# Avoid overwriting an unrelated policy or role. Do all drift checks first.
|
||||
for lane in lanes:
|
||||
policy=read_optional('sys/policies/acl/'+lane['policy'])
|
||||
role=read_optional('auth/kubernetes/role/'+lane['role'])
|
||||
require(policy is None or policy['policy']==lane['hcl'],'existing_policy_drift')
|
||||
require(role is None or role_matches(role,lane),'existing_role_drift')
|
||||
boundary=read_optional(BOUNDARY); require(boundary is not None,'coding_agent_boundary_required')
|
||||
current=boundary['policy']; additions=''
|
||||
for lane in lanes:
|
||||
for path in (lane['kv'],lane['metadata']):
|
||||
if '"'+path+'"' in current:
|
||||
require(re.search(r'path\s+"'+re.escape(path)+r'"\s*\{\s*capabilities\s*=\s*\["deny"\]\s*\}',current),'boundary_path_drift')
|
||||
else:
|
||||
additions+=f'path "{path}" {{ capabilities = ["deny"] }}\n'
|
||||
if additions:
|
||||
require(read_optional(BOUNDARY)['policy']==current,'boundary_revision_changed')
|
||||
bao(['write',BOUNDARY,'-'],payload={'policy':current+'\n'+additions})
|
||||
require(read_optional(BOUNDARY)['policy']==current+'\n'+additions,'boundary_readback_failed')
|
||||
for lane in lanes:
|
||||
bao(['write','sys/policies/acl/'+lane['policy'],'-'],payload={'policy':lane['hcl']})
|
||||
bao(['write','auth/kubernetes/role/'+lane['role'],'-'],payload=lane['role_payload'])
|
||||
require(read_optional('sys/policies/acl/'+lane['policy'])['policy']==lane['hcl']
|
||||
and role_matches(read_optional('auth/kubernetes/role/'+lane['role']),lane),'metadata_readback_failed')
|
||||
|
||||
|
||||
def main():
|
||||
parser=argparse.ArgumentParser(description=__doc__)
|
||||
parser.add_argument('action',choices=['plan','receiver-check','seed'])
|
||||
parser.add_argument('--kubeconfig'); parser.add_argument('--server')
|
||||
parser.add_argument('--expected-receiver-image'); parser.add_argument('--confirm')
|
||||
parser.add_argument('--receipt',type=Path); parser.add_argument('--resume',action='store_true')
|
||||
args=parser.parse_args()
|
||||
receipt={'schema':'platform.factory-audit-custody.v1','status':'refused','credential_values_emitted':False,
|
||||
'started_at':datetime.now(timezone.utc).isoformat()}
|
||||
fd=None
|
||||
try:
|
||||
lanes=contracts(approved=args.action=='seed')
|
||||
receipt['lanes']=[{k:v for k,v in x.items() if k in ('ccr','name','kv','store','secret','secret_key','source_sha256')} for x in lanes]
|
||||
if args.action=='plan':
|
||||
receipt['status']='proposed'; print(json.dumps(receipt,indent=2)); return 0
|
||||
require(args.kubeconfig and args.expected_receiver_image and args.receipt,'receiver_inputs_required')
|
||||
fd=os.open(args.receipt,os.O_RDWR|os.O_CREAT|os.O_EXCL|os.O_NOFOLLOW,0o600)
|
||||
def save():
|
||||
os.lseek(fd,0,os.SEEK_SET);os.ftruncate(fd,0)
|
||||
os.write(fd,(json.dumps(receipt,indent=2)+'\n').encode());os.fsync(fd)
|
||||
kube=['kubectl','--kubeconfig',args.kubeconfig,'--request-timeout=20s']
|
||||
if args.server:kube+=['--server',args.server]
|
||||
receipt['receiver']=receiver_check(kube,args.expected_receiver_image)
|
||||
if args.action=='receiver-check':
|
||||
receipt['status']='receiver_contract_supported';save();return 0
|
||||
require(args.confirm==CONFIRM,'exact_confirmation_required')
|
||||
require(Path.home().parent.name=='.warden-attended-login'
|
||||
and not os.environ.get('BAO_TOKEN') and not os.environ.get('VAULT_TOKEN'),'attended_warden_envelope_required')
|
||||
identity=data(bao(['token','lookup','-format=json']))['data']
|
||||
require('platform-admin' in identity['policies'] and 'root' not in identity['policies'],'attended_platform_admin_required')
|
||||
for lane in lanes:
|
||||
command(kube+['get','namespace',lane['name'],'-o','name'])
|
||||
# Refuse malformed registry before changing policy/auth metadata.
|
||||
snapshot()
|
||||
receipt['phase']='metadata';save();prepare_metadata(lanes)
|
||||
seed(lanes,receipt,save,resume=args.resume)
|
||||
return 0
|
||||
except Exception as exc:
|
||||
receipt['status']='refused'
|
||||
receipt['error']=str(exc) if isinstance(exc,LaneError) else 'contained_operation_failed'
|
||||
if fd is not None:
|
||||
save()
|
||||
print(json.dumps({'status':'refused','error':receipt['error']}))
|
||||
return 1
|
||||
finally:
|
||||
if fd is not None:os.close(fd)
|
||||
|
||||
|
||||
if __name__=='__main__':raise SystemExit(main())
|
||||
227
tests/test_factory_audit_custody.py
Normal file
227
tests/test_factory_audit_custody.py
Normal file
|
|
@ -0,0 +1,227 @@
|
|||
"""Disposable OpenBao and exact receiver compatibility tests; no native credentials."""
|
||||
import copy
|
||||
import importlib.util
|
||||
import json
|
||||
import os
|
||||
from pathlib import Path
|
||||
import secrets
|
||||
import shutil
|
||||
import socket
|
||||
import subprocess
|
||||
import sys
|
||||
import time
|
||||
import unittest
|
||||
from unittest.mock import patch
|
||||
import yaml
|
||||
|
||||
ROOT=Path(__file__).resolve().parents[1]
|
||||
sys.path.insert(0,str(ROOT/'scripts'))
|
||||
import factory_audit_custody as lane
|
||||
|
||||
|
||||
class Contracts(unittest.TestCase):
|
||||
def test_proposed_requests_cannot_seed(self):
|
||||
self.assertEqual(len(lane.contracts()),2)
|
||||
with patch.object(lane,'bao',side_effect=AssertionError('must not contact Bao')):
|
||||
with self.assertRaisesRegex(lane.LaneError,'approved_ccrs_required'):
|
||||
lane.contracts(approved=True)
|
||||
|
||||
def test_each_named_owner_approval_is_required(self):
|
||||
module=lane.credential_module()
|
||||
original=module.validate_ccr
|
||||
for missing in ['platform-operator','audit-core-owner','approval-engine-owner','informed-decision-owner']:
|
||||
def candidate(path):
|
||||
c,errors,warnings=original(path);c=copy.deepcopy(c);c['status']='approved'
|
||||
owners=['platform-operator','audit-core-owner',c['target']['workload']+'-owner']
|
||||
c['review']['comments']=[{'reviewer':owner,'decision':'approved'} for owner in owners if owner!=missing]
|
||||
return c,errors,warnings
|
||||
with patch.object(module,'validate_ccr',side_effect=candidate),patch.object(lane,'credential_module',return_value=module):
|
||||
with self.assertRaisesRegex(lane.LaneError,'named_owner_reviews_required'):lane.contracts(approved=True)
|
||||
|
||||
def test_altered_credential_coordinates_refuse_even_with_approvals(self):
|
||||
module=lane.credential_module();original=module.validate_ccr
|
||||
def candidate(path):
|
||||
c,errors,warnings=original(path);c=copy.deepcopy(c);c['status']='approved'
|
||||
c['review']['comments']=[{'reviewer':owner,'decision':'approved'} for owner in ['platform-operator','audit-core-owner',c['target']['workload']+'-owner']]
|
||||
c['openbao']['kv_path']='platform/workloads/audit-core/senders'
|
||||
return c,errors,warnings
|
||||
with patch.object(module,'validate_ccr',side_effect=candidate),patch.object(lane,'credential_module',return_value=module):
|
||||
with self.assertRaisesRegex(lane.LaneError,'exact_contract_required'):lane.contracts(approved=True)
|
||||
|
||||
def test_projection_only_delivers_one_field_per_exact_namespace(self):
|
||||
objects=list(yaml.safe_load_all((ROOT/'manifests/factory-audit-senders.yaml').read_text()))
|
||||
self.assertEqual([x['kind'] for x in objects],['ClusterSecretStore','ExternalSecret']*2)
|
||||
for contract,store,es in zip(lane.contracts(),objects[::2],objects[1::2]):
|
||||
self.assertEqual(store['spec']['conditions'],[{'namespaces':[contract['name']]}])
|
||||
self.assertEqual(es['metadata']['namespace'],contract['name'])
|
||||
self.assertEqual(es['spec']['data'],[{'secretKey':contract['secret_key'],'remoteRef':{'key':contract['kv'].removeprefix('platform/data/'),'property':'AUDIT_TOKEN'}}])
|
||||
self.assertEqual(es['spec']['secretStoreRef']['name'],store['metadata']['name'])
|
||||
self.assertNotIn('senders.json',json.dumps(es))
|
||||
|
||||
def test_current_receiver_source_supports_exact_contract(self):
|
||||
source=os.environ.get('AUDIT_CORE_SOURCE')
|
||||
if not source:self.skipTest('set AUDIT_CORE_SOURCE for actual receiver contract')
|
||||
result=subprocess.run([sys.executable,'-c',lane.RECEIVER_PROBE],cwd=source,capture_output=True,text=True,check=True)
|
||||
self.assertTrue(all(json.loads(result.stdout).values()))
|
||||
|
||||
def test_legacy_receiver_is_refused_before_credentials(self):
|
||||
dep={'metadata':{'uid':'d','generation':1,'resourceVersion':'1'},'spec':{'replicas':1,'template':{'spec':{'containers':[{'name':'audit-core','image':'forgejo.coulomb.social/coulomb/audit-core@sha256:'+'a'*64}]}}},'status':{'observedGeneration':1,'readyReplicas':1}}
|
||||
pod={'metadata':{'name':'audit-core-test','uid':'p'},'spec':dep['spec']['template']['spec'],'status':{'containerStatuses':[{'ready':True}]}}
|
||||
responses=[dep,{'items':[pod]},{'load_bearing':False,'redact':True,'write_only':True,'source_exact':True,'tenant_exact':True}]
|
||||
with patch.object(lane,'assert_cluster'),patch.object(lane,'command',side_effect=[subprocess.CompletedProcess([],0,json.dumps(x).encode(),b'') for x in responses]),patch.object(lane,'bao',side_effect=AssertionError('no credentials')):
|
||||
with self.assertRaisesRegex(lane.LaneError,'receiver_lacks_sender_contract'):
|
||||
lane.receiver_check(['kubectl'],dep['spec']['template']['spec']['containers'][0]['image'])
|
||||
|
||||
|
||||
class OpenBaoExercise(unittest.TestCase):
|
||||
@classmethod
|
||||
def setUpClass(cls):
|
||||
if not shutil.which('bao'):raise unittest.SkipTest('local OpenBao binary required')
|
||||
with socket.socket() as s:s.bind(('127.0.0.1',0));port=s.getsockname()[1]
|
||||
token=secrets.token_urlsafe(32)
|
||||
env=dict(os.environ,BAO_ADDR=f'http://127.0.0.1:{port}',VAULT_ADDR=f'http://127.0.0.1:{port}',BAO_TOKEN=token,VAULT_TOKEN=token,BAO_DEV_ROOT_TOKEN_ID=token)
|
||||
cls.server=subprocess.Popen(['bao','server','-dev','-dev-no-store-token',f'-dev-listen-address=127.0.0.1:{port}'],env=env,stdout=subprocess.DEVNULL,stderr=subprocess.DEVNULL)
|
||||
cls.environment=patch.dict(os.environ,env,clear=True);cls.environment.start()
|
||||
try:
|
||||
for _ in range(60):
|
||||
if lane.bao(['status'],allow_failure=True).returncode==0:break
|
||||
time.sleep(.1)
|
||||
else:raise RuntimeError('local server not ready')
|
||||
lane.bao(['secrets','enable','-path=platform','kv-v2'])
|
||||
lane.bao(['auth','enable','kubernetes'])
|
||||
cls.lanes=lane.contracts()
|
||||
except BaseException:
|
||||
cls.environment.stop();cls.server.terminate();cls.server.wait(timeout=10);raise
|
||||
|
||||
@classmethod
|
||||
def tearDownClass(cls):
|
||||
cls.environment.stop();cls.server.terminate();cls.server.wait(timeout=10)
|
||||
|
||||
def setUp(self):
|
||||
# These deletes target only the test's own loopback dev server.
|
||||
for item in self.lanes:lane.bao(['delete',item['metadata']],allow_failure=True)
|
||||
lane.bao(['delete',lane.REGISTRY.replace('/data/','/metadata/')],allow_failure=True)
|
||||
self.original=[{'name':'existing','tokens':[secrets.token_urlsafe(48)],'sources':['existing'],'tenants':['*'],'may_read':True,'may_write':False,'secret_policy':'reject'}]
|
||||
self.body={'senders.json':json.dumps(self.original),'unrelated-metadata':'preserve me'}
|
||||
lane.bao(['write',lane.REGISTRY,'-'],payload={'options':{'cas':0},'data':self.body})
|
||||
self.receipt={};self.saved=[]
|
||||
|
||||
def run_seed(self,**kwargs):
|
||||
lane.seed(self.lanes,self.receipt,lambda:self.saved.append(copy.deepcopy(self.receipt)),**kwargs)
|
||||
|
||||
def token(self,item):
|
||||
return lane.data(lane.bao(['read','-format=json',item['kv']]))['data']['data']['AUDIT_TOKEN']
|
||||
|
||||
def test_first_provision_and_idempotent_resume(self):
|
||||
self.run_seed()
|
||||
before=[self.token(x) for x in self.lanes];self.assertNotEqual(*before)
|
||||
version,body,rows,_=lane.snapshot()
|
||||
self.assertEqual(rows[0],self.original[0]);self.assertEqual(body['unrelated-metadata'],'preserve me')
|
||||
self.assertEqual(len(rows),3)
|
||||
self.run_seed(resume=True)
|
||||
self.assertEqual(lane.snapshot()[0],version)
|
||||
self.assertEqual([self.token(x) for x in self.lanes],before)
|
||||
self.assertFalse(any(t in json.dumps(self.saved) for t in before))
|
||||
with self.assertRaisesRegex(lane.LaneError,'existing_custody_requires_reviewed_resume'):self.run_seed()
|
||||
|
||||
def test_crash_after_first_write_reuses_value(self):
|
||||
real=lane.bao
|
||||
def fail_second(args,**kwargs):
|
||||
if args[:2]==['write','-format=json'] and args[2]==self.lanes[1]['kv']:raise lane.LaneError('injected_interrupt')
|
||||
return real(args,**kwargs)
|
||||
with patch.object(lane,'bao',side_effect=fail_second):
|
||||
with self.assertRaisesRegex(lane.LaneError,'injected_interrupt'):self.run_seed()
|
||||
first=self.token(self.lanes[0]);self.assertEqual(lane.snapshot()[0],1)
|
||||
self.run_seed(resume=True)
|
||||
self.assertEqual(self.token(self.lanes[0]),first);self.assertEqual(len(lane.snapshot()[2]),3)
|
||||
|
||||
def test_lost_registry_write_reply_reconciles_without_rewriting(self):
|
||||
real=lane.bao
|
||||
def lost_reply(args,**kwargs):
|
||||
result=real(args,**kwargs)
|
||||
if args[:3]==['write','-format=json',lane.REGISTRY]:raise lane.LaneError('reply_lost')
|
||||
return result
|
||||
with patch.object(lane,'bao',side_effect=lost_reply):
|
||||
with self.assertRaisesRegex(lane.LaneError,'reply_lost'):self.run_seed()
|
||||
before=[self.token(x) for x in self.lanes];version=lane.snapshot()[0]
|
||||
self.run_seed(resume=True)
|
||||
self.assertEqual(lane.snapshot()[0],version);self.assertEqual([self.token(x) for x in self.lanes],before)
|
||||
|
||||
def test_cas_conflict_preserves_concurrent_writer(self):
|
||||
real=lane.bao
|
||||
extra={'name':'concurrent','tokens':[secrets.token_urlsafe(48)],'sources':['concurrent']}
|
||||
def race(args,**kwargs):
|
||||
if args[:3]==['write','-format=json',lane.REGISTRY]:
|
||||
body=dict(self.body,**{'senders.json':json.dumps(self.original+[extra])})
|
||||
real(['write',lane.REGISTRY,'-'],payload={'options':{'cas':1},'data':body})
|
||||
return real(args,**kwargs)
|
||||
with patch.object(lane,'bao',side_effect=race):
|
||||
with self.assertRaises(lane.LaneError):self.run_seed()
|
||||
self.assertEqual(lane.snapshot()[2],self.original+[extra])
|
||||
self.run_seed(resume=True);self.assertIn(extra,lane.snapshot()[2])
|
||||
|
||||
def test_wrong_provenance_refuses_resume(self):
|
||||
x=self.lanes[0]
|
||||
lane.bao(['write',x['kv'],'-'],payload={'options':{'cas':0},'data':{'AUDIT_TOKEN':secrets.token_urlsafe(48),'CUSTODY_REQUEST':'different-request'}})
|
||||
with self.assertRaisesRegex(lane.LaneError,'custody_provenance_mismatch'):self.run_seed(resume=True)
|
||||
self.assertIsNone(lane.read_optional(self.lanes[1]['metadata']))
|
||||
self.assertEqual(lane.snapshot()[0],1)
|
||||
|
||||
def test_scope_drift_is_never_overwritten(self):
|
||||
self.run_seed();version,body,rows,_=lane.snapshot();rows[-1]['may_read']=True
|
||||
lane.bao(['write',lane.REGISTRY,'-'],payload={'options':{'cas':version},'data':dict(body,**{'senders.json':json.dumps(rows)})})
|
||||
with self.assertRaisesRegex(lane.LaneError,'registered_sender_drift'):self.run_seed(resume=True)
|
||||
self.assertTrue(lane.snapshot()[2][-1]['may_read'])
|
||||
|
||||
def test_duplicate_names_refuse_before_token_creation(self):
|
||||
lane.bao(['write',lane.REGISTRY,'-'],payload={'options':{'cas':1},'data':{'senders.json':json.dumps(self.original*2)}})
|
||||
with self.assertRaisesRegex(lane.LaneError,'registry_identity_invalid_or_duplicate'):self.run_seed()
|
||||
self.assertTrue(all(lane.read_optional(x['metadata']) is None for x in self.lanes))
|
||||
|
||||
def test_existing_cross_sender_token_collision_refused(self):
|
||||
row=dict(self.original[0],name='different')
|
||||
lane.bao(['write',lane.REGISTRY,'-'],payload={'options':{'cas':1},'data':{'senders.json':json.dumps(self.original+[row])}})
|
||||
with self.assertRaisesRegex(lane.LaneError,'registry_token_collision'):self.run_seed()
|
||||
|
||||
def test_metadata_preserves_boundary_and_deny_overrides_reader(self):
|
||||
original='path "protected/existing" { capabilities = ["deny"] }\n'
|
||||
lane.bao(['write',lane.BOUNDARY,'-'],payload={'policy':original})
|
||||
lane.prepare_metadata(self.lanes)
|
||||
boundary=lane.read_optional(lane.BOUNDARY)['policy']
|
||||
self.assertTrue(boundary.startswith(original))
|
||||
for item in self.lanes:
|
||||
self.assertTrue(lane.role_matches(lane.read_optional('auth/kubernetes/role/'+item['role']),item))
|
||||
self.assertIn(item['kv'],boundary);self.assertIn(item['metadata'],boundary)
|
||||
self.run_seed()
|
||||
item=self.lanes[0]
|
||||
token=lane.data(lane.bao(['token','create','-format=json','-policy='+item['policy'],'-policy=agent-high-risk-boundary','-ttl=60s']))['auth']['client_token']
|
||||
try:
|
||||
result=lane.bao(['read',item['kv']],token=token,allow_failure=True)
|
||||
self.assertNotEqual(result.returncode,0);self.assertIn(b'403',result.stderr)
|
||||
finally:lane.bao(['write','auth/token/revoke','-'],payload={'token':token})
|
||||
lane.prepare_metadata(self.lanes)
|
||||
self.assertEqual(lane.read_optional(lane.BOUNDARY)['policy'],boundary)
|
||||
|
||||
def test_metadata_policy_drift_refuses_before_boundary_change(self):
|
||||
item=self.lanes[0];original=lane.read_optional(lane.BOUNDARY)
|
||||
lane.bao(['write','sys/policies/acl/'+item['policy'],'-'],payload={'policy':'path "unrelated/data" { capabilities = ["read"] }'})
|
||||
try:
|
||||
with self.assertRaisesRegex(lane.LaneError,'existing_policy_drift'):lane.prepare_metadata(self.lanes)
|
||||
self.assertEqual(lane.read_optional(lane.BOUNDARY),original)
|
||||
self.assertTrue(all(lane.read_optional(x['metadata']) is None for x in self.lanes))
|
||||
finally:lane.bao(['delete','sys/policies/acl/'+item['policy']])
|
||||
|
||||
def test_exact_read_policies_exclude_sibling_and_registry(self):
|
||||
self.run_seed()
|
||||
for item in self.lanes:
|
||||
lane.bao(['write','sys/policies/acl/'+item['policy'],'-'],payload={'policy':item['hcl']})
|
||||
token=lane.data(lane.bao(['token','create','-format=json','-policy='+item['policy'],'-ttl=60s']))['auth']['client_token']
|
||||
try:
|
||||
self.assertEqual(lane.bao(['read',item['kv']],token=token).returncode,0)
|
||||
targets=[lane.REGISTRY,item['metadata']]+[x['kv'] for x in self.lanes if x!=item]
|
||||
for target in targets:
|
||||
result=lane.bao(['read',target],token=token,allow_failure=True)
|
||||
self.assertNotEqual(result.returncode,0);self.assertIn(b'403',result.stderr)
|
||||
finally:lane.bao(['write','auth/token/revoke','-'],payload={'token':token})
|
||||
|
||||
if __name__=='__main__':unittest.main()
|
||||
|
|
@ -7,7 +7,7 @@ repo: railiance-platform
|
|||
status: blocked
|
||||
owner: codex
|
||||
created: "2026-09-05"
|
||||
updated: "2026-09-10"
|
||||
updated: "2026-09-11"
|
||||
related:
|
||||
- RPF-WP-0032
|
||||
- RPF-WP-0033
|
||||
|
|
@ -393,6 +393,35 @@ receipts to HFACT-WP-0001-T03, SECRETS-WP-0009-T03 and APPROVAL-WP-0002-T01/T05.
|
|||
Audit receiver/sender custody remains AUDIT-WP-0009-T09 and must not be folded
|
||||
into this client-identity grant.
|
||||
|
||||
## Admit the two factory audit-sender custody lanes
|
||||
|
||||
```task
|
||||
id: RPF-WP-0035-T08
|
||||
status: progress
|
||||
priority: high
|
||||
assignee: railiance-platform
|
||||
needs_human: true
|
||||
intervention_note: "CCR-2026-0021/0022 need named platform-operator, audit-core-owner and producer-owner reviews. Receiver upgrade and namespace readiness remain separate preconditions; approval alone does not admit factory execution."
|
||||
```
|
||||
|
||||
Consume AUDIT-WP-0009-T09/T11's exact declarations for approval-engine and
|
||||
informed-decision: tenant:platform, write-only, load-bearing, redact. Source
|
||||
preparation supplies two proposed CCRs, independent exact-path policies/ESO
|
||||
projections, and the attended `factory_audit_custody.py` first-provision helper.
|
||||
Its CAS and request-provenance checks preserve unrelated senders and recover
|
||||
interrupted writes without generating replacements. Native reviews and
|
||||
provision/delivery/receiver-ingestion acceptance remain open.
|
||||
|
||||
The 2026-09-11 native read-only check found an additional deployment dependency:
|
||||
receiver image c2fe39a is 1/1 Ready but does not support evidence_kind. The
|
||||
synthetic native probe now refuses before any credential read. Current receiver
|
||||
source passes. AUDIT T09/T11 retain compatible release/source-manifest rollout;
|
||||
Approval Engine's missing namespace remains its owner prerequisite.
|
||||
|
||||
[Review packet](../docs/credential-lane-designs/factory-audit-senders-review.md).
|
||||
[Preparation evidence](../docs/evidence/2026-09-11-factory-audit-custody.json).
|
||||
Do not fold these senders into CCR-2026-0019 or the cancelled CCR-2026-0020.
|
||||
|
||||
## Dependency review — 2026-09-06
|
||||
|
||||
### 2026-09-09 tenant question resolved — no change needed
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue