Prepare scoped factory audit custody and enforce receiver compatibility
Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a07ff8-19d0-7820-b4d0-1353833cb7fc
This commit is contained in:
codex
parent
d3a502b45c
commit
bfe65a5b05
11 changed files with 1053 additions and 1 deletions
|
|
@ -0,0 +1,110 @@
|
|||
id: CCR-2026-0021
|
||||
kind: credential-change-request
|
||||
schema_version: 1
|
||||
request_type: workload-kv-read
|
||||
title: approval-engine load-bearing audit sender custody and delivery
|
||||
status: proposed
|
||||
created: '2026-09-11'
|
||||
updated: '2026-09-11'
|
||||
requester:
|
||||
agent: codex
|
||||
reason: AUDIT-WP-0009-T09 and HFACT-WP-0001-T03 require the existing exact sender declaration. This
|
||||
request supplies the missing platform custody and ESO delivery; receiver compatibility and service
|
||||
rollout remain explicit gates.
|
||||
review:
|
||||
required: true
|
||||
required_approvers:
|
||||
- platform-operator
|
||||
- audit-core-owner
|
||||
- approval-engine-owner
|
||||
comments: []
|
||||
target:
|
||||
domain: financials
|
||||
tenant: platform
|
||||
workload: approval-engine
|
||||
environment: production
|
||||
purpose: Provide only the approval-engine sender with source=approval-engine, tenants=[tenant:platform],
|
||||
may_write=true, may_read=false, evidence_kind=load-bearing, secret_policy=redact. Preserve the
|
||||
existing receiver registry and every other sender.
|
||||
openbao:
|
||||
mount: platform
|
||||
kv_path: platform/workloads/approval-engine/audit-sender
|
||||
fields:
|
||||
- AUDIT_TOKEN
|
||||
- CUSTODY_REQUEST
|
||||
policy_name: workload-kv-read-approval-engine-audit
|
||||
policy_file: openbao/policies/workload-kv-read-approval-engine-audit.hcl
|
||||
metadata_read: false
|
||||
auth:
|
||||
method: kubernetes
|
||||
mount: kubernetes
|
||||
role: external-secrets-approval-engine-audit
|
||||
bound_claims:
|
||||
service_account_names:
|
||||
- external-secrets
|
||||
service_account_namespaces:
|
||||
- external-secrets
|
||||
bound_claims_confirmed: true
|
||||
policies:
|
||||
- workload-kv-read-approval-engine-audit
|
||||
ttl: 15m
|
||||
access_frontdoor:
|
||||
type: external-secrets
|
||||
catalog_id: approval-engine-audit
|
||||
readiness: pending-review
|
||||
resolvable: false
|
||||
delivery:
|
||||
surface: external-secrets
|
||||
target: 'ClusterSecretStore openbao-approval-engine-audit restricted to namespace approval-engine;
|
||||
ExternalSecret and Secret approval-engine/approval-engine-audit, key audit-token. Source: manifests/factory-audit-senders.yaml.
|
||||
A missing namespace stays a workload-owner prerequisite; this packet creates none.'
|
||||
risk:
|
||||
classification: high
|
||||
notes:
|
||||
- A bearer permits append for its exact sender and tenant, never reading or changing stored evidence.
|
||||
- The registry update reads existing sender credentials inside the attended platform process only.
|
||||
No registry is delivered to a producer.
|
||||
- OpenBao login TTL limits the ESO reader session, not the audit bearer. Revocation must remove
|
||||
the sender token from the receiver registry and prove refusal.
|
||||
- New paths extend the existing coding-agent deny boundary. No existing high-risk grant is widened.
|
||||
verification:
|
||||
positive:
|
||||
- Independent CAS=0 token creation and exact sender merge with registry-version compare-and-set;
|
||||
repeated runs preserve both tokens and other registry fields.
|
||||
- ESO delivers only AUDIT_TOKEN into approval-engine/approval-engine-audit:audit-token; source and
|
||||
receiver copies agree without displaying values.
|
||||
- Compatible deployed receiver accepts and deduplicates a declared synthetic event for the exact
|
||||
sender and tenant, retaining load-bearing/redact declarations.
|
||||
negative:
|
||||
- Sibling sender path, full registry and parent listing are denied to each workload reader. Wrong
|
||||
service account/namespace and disallowed store namespace fail.
|
||||
- Receiver denies sibling source, wrong tenant, every read route and revoked token. No existing
|
||||
sender is removed or re-scoped.
|
||||
- Proposed or altered CCR, legacy receiver, malformed/duplicate registry identity, token collision,
|
||||
stale registry version or partial/conflicting custody refuses without overwriting.
|
||||
activation_conditions:
|
||||
- All three named owner reviews are approved before any native credential mutation.
|
||||
- A current image supporting evidence_kind is published/admitted by audit-core and deployed with
|
||||
its source scope and network policy; current c2fe39a image fails compatibility.
|
||||
- Use the Warden attended platform-admin login envelope; preserve independent receipt and revoke
|
||||
the session on exit.
|
||||
- Apply reviewed policy/auth metadata and ESO projection only after receiver compatibility and namespace
|
||||
readiness. An interrupted seed resumes from durable KV values, never blindly rotates or deletes.
|
||||
- Record native positive/negative evidence before declaring verified or active. Custody alone does
|
||||
not admit UI, human approval or factory execution.
|
||||
lifecycle:
|
||||
deactivate: Stop the exact producer; remove only its admitted token from the registry using CAS
|
||||
and reload/verify receiver refusal. Then detach its reader policy and remove its ExternalSecret/projection,
|
||||
retaining KV versions for investigation. Do not delete audit events or other sender entries.
|
||||
rotate: 'Reviewed overlap-first rotation: append a replacement to this sender only, deliver it,
|
||||
prove acceptance, then remove the predecessor and prove refusal. The first-provision helper refuses
|
||||
rotation and unexpected existing values.'
|
||||
compromised: Stop affected producer and revoke the exact receiver token first; inspect affected
|
||||
source/tenant events, rotate through a separate reviewed action, and preserve the independent
|
||||
audit trail.
|
||||
state_hub:
|
||||
workplan_id: RPF-WP-0035
|
||||
task_id: RPF-WP-0035-T08
|
||||
related_workplan: AUDIT-WP-0009-T09
|
||||
decision_id: 2c9fe9f0-034a-41d7-9d49-b99df488fdc8
|
||||
decision_api_url: http://127.0.0.1:8000/decisions/2c9fe9f0-034a-41d7-9d49-b99df488fdc8
|
||||
|
|
@ -0,0 +1,110 @@
|
|||
id: CCR-2026-0022
|
||||
kind: credential-change-request
|
||||
schema_version: 1
|
||||
request_type: workload-kv-read
|
||||
title: informed-decision load-bearing audit sender custody and delivery
|
||||
status: proposed
|
||||
created: '2026-09-11'
|
||||
updated: '2026-09-11'
|
||||
requester:
|
||||
agent: codex
|
||||
reason: AUDIT-WP-0009-T11 and HFACT-WP-0001-T03 require the existing exact sender declaration. This
|
||||
request supplies the missing platform custody and ESO delivery; receiver compatibility and service
|
||||
rollout remain explicit gates.
|
||||
review:
|
||||
required: true
|
||||
required_approvers:
|
||||
- platform-operator
|
||||
- audit-core-owner
|
||||
- informed-decision-owner
|
||||
comments: []
|
||||
target:
|
||||
domain: financials
|
||||
tenant: platform
|
||||
workload: informed-decision
|
||||
environment: production
|
||||
purpose: Provide only the informed-decision sender with source=informed-decision, tenants=[tenant:platform],
|
||||
may_write=true, may_read=false, evidence_kind=load-bearing, secret_policy=redact. Preserve the
|
||||
existing receiver registry and every other sender.
|
||||
openbao:
|
||||
mount: platform
|
||||
kv_path: platform/workloads/informed-decision/audit-sender
|
||||
fields:
|
||||
- AUDIT_TOKEN
|
||||
- CUSTODY_REQUEST
|
||||
policy_name: workload-kv-read-informed-decision-audit
|
||||
policy_file: openbao/policies/workload-kv-read-informed-decision-audit.hcl
|
||||
metadata_read: false
|
||||
auth:
|
||||
method: kubernetes
|
||||
mount: kubernetes
|
||||
role: external-secrets-informed-decision-audit
|
||||
bound_claims:
|
||||
service_account_names:
|
||||
- external-secrets
|
||||
service_account_namespaces:
|
||||
- external-secrets
|
||||
bound_claims_confirmed: true
|
||||
policies:
|
||||
- workload-kv-read-informed-decision-audit
|
||||
ttl: 15m
|
||||
access_frontdoor:
|
||||
type: external-secrets
|
||||
catalog_id: informed-decision-audit
|
||||
readiness: pending-review
|
||||
resolvable: false
|
||||
delivery:
|
||||
surface: external-secrets
|
||||
target: 'ClusterSecretStore openbao-informed-decision-audit restricted to namespace informed-decision;
|
||||
ExternalSecret and Secret informed-decision/informed-decision-audit, key token. Source: manifests/factory-audit-senders.yaml.
|
||||
A missing namespace stays a workload-owner prerequisite; this packet creates none.'
|
||||
risk:
|
||||
classification: high
|
||||
notes:
|
||||
- A bearer permits append for its exact sender and tenant, never reading or changing stored evidence.
|
||||
- The registry update reads existing sender credentials inside the attended platform process only.
|
||||
No registry is delivered to a producer.
|
||||
- OpenBao login TTL limits the ESO reader session, not the audit bearer. Revocation must remove
|
||||
the sender token from the receiver registry and prove refusal.
|
||||
- New paths extend the existing coding-agent deny boundary. No existing high-risk grant is widened.
|
||||
verification:
|
||||
positive:
|
||||
- Independent CAS=0 token creation and exact sender merge with registry-version compare-and-set;
|
||||
repeated runs preserve both tokens and other registry fields.
|
||||
- ESO delivers only AUDIT_TOKEN into informed-decision/informed-decision-audit:token; source and
|
||||
receiver copies agree without displaying values.
|
||||
- Compatible deployed receiver accepts and deduplicates a declared synthetic event for the exact
|
||||
sender and tenant, retaining load-bearing/redact declarations.
|
||||
negative:
|
||||
- Sibling sender path, full registry and parent listing are denied to each workload reader. Wrong
|
||||
service account/namespace and disallowed store namespace fail.
|
||||
- Receiver denies sibling source, wrong tenant, every read route and revoked token. No existing
|
||||
sender is removed or re-scoped.
|
||||
- Proposed or altered CCR, legacy receiver, malformed/duplicate registry identity, token collision,
|
||||
stale registry version or partial/conflicting custody refuses without overwriting.
|
||||
activation_conditions:
|
||||
- All three named owner reviews are approved before any native credential mutation.
|
||||
- A current image supporting evidence_kind is published/admitted by audit-core and deployed with
|
||||
its source scope and network policy; current c2fe39a image fails compatibility.
|
||||
- Use the Warden attended platform-admin login envelope; preserve independent receipt and revoke
|
||||
the session on exit.
|
||||
- Apply reviewed policy/auth metadata and ESO projection only after receiver compatibility and namespace
|
||||
readiness. An interrupted seed resumes from durable KV values, never blindly rotates or deletes.
|
||||
- Record native positive/negative evidence before declaring verified or active. Custody alone does
|
||||
not admit UI, human approval or factory execution.
|
||||
lifecycle:
|
||||
deactivate: Stop the exact producer; remove only its admitted token from the registry using CAS
|
||||
and reload/verify receiver refusal. Then detach its reader policy and remove its ExternalSecret/projection,
|
||||
retaining KV versions for investigation. Do not delete audit events or other sender entries.
|
||||
rotate: 'Reviewed overlap-first rotation: append a replacement to this sender only, deliver it,
|
||||
prove acceptance, then remove the predecessor and prove refusal. The first-provision helper refuses
|
||||
rotation and unexpected existing values.'
|
||||
compromised: Stop affected producer and revoke the exact receiver token first; inspect affected
|
||||
source/tenant events, rotate through a separate reviewed action, and preserve the independent
|
||||
audit trail.
|
||||
state_hub:
|
||||
workplan_id: RPF-WP-0035
|
||||
task_id: RPF-WP-0035-T08
|
||||
related_workplan: AUDIT-WP-0009-T11
|
||||
decision_id: ee4ff001-256a-4406-9cb8-51be2cd5d31b
|
||||
decision_api_url: http://127.0.0.1:8000/decisions/ee4ff001-256a-4406-9cb8-51be2cd5d31b
|
||||
Loading…
Add table
Add a link
Reference in a new issue