coulomb/railiance-platform
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat: verify live KeyCape custody and preserve versions on resume
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 2s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-5.6-luna
Assistant-Session: 01a07ff8-19d0-7820-b4d0-1353833cb7fc
This commit is contained in:
codex 2026-09-09 02:18:12 +02:00
parent b7861de20e
commit c6dc4286e2
8 changed files with 382 additions and 57 deletions
Download patch file Download diff file Expand all files Collapse all files

63
docs/credential-lane-designs/keycape-approval-clients-review.md
View file

@ -1,45 +1,28 @@
# KeyCape approval-client custody: review packet
# KeyCape approval-client custody: accepted verifier delivery
Prepared 2026-09-09 by the-custodian. Both requests are **approved** by the user as platform operator and KeyCape
owner, explicitly recorded on 2026-09-09. The admission receipt is
[here](../evidence/2026-09-09-keycape-approval-admission.json). This is the review record for
RPF-WP-0035-T05, consumed by HFACT-WP-0001-T03.
Both CCR-2026-0017 and CCR-2026-0018 have the user's explicit approval as platform
operator and KeyCape owner. Both are now **verified**. Their existing decision
IDs remain resolved; no renewed review is needed for this completed scope.
| Request | Secret path and field | Client authority | Resolved decision |
| --- | --- | --- | --- |
| [CCR-2026-0017](../../credential-change-requests/CCR-2026-0017-keycape-secrets-engine-approval-client.yaml) | `platform/workloads/secrets-engine/approval-client`, `CLIENT_SECRET` | `approval:read`, `approval:consume` | `b533a271-b704-4c5c-98a2-9a5951aadfb6` |
| [CCR-2026-0018](../../credential-change-requests/CCR-2026-0018-keycape-approval-engine-operator-client.yaml) | `platform/workloads/approval-engine/operator-client`, `CLIENT_SECRET` | create/read/approve/revoke/supersede/observe/emit; no consume | `efa90517-0cae-4eb6-a68d-5b0489c84d65` |
[Combined live receipt](../evidence/2026-09-09-keycape-verifier-admission.json) records version-1 custody, both ESO
stores and Secrets, exact native scope/auth/namespace denials, reader revocation,
compatible pinned KeyCape deployment and both service-client verification runs.
The existing human OpenBao login passed before and after the rollout.
Both named **platform-operator and key-cape-owner** reviews are approved. Each has its own
exact-path policy, Kubernetes auth role and ClusterSecretStore, bound to
`external-secrets/external-secrets`, limited to `sso`. ESO owns the resulting
Secret; authentication tokens have a 15-minute TTL. Client secrets require
explicit rotation or registration disablement; token expiry does not revoke them.
The two Warden fetch selectors remain unresolved: these CCRs authorize verifier
copies only. Client-side reads, audit custody, natural JWT expiry, real predecessor
rotation and factory operating/spend admission remain with the existing owner
records. See [the owner sequence](keycape-approval-clients.md).
The approved requests authorize verifier-side custody only. Client-side
retrieval, audit sender/receiver custody, operator `approval:consume`, adoption
of the Qonto Secret and factory spending remain outside these two requests.
The exercised procedure is `scripts/keycape_approval_custody.py`: `activate` for
first provision, `resume-activate` only with a completed rollback receipt, and
`verify` for existing custody. The selected kubeconfig must identify railiance01;
on this workstation it is `/home/worsch/.kube/config-railiance01`. Use the
Warden attended wrapper, a unique metadata receipt and protected recovery file.
The pinned native verifier is extracted from image digest `7ff54c54e63e...` and
hash-checked; its child environment carries credentials only during execution.
No Kubernetes egress policy changes are needed.
Technical review completed: both CCRs validate, their generated policies match
the two source HCL files, and the delivery manifests map exactly to the declared
paths and fields. The signed upstream issuer is verified; NetKingdom's exact live
pin is independently read back at Secret revision `58713343`. The compatible
KeyCape image and rollout patch are prepared. These checks are evidence for the
review, not substitutes for either named approval.
Execution still follows the [owner rollout sequence](keycape-approval-clients.md)
through the founder-attended Warden/OpenBao envelope: policy/roles, CAS=0 initial
custody, Valid stores, SecretSynced delivery, compatible config/image replacement,
then positive and negative acceptance and metadata-only receipts. The contained owner command is now `scripts/keycape_approval_custody.py activate`.
It preflights both config and deployment changes, seeds with CAS=0, verifies native
and namespace boundaries, then calls NetKingdom's contained compatible rollout.
A failure restores the prior config/image pair before detaching verifier delivery;
initial KV versions remain in custody. The four new exact data/metadata deny
stanzas extend the coding-agent boundary without changing any grant.
Validation: six checks against a disposable local OpenBao, eight config/rollback
tests, and real HTTP signature/claim/scope acceptance against the pinned KeyCape
image with synthetic keys. Production in-pod CLI and existing-human-login checks
remain part of the live window. The image exercise omits the in-pod CLI explicitly.
Use a unique private receipt and protected owner recovery path; a fresh attended
login after the rollout establishes the existing human path on the new build.
Validation: eight local OpenBao checks, ten config/rollback/clock checks, 53
existing credential-change tests, plus a disposable pinned-image HTTPS exercise
that runs the exact native verifier with synthetic keys and client credentials.

23
docs/credential-lane-designs/keycape-approval-clients.md
View file

@ -1,14 +1,20 @@
# KeyCape approval-engine client custody admission
**2026-09-09 accepted:** verifier custody and the compatible image/config are live;
both service verifiers and a fresh existing-human OpenBao login passed. Both CCRs
are verified. [Live evidence](../evidence/2026-09-09-keycape-verifier-admission.json) supersedes the preparation
status below. Client-side reads and factory operating grants remain separate.
Answer to KEY-WP-0013-T02 (State Hub message
`278a3ebe-b529-49f6-bd1a-e3ebcf318260`, KeyCape packet
`key-cape: docs/approval-engine-provisioning-request.yaml`). Tracked here as
RPF-WP-0035-T05. Requests: [CCR-2026-0017](../../credential-change-requests/CCR-2026-0017-keycape-secrets-engine-approval-client.yaml),
[CCR-2026-0018](../../credential-change-requests/CCR-2026-0018-keycape-approval-engine-operator-client.yaml).
Nothing below is an activation. Both CCRs are `proposed`; no value has been
generated, no KV version written, no manifest applied. Source preparation is not
live completion.
Both CCRs are **verified** following explicit user approval in both reviewer
roles. Version-1 custody, ESO delivery, the compatible KeyCape rollout and the
fresh existing-human login all passed. The contract below defines the completed
verifier-side scope; client-side reads remain a separate admission.
## a) Custody paths and field names
@ -53,7 +59,7 @@ keycape-rapp-qonto-client, key: client-secret}`. Read-only observation
2026-09-08, and it confirms KeyCape's own statement that the image carries only
that one client reference.
Manifests are written and client-validated but unapplied:
Both delivery manifests are applied and live-verified:
`argocd/platform-addons/openbao-secretstore/openbao-keycape-approval-clients.clustersecretstore.yaml`
and `keycape-approval-clients.externalsecrets.yaml`.
@ -146,9 +152,10 @@ ExternalSecrets, detach the policies from the roles. The KV versions are retaine
until KeyCape confirms whether the registrations stay; if they are abandoned,
KeyCape disables the registrations first and platform then destroys the versions.
**Date is not set here.** It depends on the founder's availability, which is not
mine to schedule. Propose a slot from 2026-09-10 and I will confirm the
platform side; the window needs roughly 60–90 minutes with both owners present.
The attended window completed on **2026-09-09** under the user's explicit
approval. Failed checks restored the compatible config/image and detached ESO
delivery. The final resume preserved both initial KV versions and passed all
service checks plus a fresh existing-human OpenBao login.
## What is not admitted
@ -184,4 +191,4 @@ approval is performed by this preflight.
2026-09-09: the live issuer pin is complete. The next review is captured in
[keycape-approval-clients-review.md](keycape-approval-clients-review.md), with
one pending Hub decision per existing CCR and both required reviewer roles.
the resolved Hub decisions, both recorded reviewer roles and completed live verification.

220
docs/evidence/2026-09-09-keycape-verifier-admission.json Normal file
View file

@ -0,0 +1,220 @@
{
"schema": "helixforge.keycape-verifier-admission.v1",
"recorded_at": "2026-09-09T00:14:27.155338+00:00",
"approval": {
"schema": "railiance.keycape-custody-user-approval.v1",
"recorded_at": "2026-09-08T23:05:19.886216+00:00",
"user_response": "I approve, go on.",
"approved_question": "Do you approve CCR-2026-0017 and CCR-2026-0018, as platform operator and KeyCape owner, for the verifier-side credential delivery described in the review packet?",
"review_packet_revision": "52b24eab9a8aff3396e71b2296d0240a44f3b0db",
"roles": [
"platform-operator",
"key-cape-owner"
],
"scope": "Two verifier-side KeyCape client credential custody requests, including their governed attended provisioning and compatible rollout sequence.",
"client_side_read_authorized": false,
"factory_spending_authorized": false,
"requests": [
{
"id": "CCR-2026-0017",
"decision_id": "b533a271-b704-4c5c-98a2-9a5951aadfb6",
"status": "approved",
"decision_status": "resolved",
"reviewed_roles": [
"platform-operator",
"key-cape-owner"
]
},
{
"id": "CCR-2026-0018",
"decision_id": "efa90517-0cae-4eb6-a68d-5b0489c84d65",
"status": "approved",
"decision_status": "resolved",
"reviewed_roles": [
"platform-operator",
"key-cape-owner"
]
}
]
},
"activation": {
"schema": "platform.keycape-approval-custody.v1",
"status": "custody_and_service_acceptance_passed_pending_fresh_human_login",
"lanes": [
{
"ccr": "CCR-2026-0017",
"source_sha256": "dc2bbd86e213edecc2f2f91a99d0f51136e9a0853a90e55f65dda2b942305416",
"custody_seeded": false,
"existing_version_reused": true,
"kv_version": 1,
"initial_request_id": "94c98373-33fa-591d-c201-d36dddf9879b",
"policy_applied": false,
"role_applied": true,
"native_reader_verified": true,
"cross_path_denied": true,
"parent_listing_denied": true,
"auth_ttl": 900,
"reader_revocation_verified": true,
"wrong_service_account_denied": true,
"coding_agent_deny_wins": true,
"store_ready": true,
"external_secret_ready": true,
"delivery_matches": true,
"secret_uid": "eaa28bdf-04af-4e4e-a1fc-fe395c7689a7",
"secret_resource_version": "58747058",
"wrong_namespace_denied": true,
"outside_namespace_store_denied": true
},
{
"ccr": "CCR-2026-0018",
"source_sha256": "99148133ddf1eb15dce3c03862b51dc001818ca3121045035a0b0e5897c55dad",
"custody_seeded": false,
"existing_version_reused": true,
"kv_version": 1,
"initial_request_id": "a62ee5c5-b5ba-b7dc-0f51-e6fd8a6dde32",
"policy_applied": false,
"role_applied": true,
"native_reader_verified": true,
"cross_path_denied": true,
"parent_listing_denied": true,
"auth_ttl": 900,
"reader_revocation_verified": true,
"wrong_service_account_denied": true,
"coding_agent_deny_wins": true,
"store_ready": true,
"external_secret_ready": true,
"delivery_matches": true,
"secret_uid": "599a61a7-8244-4618-8c44-6473195bbe4e",
"secret_resource_version": "58747062",
"wrong_namespace_denied": true,
"outside_namespace_store_denied": true
}
],
"started_at": "2026-09-09T00:09:28.852280+00:00",
"credential_values_emitted": false,
"client_side_read_admitted": false,
"keycape_rollout_completed": true,
"issuer_pin_revision": "58746187",
"phase": "awaiting_fresh_human_login",
"custody_versions_unchanged": true,
"namespace_probe_cleanup_requested": true,
"keycape": {
"existing_human_login_before": true,
"protected_recovery_retained": true,
"deployment_uid": "99ddd83c-cb3f-4847-bcf8-35f1aa87627f",
"generation": 38,
"pod_uid": "8d62e972-d466-413e-a2e4-08b9a08016bc",
"single_ready_replica": true,
"acceptance_phase": "passed",
"clients": [
{
"client_id": "secrets-engine-approval",
"live_jwks_signature_verified": true,
"exact_claims_verified": true,
"lifetime_seconds": 900,
"maximum_future_iat_seconds": 30,
"expiry_leeway_seconds": 0,
"excess_scope_denied": true,
"wrong_secret_denied": true,
"pinned_artifact_verifier_passed": true,
"verifier_location": "attended owner process",
"verifier_sha256": "4bf93bbe9afe0bf2e21d51c03373a7e2b4be6864586bcc2d472eeb9abc913d92",
"real_predecessor_rotation_tested": false,
"observed_wall_clock_expiry": false
},
{
"client_id": "approval-engine-operator",
"live_jwks_signature_verified": true,
"exact_claims_verified": true,
"lifetime_seconds": 900,
"maximum_future_iat_seconds": 30,
"expiry_leeway_seconds": 0,
"excess_scope_denied": true,
"wrong_secret_denied": true,
"pinned_artifact_verifier_passed": true,
"verifier_location": "attended owner process",
"verifier_sha256": "4bf93bbe9afe0bf2e21d51c03373a7e2b4be6864586bcc2d472eeb9abc913d92",
"real_predecessor_rotation_tested": false,
"observed_wall_clock_expiry": false
}
],
"acceptance_client": "approval-engine-operator",
"human_client_consume_denied": true,
"status": "service_acceptance_passed_pending_fresh_human_login",
"image": "forgejo.coulomb.social/coulomb/key-cape@sha256:7ff54c54e63ee172ae9e6e7fd2da96e427352f712343d74626ee6fe0f6f82611",
"config_resource_version": "58747126",
"signing_key_unchanged": true,
"unrelated_config_bytes_preserved": true,
"existing_human_login_after": false
},
"finished_at": "2026-09-09T00:10:09.099481+00:00"
},
"post_rollout_login": {
"schema": "netkingdom.keycape-approval-rollout.v1",
"status": "service_and_existing_human_login_acceptance_passed",
"values_emitted": false,
"deployment_uid": "99ddd83c-cb3f-4847-bcf8-35f1aa87627f",
"generation": 38,
"pod_uid": "8d62e972-d466-413e-a2e4-08b9a08016bc",
"single_ready_replica": true,
"acceptance_phase": "passed",
"clients": [
{
"client_id": "secrets-engine-approval",
"live_jwks_signature_verified": true,
"exact_claims_verified": true,
"lifetime_seconds": 900,
"maximum_future_iat_seconds": 30,
"expiry_leeway_seconds": 0,
"excess_scope_denied": true,
"wrong_secret_denied": true,
"pinned_artifact_verifier_passed": true,
"verifier_location": "attended owner process",
"verifier_sha256": "4bf93bbe9afe0bf2e21d51c03373a7e2b4be6864586bcc2d472eeb9abc913d92",
"real_predecessor_rotation_tested": false,
"observed_wall_clock_expiry": false
},
{
"client_id": "approval-engine-operator",
"live_jwks_signature_verified": true,
"exact_claims_verified": true,
"lifetime_seconds": 900,
"maximum_future_iat_seconds": 30,
"expiry_leeway_seconds": 0,
"excess_scope_denied": true,
"wrong_secret_denied": true,
"pinned_artifact_verifier_passed": true,
"verifier_location": "attended owner process",
"verifier_sha256": "4bf93bbe9afe0bf2e21d51c03373a7e2b4be6864586bcc2d472eeb9abc913d92",
"real_predecessor_rotation_tested": false,
"observed_wall_clock_expiry": false
}
],
"acceptance_client": "approval-engine-operator",
"human_client_consume_denied": true,
"existing_human_login_after": true,
"receipt_written_at": "2026-09-09T00:11:59.113549+00:00"
},
"attended_envelope": {
"all_attempted_sessions_revoked": true,
"successful_activation_exit_code": 0,
"post_rollout_login_exit_code": 0
},
"validation": {
"local_openbao_tests": 8,
"configuration_and_recovery_tests": 10,
"credential_change_tests": 53,
"pinned_image_synthetic_https_and_native_verifier": "passed"
},
"failed_attempt_receipts": [
"net-kingdom:docs/evidence/2026-09-09-keycape-activation-attempts.json"
],
"limits": {
"client_side_read_admitted": false,
"factory_spending_admitted": false,
"wall_clock_jwt_expiry_observed": false,
"actual_predecessor_rotation_observed": false
},
"temporary_probe_namespaces_remaining": 0,
"owner_manifest_api_defaults_match_live": true
}