RPF-WP-0054-T05 probe passed; publish secrets-engine JWT login contract
- CCR-2026-0040/0043 re-applied 2026-10-10T09:15Z. Probe: generated v1, a second run refused (already_present), tokens revoked, no value read, probe entry deleted. Receipts in docs/evidence. - CCR-2026-0038: login proof passed (secrets-engine a963a77); the consumer contract is published at docs/contracts/secrets-engine-openbao-jwt-login.yaml. RPF-WP-0035-T02 still waits on the negative claim checks. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 469992@bnt-lap001 Assistant-Session: e4b8e420-df0a-441d-83ae-7f19130594d9
This commit is contained in:
codex
parent
6f77484785
commit
c924ff2279
6 changed files with 142 additions and 7 deletions
|
|
@ -5,7 +5,7 @@ request_type: custody-generate-grant
|
|||
title: Broker grant keycape/client-secret-generate (create-only, generate in custody)
|
||||
status: applied
|
||||
created: '2026-10-09'
|
||||
updated: '2026-10-09'
|
||||
updated: '2026-10-10'
|
||||
requester:
|
||||
agent: railiance-platform
|
||||
reason: RPF-WP-0054-T04. net-kingdom SecurityCaseType oidc-browser-relying-party
|
||||
|
|
@ -82,6 +82,18 @@ verification:
|
|||
- Readback matched source for both policies and the token role.
|
||||
- Issuer policy is not bound to any identity by this apply.
|
||||
- No secret values were read, written, printed, or accepted in argv.
|
||||
- at: '2026-10-10T09:15:46+00:00'
|
||||
actor: founder
|
||||
kind: delegated_metadata_apply
|
||||
result: passed
|
||||
details:
|
||||
- Delegated metadata applier ran as founder using local bao CLI ambient authority.
|
||||
- 'Policy metadata write: sys/policies/acl/keycape-client-secret-generate'
|
||||
- 'Issuer policy metadata write: sys/policies/acl/credential-broker-keycape-client-secret-generate-issuer'
|
||||
- 'Token role metadata write: auth/token/roles/keycape-client-secret-generate'
|
||||
- Readback matched source for both policies and the token role.
|
||||
- Issuer policy is not bound to any identity by this apply.
|
||||
- No secret values were read, written, printed, or accepted in argv.
|
||||
lifecycle:
|
||||
deactivate: Delete auth/token/roles/keycape-client-secret-generate, then both policies;
|
||||
generated entries stay in custody with their cases.
|
||||
|
|
|
|||
|
|
@ -60,8 +60,8 @@ risk:
|
|||
notes:
|
||||
- Membership of net-kingdom-admins is the access decision; that group already holds
|
||||
the KeyCape operator reader (CCR-2026-0034).
|
||||
- Worst case within 15m is unused keycape/<client_id> entries;
|
||||
existing entries cannot be overwritten (CCR-2026-0040 is create-only).
|
||||
- Worst case within 15m is unused keycape/<client_id> entries; existing entries
|
||||
cannot be overwritten (CCR-2026-0040 is create-only).
|
||||
verification:
|
||||
positive:
|
||||
- Readback after apply matches source for the role (done by applier-apply; prints
|
||||
|
|
@ -86,6 +86,16 @@ verification:
|
|||
- 'OIDC role metadata write: auth/netkingdom/role/credential-broker-keycape-client-secret-generate'
|
||||
- Readback matched source for the role.
|
||||
- No secret values were read, written, printed, or accepted in argv.
|
||||
- at: '2026-10-10T09:15:56+00:00'
|
||||
actor: founder
|
||||
kind: delegated_metadata_apply
|
||||
result: passed
|
||||
details:
|
||||
- Delegated metadata applier ran as founder using local bao CLI ambient authority.
|
||||
- 'Issuer policy confirmed live and matching source: sys/policies/acl/credential-broker-keycape-client-secret-generate-issuer'
|
||||
- 'OIDC role metadata write: auth/netkingdom/role/credential-broker-keycape-client-secret-generate'
|
||||
- Readback matched source for the role.
|
||||
- No secret values were read, written, printed, or accepted in argv.
|
||||
lifecycle:
|
||||
deactivate: Delete auth/netkingdom/role/credential-broker-keycape-client-secret-generate.
|
||||
rotate: Not applicable (no stored credential).
|
||||
|
|
|
|||
8
docs/contracts/secrets-engine-openbao-jwt-login.yaml
Normal file
8
docs/contracts/secrets-engine-openbao-jwt-login.yaml
Normal file
|
|
@ -0,0 +1,8 @@
|
|||
# Consumer contract for secrets-engine service-JWT login to OpenBao (CCR-2026-0038).
|
||||
# Published by railiance-platform 2026-10-10 after the login proof passed
|
||||
# (secrets-engine docs/evidence/2026-10-10-keycape-openbao-probe.json, a963a77).
|
||||
# Non-secret. Point SECRETS_ENGINE_OPENBAO_JWT_LOGIN at a copy of this file.
|
||||
# Identical to the founder's probe input; that local copy may be kept as is.
|
||||
mount: keycape-services
|
||||
role: secrets-engine-openbao
|
||||
bound_issuer: https://kc.coulomb.social
|
||||
|
|
@ -0,0 +1,94 @@
|
|||
{
|
||||
"actor": "founder",
|
||||
"ccrs": [
|
||||
"CCR-2026-0040",
|
||||
"CCR-2026-0043"
|
||||
],
|
||||
"date": "2026-10-10",
|
||||
"note": "Receipts copied verbatim (no values). First attempt failed at grant token creation (limited-use caller token) and wrote nothing; fixed in 6f77484, both CCRs re-applied. Caller token after fix: policies [credential-broker-keycape-client-secret-generate-issuer], num_uses 0. Probe entry metadata-deleted afterwards by platform-admin.",
|
||||
"receipts": {
|
||||
"dry_run": {
|
||||
"case_ref": "probe-secret-generate-20261010@sha256:9cb9b2da16f4a8e5a6dfccad23d1849110485d452e098ff8cbd7a4066447e956",
|
||||
"case_verified": true,
|
||||
"client_id": "probe-secret-generate-20261010",
|
||||
"credential_values_emitted": false,
|
||||
"exit_code": 0,
|
||||
"grant": "keycape/client-secret-generate",
|
||||
"grant_token_revoked": true,
|
||||
"mode": "dry-run",
|
||||
"outcome": "dry_run_would_generate",
|
||||
"path": "platform/workloads/keycape/probe-secret-generate-20261010",
|
||||
"schema": "platform.keycape-client-secret-generate.v1",
|
||||
"value_reads": 0
|
||||
},
|
||||
"first_attempt_1": {
|
||||
"case_ref": "probe-secret-generate-20261010@sha256:9cb9b2da16f4a8e5a6dfccad23d1849110485d452e098ff8cbd7a4066447e956",
|
||||
"case_verified": true,
|
||||
"client_id": "probe-secret-generate-20261010",
|
||||
"credential_values_emitted": false,
|
||||
"exit_code": 4,
|
||||
"grant": "keycape/client-secret-generate",
|
||||
"mode": "generate",
|
||||
"outcome": "grant_token_create_failed",
|
||||
"path": "platform/workloads/keycape/probe-secret-generate-20261010",
|
||||
"schema": "platform.keycape-client-secret-generate.v1",
|
||||
"value_reads": 0
|
||||
},
|
||||
"first_attempt_2": {
|
||||
"case_ref": "probe-secret-generate-20261010@sha256:9cb9b2da16f4a8e5a6dfccad23d1849110485d452e098ff8cbd7a4066447e956",
|
||||
"case_verified": true,
|
||||
"client_id": "probe-secret-generate-20261010",
|
||||
"credential_values_emitted": false,
|
||||
"exit_code": 4,
|
||||
"grant": "keycape/client-secret-generate",
|
||||
"mode": "generate",
|
||||
"outcome": "grant_token_create_failed",
|
||||
"path": "platform/workloads/keycape/probe-secret-generate-20261010",
|
||||
"schema": "platform.keycape-client-secret-generate.v1",
|
||||
"value_reads": 0
|
||||
},
|
||||
"first_attempt_dry_run": {
|
||||
"case_ref": "probe-secret-generate-20261010@sha256:9cb9b2da16f4a8e5a6dfccad23d1849110485d452e098ff8cbd7a4066447e956",
|
||||
"case_verified": true,
|
||||
"client_id": "probe-secret-generate-20261010",
|
||||
"credential_values_emitted": false,
|
||||
"exit_code": 4,
|
||||
"grant": "keycape/client-secret-generate",
|
||||
"mode": "dry-run",
|
||||
"outcome": "grant_token_create_failed",
|
||||
"path": "platform/workloads/keycape/probe-secret-generate-20261010",
|
||||
"schema": "platform.keycape-client-secret-generate.v1",
|
||||
"value_reads": 0
|
||||
},
|
||||
"generate": {
|
||||
"case_ref": "probe-secret-generate-20261010@sha256:9cb9b2da16f4a8e5a6dfccad23d1849110485d452e098ff8cbd7a4066447e956",
|
||||
"case_verified": true,
|
||||
"client_id": "probe-secret-generate-20261010",
|
||||
"credential_values_emitted": false,
|
||||
"exit_code": 0,
|
||||
"grant": "keycape/client-secret-generate",
|
||||
"grant_token_revoked": true,
|
||||
"kv_version": 1,
|
||||
"mode": "generate",
|
||||
"outcome": "generated",
|
||||
"path": "platform/workloads/keycape/probe-secret-generate-20261010",
|
||||
"schema": "platform.keycape-client-secret-generate.v1",
|
||||
"value_reads": 0
|
||||
},
|
||||
"second_generate_refused": {
|
||||
"case_ref": "probe-secret-generate-20261010@sha256:9cb9b2da16f4a8e5a6dfccad23d1849110485d452e098ff8cbd7a4066447e956",
|
||||
"case_verified": true,
|
||||
"client_id": "probe-secret-generate-20261010",
|
||||
"credential_values_emitted": false,
|
||||
"exit_code": 3,
|
||||
"grant": "keycape/client-secret-generate",
|
||||
"grant_token_revoked": true,
|
||||
"mode": "generate",
|
||||
"outcome": "already_present",
|
||||
"path": "platform/workloads/keycape/probe-secret-generate-20261010",
|
||||
"schema": "platform.keycape-client-secret-generate.v1",
|
||||
"value_reads": 0
|
||||
}
|
||||
},
|
||||
"schema": "platform.evidence.rpf-wp-0054-t05-probe.v1"
|
||||
}
|
||||
|
|
@ -47,7 +47,7 @@ status: wait
|
|||
needs_human: true
|
||||
decision_id: 62aa95e4-3ccc-4867-8806-5e3db005b483
|
||||
depends_on: [KEY-WP-0037-T02, KEY-WP-0037-T03, KEY-WP-0037-T04]
|
||||
blocking_reason: "CCR-2026-0038 approved, binding confirmed and applied by the founder 2026-10-08T22:42Z (readback matched; evidence in the CCR). Waits only on the login proof with a real KeyCape service JWT (SECRETS-WP-0012-T03 probe-openbao) and the negative checks listed in the CCR."
|
||||
blocking_reason: "CCR-2026-0038 applied 2026-10-08. The login proof passed 2026-10-10 (secrets-engine a963a77, message 0dba7e04), and the consumer contract is published at docs/contracts/secrets-engine-openbao-jwt-login.yaml. Still waits on the CCR negative checks (wrong aud/sub/tenant/principal_type/roles/scope, a coding-agent JWT and an expired JWT refused; capabilities-self deny on the guarded paths), then ops-mason MASON-WP-0009-T05."
|
||||
priority: high
|
||||
state_hub_task_id: "e0c82ea9-05a5-537e-8fbf-67534263572e"
|
||||
```
|
||||
|
|
|
|||
|
|
@ -189,9 +189,8 @@ is needed.
|
|||
|
||||
```task
|
||||
id: RPF-WP-0054-T05
|
||||
status: todo
|
||||
status: done
|
||||
priority: high
|
||||
needs_human: true
|
||||
depends_on: [RPF-WP-0054-T03, RPF-WP-0054-T04]
|
||||
state_hub_task_id: "a21d1915-fee9-5c31-89e7-a4560c645950"
|
||||
```
|
||||
|
|
@ -263,6 +262,13 @@ The issuer policy lacked `auth/token/revoke-self`; it is now added. Re-apply
|
|||
CCR-2026-0040 (issuer policy) before CCR-2026-0043 (role), because the binding
|
||||
apply refuses unless the live issuer policy matches source.
|
||||
|
||||
2026-10-10 second probe passed after re-applying both CCRs (09:15Z). The
|
||||
caller token held only the issuer policy with num_uses 0. Results: dry-run
|
||||
`dry_run_would_generate`; generate `generated`, kv_version 1; second run exit 3
|
||||
`already_present`. The grant token was revoked every time, operator
|
||||
`revoke-self` succeeded, and no value was read. The probe entry was then
|
||||
metadata-deleted. Receipts: `docs/evidence/2026-10-10-keycape-client-secret-generate-probe.json`.
|
||||
|
||||
The policy denials (data read, update, delete, other paths) were already proven
|
||||
by the CCR-2026-0040 readback and its policy tests. The probe proves the live
|
||||
create-once behaviour.
|
||||
|
|
@ -273,7 +279,7 @@ Record the receipts under `docs/evidence/`.
|
|||
|
||||
```task
|
||||
id: RPF-WP-0054-T06
|
||||
status: todo
|
||||
status: progress
|
||||
priority: medium
|
||||
depends_on: [RPF-WP-0054-T05]
|
||||
state_hub_task_id: "d7015584-3429-5f32-b4bc-0a9b64017c15"
|
||||
|
|
@ -286,6 +292,11 @@ plan NK-WP-0048-T06. Consider declaring the `c3.runtime-secrets` capability so
|
|||
the case type can compose mint-secret instead of treating it as a follow-through
|
||||
step (net-kingdom case README "Known limits").
|
||||
|
||||
2026-10-10: ops-warden catalogued the lane as draft (ops-warden 0ae8a0e,
|
||||
playbook `wiki/playbooks/keycape-client-secret-generate.md`) and activates it
|
||||
when platform confirms. Probe receipt sent. Activation is held until key-cape
|
||||
confirms the secret format (T01/T03).
|
||||
|
||||
## T07 — Rotation lane (separate, later)
|
||||
|
||||
```task
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue