diff --git a/credential-change-requests/CCR-2026-0040-keycape-client-secret-generate-grant.yaml b/credential-change-requests/CCR-2026-0040-keycape-client-secret-generate-grant.yaml index d4f94c2..2624966 100644 --- a/credential-change-requests/CCR-2026-0040-keycape-client-secret-generate-grant.yaml +++ b/credential-change-requests/CCR-2026-0040-keycape-client-secret-generate-grant.yaml @@ -5,7 +5,7 @@ request_type: custody-generate-grant title: Broker grant keycape/client-secret-generate (create-only, generate in custody) status: applied created: '2026-10-09' -updated: '2026-10-09' +updated: '2026-10-10' requester: agent: railiance-platform reason: RPF-WP-0054-T04. net-kingdom SecurityCaseType oidc-browser-relying-party @@ -82,6 +82,18 @@ verification: - Readback matched source for both policies and the token role. - Issuer policy is not bound to any identity by this apply. - No secret values were read, written, printed, or accepted in argv. + - at: '2026-10-10T09:15:46+00:00' + actor: founder + kind: delegated_metadata_apply + result: passed + details: + - Delegated metadata applier ran as founder using local bao CLI ambient authority. + - 'Policy metadata write: sys/policies/acl/keycape-client-secret-generate' + - 'Issuer policy metadata write: sys/policies/acl/credential-broker-keycape-client-secret-generate-issuer' + - 'Token role metadata write: auth/token/roles/keycape-client-secret-generate' + - Readback matched source for both policies and the token role. + - Issuer policy is not bound to any identity by this apply. + - No secret values were read, written, printed, or accepted in argv. lifecycle: deactivate: Delete auth/token/roles/keycape-client-secret-generate, then both policies; generated entries stay in custody with their cases. diff --git a/credential-change-requests/CCR-2026-0043-keycape-client-secret-generate-issuer-binding.yaml b/credential-change-requests/CCR-2026-0043-keycape-client-secret-generate-issuer-binding.yaml index e4e0f7c..a5ce649 100644 --- a/credential-change-requests/CCR-2026-0043-keycape-client-secret-generate-issuer-binding.yaml +++ b/credential-change-requests/CCR-2026-0043-keycape-client-secret-generate-issuer-binding.yaml @@ -60,8 +60,8 @@ risk: notes: - Membership of net-kingdom-admins is the access decision; that group already holds the KeyCape operator reader (CCR-2026-0034). - - Worst case within 15m is unused keycape/ entries; - existing entries cannot be overwritten (CCR-2026-0040 is create-only). + - Worst case within 15m is unused keycape/ entries; existing entries + cannot be overwritten (CCR-2026-0040 is create-only). verification: positive: - Readback after apply matches source for the role (done by applier-apply; prints @@ -86,6 +86,16 @@ verification: - 'OIDC role metadata write: auth/netkingdom/role/credential-broker-keycape-client-secret-generate' - Readback matched source for the role. - No secret values were read, written, printed, or accepted in argv. + - at: '2026-10-10T09:15:56+00:00' + actor: founder + kind: delegated_metadata_apply + result: passed + details: + - Delegated metadata applier ran as founder using local bao CLI ambient authority. + - 'Issuer policy confirmed live and matching source: sys/policies/acl/credential-broker-keycape-client-secret-generate-issuer' + - 'OIDC role metadata write: auth/netkingdom/role/credential-broker-keycape-client-secret-generate' + - Readback matched source for the role. + - No secret values were read, written, printed, or accepted in argv. lifecycle: deactivate: Delete auth/netkingdom/role/credential-broker-keycape-client-secret-generate. rotate: Not applicable (no stored credential). diff --git a/docs/contracts/secrets-engine-openbao-jwt-login.yaml b/docs/contracts/secrets-engine-openbao-jwt-login.yaml new file mode 100644 index 0000000..c91616e --- /dev/null +++ b/docs/contracts/secrets-engine-openbao-jwt-login.yaml @@ -0,0 +1,8 @@ +# Consumer contract for secrets-engine service-JWT login to OpenBao (CCR-2026-0038). +# Published by railiance-platform 2026-10-10 after the login proof passed +# (secrets-engine docs/evidence/2026-10-10-keycape-openbao-probe.json, a963a77). +# Non-secret. Point SECRETS_ENGINE_OPENBAO_JWT_LOGIN at a copy of this file. +# Identical to the founder's probe input; that local copy may be kept as is. +mount: keycape-services +role: secrets-engine-openbao +bound_issuer: https://kc.coulomb.social diff --git a/docs/evidence/2026-10-10-keycape-client-secret-generate-probe.json b/docs/evidence/2026-10-10-keycape-client-secret-generate-probe.json new file mode 100644 index 0000000..0c4bfa0 --- /dev/null +++ b/docs/evidence/2026-10-10-keycape-client-secret-generate-probe.json @@ -0,0 +1,94 @@ +{ + "actor": "founder", + "ccrs": [ + "CCR-2026-0040", + "CCR-2026-0043" + ], + "date": "2026-10-10", + "note": "Receipts copied verbatim (no values). First attempt failed at grant token creation (limited-use caller token) and wrote nothing; fixed in 6f77484, both CCRs re-applied. Caller token after fix: policies [credential-broker-keycape-client-secret-generate-issuer], num_uses 0. Probe entry metadata-deleted afterwards by platform-admin.", + "receipts": { + "dry_run": { + "case_ref": "probe-secret-generate-20261010@sha256:9cb9b2da16f4a8e5a6dfccad23d1849110485d452e098ff8cbd7a4066447e956", + "case_verified": true, + "client_id": "probe-secret-generate-20261010", + "credential_values_emitted": false, + "exit_code": 0, + "grant": "keycape/client-secret-generate", + "grant_token_revoked": true, + "mode": "dry-run", + "outcome": "dry_run_would_generate", + "path": "platform/workloads/keycape/probe-secret-generate-20261010", + "schema": "platform.keycape-client-secret-generate.v1", + "value_reads": 0 + }, + "first_attempt_1": { + "case_ref": "probe-secret-generate-20261010@sha256:9cb9b2da16f4a8e5a6dfccad23d1849110485d452e098ff8cbd7a4066447e956", + "case_verified": true, + "client_id": "probe-secret-generate-20261010", + "credential_values_emitted": false, + "exit_code": 4, + "grant": "keycape/client-secret-generate", + "mode": "generate", + "outcome": "grant_token_create_failed", + "path": "platform/workloads/keycape/probe-secret-generate-20261010", + "schema": "platform.keycape-client-secret-generate.v1", + "value_reads": 0 + }, + "first_attempt_2": { + "case_ref": "probe-secret-generate-20261010@sha256:9cb9b2da16f4a8e5a6dfccad23d1849110485d452e098ff8cbd7a4066447e956", + "case_verified": true, + "client_id": "probe-secret-generate-20261010", + "credential_values_emitted": false, + "exit_code": 4, + "grant": "keycape/client-secret-generate", + "mode": "generate", + "outcome": "grant_token_create_failed", + "path": "platform/workloads/keycape/probe-secret-generate-20261010", + "schema": "platform.keycape-client-secret-generate.v1", + "value_reads": 0 + }, + "first_attempt_dry_run": { + "case_ref": "probe-secret-generate-20261010@sha256:9cb9b2da16f4a8e5a6dfccad23d1849110485d452e098ff8cbd7a4066447e956", + "case_verified": true, + "client_id": "probe-secret-generate-20261010", + "credential_values_emitted": false, + "exit_code": 4, + "grant": "keycape/client-secret-generate", + "mode": "dry-run", + "outcome": "grant_token_create_failed", + "path": "platform/workloads/keycape/probe-secret-generate-20261010", + "schema": "platform.keycape-client-secret-generate.v1", + "value_reads": 0 + }, + "generate": { + "case_ref": "probe-secret-generate-20261010@sha256:9cb9b2da16f4a8e5a6dfccad23d1849110485d452e098ff8cbd7a4066447e956", + "case_verified": true, + "client_id": "probe-secret-generate-20261010", + "credential_values_emitted": false, + "exit_code": 0, + "grant": "keycape/client-secret-generate", + "grant_token_revoked": true, + "kv_version": 1, + "mode": "generate", + "outcome": "generated", + "path": "platform/workloads/keycape/probe-secret-generate-20261010", + "schema": "platform.keycape-client-secret-generate.v1", + "value_reads": 0 + }, + "second_generate_refused": { + "case_ref": "probe-secret-generate-20261010@sha256:9cb9b2da16f4a8e5a6dfccad23d1849110485d452e098ff8cbd7a4066447e956", + "case_verified": true, + "client_id": "probe-secret-generate-20261010", + "credential_values_emitted": false, + "exit_code": 3, + "grant": "keycape/client-secret-generate", + "grant_token_revoked": true, + "mode": "generate", + "outcome": "already_present", + "path": "platform/workloads/keycape/probe-secret-generate-20261010", + "schema": "platform.keycape-client-secret-generate.v1", + "value_reads": 0 + } + }, + "schema": "platform.evidence.rpf-wp-0054-t05-probe.v1" +} diff --git a/workplans/RPF-WP-0035-credential-lane-implementation.md b/workplans/RPF-WP-0035-credential-lane-implementation.md index 034e22a..7f281a5 100644 --- a/workplans/RPF-WP-0035-credential-lane-implementation.md +++ b/workplans/RPF-WP-0035-credential-lane-implementation.md @@ -47,7 +47,7 @@ status: wait needs_human: true decision_id: 62aa95e4-3ccc-4867-8806-5e3db005b483 depends_on: [KEY-WP-0037-T02, KEY-WP-0037-T03, KEY-WP-0037-T04] -blocking_reason: "CCR-2026-0038 approved, binding confirmed and applied by the founder 2026-10-08T22:42Z (readback matched; evidence in the CCR). Waits only on the login proof with a real KeyCape service JWT (SECRETS-WP-0012-T03 probe-openbao) and the negative checks listed in the CCR." +blocking_reason: "CCR-2026-0038 applied 2026-10-08. The login proof passed 2026-10-10 (secrets-engine a963a77, message 0dba7e04), and the consumer contract is published at docs/contracts/secrets-engine-openbao-jwt-login.yaml. Still waits on the CCR negative checks (wrong aud/sub/tenant/principal_type/roles/scope, a coding-agent JWT and an expired JWT refused; capabilities-self deny on the guarded paths), then ops-mason MASON-WP-0009-T05." priority: high state_hub_task_id: "e0c82ea9-05a5-537e-8fbf-67534263572e" ``` diff --git a/workplans/RPF-WP-0054-keycape-client-secret-generate-lane.md b/workplans/RPF-WP-0054-keycape-client-secret-generate-lane.md index 2434ca3..437fd39 100644 --- a/workplans/RPF-WP-0054-keycape-client-secret-generate-lane.md +++ b/workplans/RPF-WP-0054-keycape-client-secret-generate-lane.md @@ -189,9 +189,8 @@ is needed. ```task id: RPF-WP-0054-T05 -status: todo +status: done priority: high -needs_human: true depends_on: [RPF-WP-0054-T03, RPF-WP-0054-T04] state_hub_task_id: "a21d1915-fee9-5c31-89e7-a4560c645950" ``` @@ -263,6 +262,13 @@ The issuer policy lacked `auth/token/revoke-self`; it is now added. Re-apply CCR-2026-0040 (issuer policy) before CCR-2026-0043 (role), because the binding apply refuses unless the live issuer policy matches source. +2026-10-10 second probe passed after re-applying both CCRs (09:15Z). The +caller token held only the issuer policy with num_uses 0. Results: dry-run +`dry_run_would_generate`; generate `generated`, kv_version 1; second run exit 3 +`already_present`. The grant token was revoked every time, operator +`revoke-self` succeeded, and no value was read. The probe entry was then +metadata-deleted. Receipts: `docs/evidence/2026-10-10-keycape-client-secret-generate-probe.json`. + The policy denials (data read, update, delete, other paths) were already proven by the CCR-2026-0040 readback and its policy tests. The probe proves the live create-once behaviour. @@ -273,7 +279,7 @@ Record the receipts under `docs/evidence/`. ```task id: RPF-WP-0054-T06 -status: todo +status: progress priority: medium depends_on: [RPF-WP-0054-T05] state_hub_task_id: "d7015584-3429-5f32-b4bc-0a9b64017c15" @@ -286,6 +292,11 @@ plan NK-WP-0048-T06. Consider declaring the `c3.runtime-secrets` capability so the case type can compose mint-secret instead of treating it as a follow-through step (net-kingdom case README "Known limits"). +2026-10-10: ops-warden catalogued the lane as draft (ops-warden 0ae8a0e, +playbook `wiki/playbooks/keycape-client-secret-generate.md`) and activates it +when platform confirms. Probe receipt sent. Activation is held until key-cape +confirms the secret format (T01/T03). + ## T07 — Rotation lane (separate, later) ```task