From c9b68ea4e494584ec1b5d481592eb837742bdc4d Mon Sep 17 00:00:00 2001 From: codex Date: Sat, 31 Oct 2026 18:47:31 +0100 Subject: [PATCH] CCR-2026-0059 (proposed): bounded executor reads the syn-journey identity workload-kv-read for platform/workloads/net-kingdom/synthetic-journey/syn-journey: read on the data path only, own role bound to sso/nk-bind-executor (audience openbao, 15m), separate from the CCR-2026-0058 write role. Widens CCR-2026-0057 runtime_access (stated). Standing reader proposed; founder decides. RPF-WP-0069-T04 updated. Not approved, not applied. Co-Authored-By: Claude Opus 5.5 Assistant: claude-code Assistant-Model: opus Assistant-Process: 5502@bnt-lap001 Assistant-Session: 68b3b02f-5d0f-4e71-8421-796f62e50196 --- ...ingdom-bind-executor-syn-journey-read.yaml | 133 ++++++++++++++++++ ...kingdom-bind-executor-syn-journey-read.hcl | 3 + .../RPF-WP-0069-bounded-executor-lanes.md | 14 +- 3 files changed, 149 insertions(+), 1 deletion(-) create mode 100644 credential-change-requests/CCR-2026-0059-net-kingdom-bind-executor-syn-journey-read.yaml create mode 100644 openbao/policies/net-kingdom-bind-executor-syn-journey-read.hcl diff --git a/credential-change-requests/CCR-2026-0059-net-kingdom-bind-executor-syn-journey-read.yaml b/credential-change-requests/CCR-2026-0059-net-kingdom-bind-executor-syn-journey-read.yaml new file mode 100644 index 0000000..1f2254d --- /dev/null +++ b/credential-change-requests/CCR-2026-0059-net-kingdom-bind-executor-syn-journey-read.yaml @@ -0,0 +1,133 @@ +id: CCR-2026-0059 +kind: credential-change-request +schema_version: 1 +request_type: workload-kv-read +title: NetKingdom bounded executor reads the synthetic journey identity (syn-journey) +status: proposed +created: '2026-10-31' +updated: '2026-10-31' +requester: + agent: claude-code + reason: 'NK-WP-0056-T10/T06: the bounded executor service:nk-bind-executor runs the + synthetic MFA journey (KeyCape, Authelia, privacyIDEA) as the check after each + consumer restart, with no person signing in. It needs the syn-journey password + and TOTP seed held under CCR-2026-0057. Lane design: railiance-platform docs/credential-lane-designs/bounded-executor.md + "Journey secrets (T10)". Drafted by net-kingdom; not approved.' +review: + required: true + required_approvers: + - platform-owner + - net-kingdom-owner + comments: [] +supersedes_boundary: + ccr: CCR-2026-0057 + field: openbao.runtime_access + was: false + change: 'This request gives one workload reader to the path CCR-2026-0057 holds with + runtime_access: false. CCR-2026-0057''s attended setup, teardown and rotation + stay valid and unchanged; its rotate (teardown + setup) does not need this role.' +target: + domain: infotech + tenant: platform + workload: net-kingdom-bind-executor + rapp: rapp-bounded-executor + environment: production + purpose: Let only the executor ServiceAccount sso/nk-bind-executor read the syn-journey + PASSWORD and TOTP_SEED to run the synthetic journey; no write, metadata, list, + sibling path, or other identity +admission: + standard: net-kingdom canon/standards/bounded-execution-admission_v0.1.md (proposed) + executor_identity: service:nk-bind-executor + example: net-kingdom examples/bounded-execution-admission/bind-rotation-svc-authelia.yaml + note: The journey is a check step under an admission. The OpenBao role does not + evaluate the admission; it bounds what the ServiceAccount can read to one synthetic, + group-less identity. +openbao: + mount: platform + kv_path: platform/workloads/net-kingdom/synthetic-journey/syn-journey + fields: + - PASSWORD + - TOTP_SEED + policy_name: net-kingdom-bind-executor-syn-journey-read + policy_file: openbao/policies/net-kingdom-bind-executor-syn-journey-read.hcl + metadata_read: false + token_self_lifecycle: true + auth: + method: kubernetes + mount: kubernetes + role: net-kingdom-bind-executor-syn-journey-read + audience: openbao + ttl: 15m + token_max_ttl: 15m + token_explicit_max_ttl: 15m + token_no_default_policy: true + policies: + - net-kingdom-bind-executor-syn-journey-read + bound_claims: + service_account_names: + - nk-bind-executor + service_account_namespaces: + - sso + bound_claims_confirmed: false +access_frontdoor: + type: platform-owner + catalog_id: net-kingdom-bind-executor-syn-journey-read + readiness: pending-review + resolvable: false +agent_fence: + data_and_metadata_denied: true + note: The syn-journey data and metadata paths are denied to coding agents since CCR-2026-0057; + setup re-checks the deny before the role is created. +lifecycle: + role_window: 'Standing (proposed; founder decides). Unlike the CCR-2026-0058 write + role, this role only reads a group-less synthetic identity, and a standing reader + lets the journey run as a scheduled check (T10) without a platform-admin per run. + Alternative: window-scoped like CCR-2026-0058, created and deleted with each admitted + run.' + deactivate: Delete the role, then the policy. The KV entry, the LLDAP user and the + privacyIDEA token stay under CCR-2026-0057. + rotate: As in CCR-2026-0057 (lane.py teardown and setup); the reader needs no change, + because the path stays the same. + compromised: Delete the privacyIDEA token SYNJOURNEY01 first (the account then cannot + pass MFA), delete this role, then tear down and set up as in CCR-2026-0057. The + identity has no groups, so a leak grants a sign-in that reaches no protected service. +delivery: + surface: native-workload-login + namespace: sso + service_account: nk-bind-executor + reader: Executor runtime (net-kingdom bounded-executor/, deployed by rapp-bounded-executor); + logs in with its projected ServiceAccount token, audience openbao, separately from + the CCR-2026-0058 write role; values stay in memory and never reach a Secret, log + or receipt + manifest: 'rapp-bounded-executor: manifests/rbac.yaml, templates/job.yaml' +risk: + classification: low + notes: + - Reachable value is one synthetic identity with no groups. Authelia and KeyCape + admit it, but no consuming service grants it anything (CCR-2026-0057 risk notes). + - A reader holding both values can complete an MFA sign-in as syn-journey, which is + the purpose. privacyIDEA refuses a reused TOTP time step, so a parallel use and + the journey can race; the journey then fails closed. + - The role is separate from the CCR-2026-0058 write role and from the ESO reader + (CCR-2026-0053); policies are never combined in one role. + - Node root, cluster admins able to mint tokens for sso/nk-bind-executor and platform-admin + remain inside this credential boundary. +verification: + positive: + - Exact policy and role read back; login as sso/nk-bind-executor (audience openbao) + gets only this policy with a lease of at most 15m + - The synthetic journey passes at aal2 with the values read through this role, with + a value-free receipt + negative: + - Write, metadata read, list, delete and sibling paths (including directory-binds) + are refused + - Wrong ServiceAccount, wrong namespace and wrong audience logins are denied + - Coding-agent boundary denies data and metadata of the path + activation_conditions: + - Explicit platform-owner and net-kingdom-owner approval of this exact request, which + includes the change to CCR-2026-0057's runtime_access boundary. + - ServiceAccount sso/nk-bind-executor exists from the reviewed rapp-bounded-executor + package (bound_claims_confirmed then set to true by the platform-owner). + - Attended platform-admin (aal2) session applies the policy and role from a reviewed + commit. + - Positive and negative results recorded in value-free receipts. diff --git a/openbao/policies/net-kingdom-bind-executor-syn-journey-read.hcl b/openbao/policies/net-kingdom-bind-executor-syn-journey-read.hcl new file mode 100644 index 0000000..173eaa9 --- /dev/null +++ b/openbao/policies/net-kingdom-bind-executor-syn-journey-read.hcl @@ -0,0 +1,3 @@ +path "platform/data/workloads/net-kingdom/synthetic-journey/syn-journey" { capabilities = ["read"] } +path "auth/token/lookup-self" { capabilities = ["read"] } +path "auth/token/revoke-self" { capabilities = ["update"] } diff --git a/workplans/RPF-WP-0069-bounded-executor-lanes.md b/workplans/RPF-WP-0069-bounded-executor-lanes.md index 5259c29..c42fdfb 100644 --- a/workplans/RPF-WP-0069-bounded-executor-lanes.md +++ b/workplans/RPF-WP-0069-bounded-executor-lanes.md @@ -78,7 +78,7 @@ id: RPF-WP-0069-T04 status: wait priority: medium blocked_on: human -blocking_reason: "Founder accepts widening CCR-2026-0057 runtime_access; scheduled with NK-WP-0056-T10 once sso/nk-bind-executor exists" +blocking_reason: "CCR-2026-0059 drafted (proposed): founder approval (platform-owner, net-kingdom-owner) incl. the CCR-2026-0057 runtime_access widening and the standing-vs-window role choice; apply needs sso/nk-bind-executor (rapp-bounded-executor make deploy)" state_hub_task_id: "5615be47-2b25-5f7d-a1c2-d4391b1377d0" ``` @@ -86,6 +86,18 @@ Draft a `workload-kv-read` CCR (native login, data read only, 15m) for `platform/workloads/net-kingdom/synthetic-journey/syn-journey`, stating that it widens CCR-2026-0057's `runtime_access: false`. Waits for T10 scheduling and the ServiceAccount. +**2026-10-31, drafted** at the founder's request (net-kingdom session): + +- `CCR-2026-0059-net-kingdom-bind-executor-syn-journey-read.yaml` and the policy + `openbao/policies/net-kingdom-bind-executor-syn-journey-read.hcl`: read on the data path, plus + `lookup-self` and `revoke-self`. +- Role `net-kingdom-bind-executor-syn-journey-read`: `sso/nk-bind-executor`, audience `openbao`, 15m, exactly one + policy. It is separate from the CCR-2026-0058 write role. +- `supersedes_boundary` names the CCR-2026-0057 change. +- `lifecycle.role_window` proposes a standing reader (founder decides; window-scoped is the alternative). +- `bound_claims_confirmed: false` until the ServiceAccount exists. Validates with only that warning. The + pre-existing failures (CCR-2026-0035 and 2 tests) are unrelated. + ## Executor audit-core sender (NK-WP-0040) ```task