CCR-2026-0059 (proposed): bounded executor reads the syn-journey identity
workload-kv-read for platform/workloads/net-kingdom/synthetic-journey/syn-journey: read on the data path only, own role bound to sso/nk-bind-executor (audience openbao, 15m), separate from the CCR-2026-0058 write role. Widens CCR-2026-0057 runtime_access (stated). Standing reader proposed; founder decides. RPF-WP-0069-T04 updated. Not approved, not applied. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 5502@bnt-lap001 Assistant-Session: 68b3b02f-5d0f-4e71-8421-796f62e50196
This commit is contained in:
codex
parent
d0ff5349db
commit
c9b68ea4e4
3 changed files with 149 additions and 1 deletions
|
|
@ -0,0 +1,133 @@
|
|||
id: CCR-2026-0059
|
||||
kind: credential-change-request
|
||||
schema_version: 1
|
||||
request_type: workload-kv-read
|
||||
title: NetKingdom bounded executor reads the synthetic journey identity (syn-journey)
|
||||
status: proposed
|
||||
created: '2026-10-31'
|
||||
updated: '2026-10-31'
|
||||
requester:
|
||||
agent: claude-code
|
||||
reason: 'NK-WP-0056-T10/T06: the bounded executor service:nk-bind-executor runs the
|
||||
synthetic MFA journey (KeyCape, Authelia, privacyIDEA) as the check after each
|
||||
consumer restart, with no person signing in. It needs the syn-journey password
|
||||
and TOTP seed held under CCR-2026-0057. Lane design: railiance-platform docs/credential-lane-designs/bounded-executor.md
|
||||
"Journey secrets (T10)". Drafted by net-kingdom; not approved.'
|
||||
review:
|
||||
required: true
|
||||
required_approvers:
|
||||
- platform-owner
|
||||
- net-kingdom-owner
|
||||
comments: []
|
||||
supersedes_boundary:
|
||||
ccr: CCR-2026-0057
|
||||
field: openbao.runtime_access
|
||||
was: false
|
||||
change: 'This request gives one workload reader to the path CCR-2026-0057 holds with
|
||||
runtime_access: false. CCR-2026-0057''s attended setup, teardown and rotation
|
||||
stay valid and unchanged; its rotate (teardown + setup) does not need this role.'
|
||||
target:
|
||||
domain: infotech
|
||||
tenant: platform
|
||||
workload: net-kingdom-bind-executor
|
||||
rapp: rapp-bounded-executor
|
||||
environment: production
|
||||
purpose: Let only the executor ServiceAccount sso/nk-bind-executor read the syn-journey
|
||||
PASSWORD and TOTP_SEED to run the synthetic journey; no write, metadata, list,
|
||||
sibling path, or other identity
|
||||
admission:
|
||||
standard: net-kingdom canon/standards/bounded-execution-admission_v0.1.md (proposed)
|
||||
executor_identity: service:nk-bind-executor
|
||||
example: net-kingdom examples/bounded-execution-admission/bind-rotation-svc-authelia.yaml
|
||||
note: The journey is a check step under an admission. The OpenBao role does not
|
||||
evaluate the admission; it bounds what the ServiceAccount can read to one synthetic,
|
||||
group-less identity.
|
||||
openbao:
|
||||
mount: platform
|
||||
kv_path: platform/workloads/net-kingdom/synthetic-journey/syn-journey
|
||||
fields:
|
||||
- PASSWORD
|
||||
- TOTP_SEED
|
||||
policy_name: net-kingdom-bind-executor-syn-journey-read
|
||||
policy_file: openbao/policies/net-kingdom-bind-executor-syn-journey-read.hcl
|
||||
metadata_read: false
|
||||
token_self_lifecycle: true
|
||||
auth:
|
||||
method: kubernetes
|
||||
mount: kubernetes
|
||||
role: net-kingdom-bind-executor-syn-journey-read
|
||||
audience: openbao
|
||||
ttl: 15m
|
||||
token_max_ttl: 15m
|
||||
token_explicit_max_ttl: 15m
|
||||
token_no_default_policy: true
|
||||
policies:
|
||||
- net-kingdom-bind-executor-syn-journey-read
|
||||
bound_claims:
|
||||
service_account_names:
|
||||
- nk-bind-executor
|
||||
service_account_namespaces:
|
||||
- sso
|
||||
bound_claims_confirmed: false
|
||||
access_frontdoor:
|
||||
type: platform-owner
|
||||
catalog_id: net-kingdom-bind-executor-syn-journey-read
|
||||
readiness: pending-review
|
||||
resolvable: false
|
||||
agent_fence:
|
||||
data_and_metadata_denied: true
|
||||
note: The syn-journey data and metadata paths are denied to coding agents since CCR-2026-0057;
|
||||
setup re-checks the deny before the role is created.
|
||||
lifecycle:
|
||||
role_window: 'Standing (proposed; founder decides). Unlike the CCR-2026-0058 write
|
||||
role, this role only reads a group-less synthetic identity, and a standing reader
|
||||
lets the journey run as a scheduled check (T10) without a platform-admin per run.
|
||||
Alternative: window-scoped like CCR-2026-0058, created and deleted with each admitted
|
||||
run.'
|
||||
deactivate: Delete the role, then the policy. The KV entry, the LLDAP user and the
|
||||
privacyIDEA token stay under CCR-2026-0057.
|
||||
rotate: As in CCR-2026-0057 (lane.py teardown and setup); the reader needs no change,
|
||||
because the path stays the same.
|
||||
compromised: Delete the privacyIDEA token SYNJOURNEY01 first (the account then cannot
|
||||
pass MFA), delete this role, then tear down and set up as in CCR-2026-0057. The
|
||||
identity has no groups, so a leak grants a sign-in that reaches no protected service.
|
||||
delivery:
|
||||
surface: native-workload-login
|
||||
namespace: sso
|
||||
service_account: nk-bind-executor
|
||||
reader: Executor runtime (net-kingdom bounded-executor/, deployed by rapp-bounded-executor);
|
||||
logs in with its projected ServiceAccount token, audience openbao, separately from
|
||||
the CCR-2026-0058 write role; values stay in memory and never reach a Secret, log
|
||||
or receipt
|
||||
manifest: 'rapp-bounded-executor: manifests/rbac.yaml, templates/job.yaml'
|
||||
risk:
|
||||
classification: low
|
||||
notes:
|
||||
- Reachable value is one synthetic identity with no groups. Authelia and KeyCape
|
||||
admit it, but no consuming service grants it anything (CCR-2026-0057 risk notes).
|
||||
- A reader holding both values can complete an MFA sign-in as syn-journey, which is
|
||||
the purpose. privacyIDEA refuses a reused TOTP time step, so a parallel use and
|
||||
the journey can race; the journey then fails closed.
|
||||
- The role is separate from the CCR-2026-0058 write role and from the ESO reader
|
||||
(CCR-2026-0053); policies are never combined in one role.
|
||||
- Node root, cluster admins able to mint tokens for sso/nk-bind-executor and platform-admin
|
||||
remain inside this credential boundary.
|
||||
verification:
|
||||
positive:
|
||||
- Exact policy and role read back; login as sso/nk-bind-executor (audience openbao)
|
||||
gets only this policy with a lease of at most 15m
|
||||
- The synthetic journey passes at aal2 with the values read through this role, with
|
||||
a value-free receipt
|
||||
negative:
|
||||
- Write, metadata read, list, delete and sibling paths (including directory-binds)
|
||||
are refused
|
||||
- Wrong ServiceAccount, wrong namespace and wrong audience logins are denied
|
||||
- Coding-agent boundary denies data and metadata of the path
|
||||
activation_conditions:
|
||||
- Explicit platform-owner and net-kingdom-owner approval of this exact request, which
|
||||
includes the change to CCR-2026-0057's runtime_access boundary.
|
||||
- ServiceAccount sso/nk-bind-executor exists from the reviewed rapp-bounded-executor
|
||||
package (bound_claims_confirmed then set to true by the platform-owner).
|
||||
- Attended platform-admin (aal2) session applies the policy and role from a reviewed
|
||||
commit.
|
||||
- Positive and negative results recorded in value-free receipts.
|
||||
|
|
@ -0,0 +1,3 @@
|
|||
path "platform/data/workloads/net-kingdom/synthetic-journey/syn-journey" { capabilities = ["read"] }
|
||||
path "auth/token/lookup-self" { capabilities = ["read"] }
|
||||
path "auth/token/revoke-self" { capabilities = ["update"] }
|
||||
|
|
@ -78,7 +78,7 @@ id: RPF-WP-0069-T04
|
|||
status: wait
|
||||
priority: medium
|
||||
blocked_on: human
|
||||
blocking_reason: "Founder accepts widening CCR-2026-0057 runtime_access; scheduled with NK-WP-0056-T10 once sso/nk-bind-executor exists"
|
||||
blocking_reason: "CCR-2026-0059 drafted (proposed): founder approval (platform-owner, net-kingdom-owner) incl. the CCR-2026-0057 runtime_access widening and the standing-vs-window role choice; apply needs sso/nk-bind-executor (rapp-bounded-executor make deploy)"
|
||||
state_hub_task_id: "5615be47-2b25-5f7d-a1c2-d4391b1377d0"
|
||||
```
|
||||
|
||||
|
|
@ -86,6 +86,18 @@ Draft a `workload-kv-read` CCR (native login, data read only, 15m) for
|
|||
`platform/workloads/net-kingdom/synthetic-journey/syn-journey`, stating that it widens
|
||||
CCR-2026-0057's `runtime_access: false`. Waits for T10 scheduling and the ServiceAccount.
|
||||
|
||||
**2026-10-31, drafted** at the founder's request (net-kingdom session):
|
||||
|
||||
- `CCR-2026-0059-net-kingdom-bind-executor-syn-journey-read.yaml` and the policy
|
||||
`openbao/policies/net-kingdom-bind-executor-syn-journey-read.hcl`: read on the data path, plus
|
||||
`lookup-self` and `revoke-self`.
|
||||
- Role `net-kingdom-bind-executor-syn-journey-read`: `sso/nk-bind-executor`, audience `openbao`, 15m, exactly one
|
||||
policy. It is separate from the CCR-2026-0058 write role.
|
||||
- `supersedes_boundary` names the CCR-2026-0057 change.
|
||||
- `lifecycle.role_window` proposes a standing reader (founder decides; window-scoped is the alternative).
|
||||
- `bound_claims_confirmed: false` until the ServiceAccount exists. Validates with only that warning. The
|
||||
pre-existing failures (CCR-2026-0035 and 2 tests) are unrelated.
|
||||
|
||||
## Executor audit-core sender (NK-WP-0040)
|
||||
|
||||
```task
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue