coulomb/railiance-platform
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

RPF-WP-0035-T03: record founder apply, custody move and duplicate retirement
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
CCR-2026-0039 applied 2026-10-09T10:30Z with matching readback. The four
hall-of-helix entries moved from infotech to coulomb (v1 each; infotech
deleted). activity-core/default/llm-connect-provider-secrets retired. T03 now
waits on ops-mason verification and the owner salt CAS probe.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 469992@bnt-lap001
Assistant-Session: e4b8e420-df0a-441d-83ae-7f19130594d9
This commit is contained in:
codex 2026-10-09 12:31:13 +02:00
parent 64ae5946d9
commit ce1c1a6338
3 changed files with 221 additions and 25 deletions
Download patch file Download diff file Expand all files Collapse all files

88
credential-change-requests/CCR-2026-0039-fluid-telegram-hall-of-helix-operator-matrix.yaml
View file

@ -2,8 +2,9 @@ id: CCR-2026-0039
kind: credential-change-request
schema_version: 1
request_type: workload-kv-operator-matrix
title: fluid-telegram hall-of-helix attended operator KV lane (per-path matrix, OIDC aal2)
status: proposed
title: fluid-telegram hall-of-helix attended operator KV lane (per-path matrix, OIDC
aal2)
status: applied
created: '2026-10-09'
updated: '2026-10-09'
requester:
@ -11,22 +12,35 @@ requester:
reason: RPF-WP-0035-T03. Founder approved ops-mason plan fluid-telegram-operator-credential-lane
2026-10-09 (approved_spec_sha256 41a0ca2746aa93b6ee9d1ca631517d680ade95c56e7a38b75a55209ef2316b73)
and ruled the tenant segment stays coulomb (ops-mason message b72ff77d). Design
docs/credential-lane-designs/fluid-telegram-operator-kv.md; key-cape confirmed groups
and aal2 claims (message b2ed890f, key-cape e0b5fae).
docs/credential-lane-designs/fluid-telegram-operator-kv.md; key-cape confirmed
groups and aal2 claims (message b2ed890f, key-cape e0b5fae).
review:
required: true
required_approvers:
- platform-owner
- fluid-telegram-owner
- key-cape-owner
comments: []
comments:
- at: '2026-10-09T10:29:55+00:00'
reviewer: platform-owner, fluid-telegram-owner, key-cape-owner (founder Bernd
Worsch)
decision: approved
comment: 'Approve ops-mason plan fluid-telegram-operator-credential-lane (spec
41a0ca27): four-entry matrix at coulomb/fluid-telegram/hall-of-helix, OIDC role
on netkingdom, agent denies.'
- at: '2026-10-09T10:29:55+00:00'
reviewer: founder
decision: binding_confirmed
comment: groups=[fluid-telegram-operators] (LLDAP, member tegwick) and /assurance/level=aal2
match key-cape b2ed890f.
target:
domain: infotech
tenant: coulomb
workload: fluid-telegram
environment: production
purpose: Let a member of fluid-telegram-operators with a verified second factor run the
attended provisioner for campaign hall-of-helix with exactly the four-entry matrix.
purpose: Let a member of fluid-telegram-operators with a verified second factor
run the attended provisioner for campaign hall-of-helix with exactly the four-entry
matrix.
openbao:
mount: platform
campaign_path: platform/workloads/coulomb/fluid-telegram/hall-of-helix
@ -35,23 +49,37 @@ openbao:
boundary_overlay_file: openbao/fluid-telegram/agent-deny-overlay.hcl
matrix:
- entry: operator-app
fields: [api_id, api_hash]
capabilities: [read]
fields:
- api_id
- api_hash
capabilities:
- read
- entry: operator-session
fields: [session_b64]
capabilities: [create, read, update]
fields:
- session_b64
capabilities:
- create
- read
- update
- entry: bot-token
fields: [token]
capabilities: [create, read, update]
fields:
- token
capabilities:
- create
- read
- update
- entry: redaction-salt
fields: [salt]
capabilities: [create, read]
fields:
- salt
capabilities:
- create
- read
auth:
method: oidc
mount: netkingdom
role: fluid-telegram-hall-of-helix-workload-kv
role_file: openbao/auth/fluid-telegram-hall-of-helix-oidc-role.json
bound_claims_confirmed: false
bound_claims_confirmed: true
founder_confirmation_items:
- bound_claims_confirmed stays false until the founder confirms groups=[fluid-telegram-operators]
(LLDAP group, single member tegwick) and /assurance/level=aal2 against the key-cape
@ -59,8 +87,8 @@ founder_confirmation_items:
- The matrix grants no metadata, list, patch or delete. The salt is create-only by
ACL; first-write CAS 0 is the consumer's job (FT-WP-0002) and is verified by an
owner-run probe, not by ACL parameters.
- The apply appends exact coding-agent denies on all four data and metadata paths to
the live agent-high-risk-boundary policy, preserving its other content verbatim,
- The apply appends exact coding-agent denies on all four data and metadata paths
to the live agent-high-risk-boundary policy, preserving its other content verbatim,
and refuses if only some of those denies are already present.
access_frontdoor:
type: none
@ -68,9 +96,8 @@ access_frontdoor:
risk:
level: high
notes:
- operator-session is a full Telegram account session. Membership of
fluid-telegram-operators is the whole access decision; adding a member widens
this lane's reach.
- operator-session is a full Telegram account session. Membership of fluid-telegram-operators
is the whole access decision; adding a member widens this lane's reach.
- Tokens are 15m (30m maximum), no default policy, num_uses 0 so MTProto session
persistence is not interrupted; the provisioner self-revokes at completion.
verification:
@ -86,10 +113,23 @@ verification:
activation_conditions:
- Founder approval (three reviews) and bound_claims_confirmed true.
- Custody moved from the infotech prefix with scripts/fluid_telegram_custody_move.py.
evidence: []
evidence:
- at: '2026-10-09T10:30:01+00:00'
actor: founder
kind: delegated_metadata_apply
result: passed
details:
- Delegated metadata applier ran as founder using local bao CLI ambient authority.
- 'Agent boundary denies ensured: sys/policies/acl/agent-high-risk-boundary (8
exact paths)'
- 'Policy metadata write: sys/policies/acl/workload-kv-fluid-telegram-hall-of-helix-operator'
- 'OIDC role metadata write: auth/netkingdom/role/fluid-telegram-hall-of-helix-workload-kv'
- Readback matched source for boundary denies, policy and role.
- No secret values were read, written, printed, or accepted in argv.
lifecycle:
deactivate: Delete auth/netkingdom/role/fluid-telegram-hall-of-helix-workload-kv first,
then the policy; KV entries stay in custody pending an explicit retention decision.
deactivate: Delete auth/netkingdom/role/fluid-telegram-hall-of-helix-workload-kv
first, then the policy; KV entries stay in custody pending an explicit retention
decision.
rotate: Session compromise needs Telegram-side session revocation; bot-token rotation
needs provider replacement; salt rotation needs a data-owner decision.
compromised: Delete the role, revoke issued tokens, revoke the Telegram session.

147
docs/evidence/2026-10-09-fluid-telegram-t03-founder-session.json Normal file
View file

@ -0,0 +1,147 @@
{
"actor": "founder",
"ccr": "CCR-2026-0039",
"date": "2026-10-09",
"note": "Receipts copied verbatim; they hold versions, booleans and outcome codes only.",
"receipts": {
"custody_move": {
"credential_values_emitted": false,
"entries": {
"bot-token": {
"outcome": "copied",
"source_deleted": true,
"source_present": true,
"source_version": 1,
"target_present": false,
"target_version": 1
},
"operator-app": {
"outcome": "copied",
"source_deleted": true,
"source_present": true,
"source_version": 1,
"target_present": false,
"target_version": 1
},
"operator-session": {
"outcome": "copied",
"source_deleted": true,
"source_present": true,
"source_version": 4,
"target_present": false,
"target_version": 1
},
"redaction-salt": {
"outcome": "copied",
"source_deleted": true,
"source_present": true,
"source_version": 1,
"target_present": false,
"target_version": 1
}
},
"exit_code": 0,
"mode": "move",
"outcome": "moved",
"schema": "platform.fluid-telegram-custody-move.v1",
"source": "platform/workloads/infotech/fluid-telegram/hall-of-helix",
"target": "platform/workloads/coulomb/fluid-telegram/hall-of-helix"
},
"custody_move_dry_run": {
"credential_values_emitted": false,
"entries": {
"bot-token": {
"source_present": true,
"source_version": 1,
"target_present": false
},
"operator-app": {
"source_present": true,
"source_version": 1,
"target_present": false
},
"operator-session": {
"source_present": true,
"source_version": 4,
"target_present": false
},
"redaction-salt": {
"source_present": true,
"source_version": 1,
"target_present": false
}
},
"exit_code": 0,
"mode": "dry-run",
"outcome": "dry_run_would_move",
"schema": "platform.fluid-telegram-custody-move.v1",
"source": "platform/workloads/infotech/fluid-telegram/hall-of-helix",
"target": "platform/workloads/coulomb/fluid-telegram/hall-of-helix",
"value_reads": 0
},
"duplicate_retire": {
"canonical": "platform/workloads/activity-core/llm-connect/llm-connect-provider-secrets",
"canonical_live": true,
"duplicate": "platform/workloads/activity-core/default/llm-connect-provider-secrets",
"duplicate_deleted": true,
"duplicate_present_before": true,
"duplicate_versions": 1,
"exit_code": 0,
"granting_policies": {},
"metadata_only_policies": {
"ops-mason-survey": [
"platform/metadata/*"
],
"platform-readonly": [
"platform/metadata/*"
]
},
"mode": "retire",
"outcome": "retired",
"schema": "platform.kv-duplicate-retire.v1",
"value_reads": 0
},
"duplicate_retire_dry_run": {
"canonical": "platform/workloads/activity-core/llm-connect/llm-connect-provider-secrets",
"canonical_live": true,
"duplicate": "platform/workloads/activity-core/default/llm-connect-provider-secrets",
"duplicate_present_before": true,
"duplicate_versions": 1,
"exit_code": 0,
"granting_policies": {},
"metadata_only_policies": {
"ops-mason-survey": [
"platform/metadata/*"
],
"platform-readonly": [
"platform/metadata/*"
]
},
"mode": "dry-run",
"outcome": "dry_run_would_retire",
"schema": "platform.kv-duplicate-retire.v1",
"value_reads": 0
},
"duplicate_retire_dry_run_refused": {
"canonical": "platform/workloads/activity-core/llm-connect/llm-connect-provider-secrets",
"canonical_live": true,
"duplicate": "platform/workloads/activity-core/default/llm-connect-provider-secrets",
"duplicate_present_before": true,
"duplicate_versions": 1,
"exit_code": 3,
"granting_policies": {
"ops-mason-survey": [
"platform/metadata/*"
],
"platform-readonly": [
"platform/metadata/*"
]
},
"mode": "dry-run",
"outcome": "live_policy_grants_duplicate",
"schema": "platform.kv-duplicate-retire.v1",
"value_reads": 0
}
},
"schema": "platform.evidence.rpf-wp-0035-t03-founder-session.v1"
}

11
workplans/RPF-WP-0035-credential-lane-implementation.md
View file

@ -98,6 +98,15 @@ $W python3 scripts/fluid_telegram_custody_move.py --confirm 'MOVE fluid-telegram
$W python3 scripts/kv_duplicate_retire.py --confirm 'RETIRE activity-core/default/llm-connect-provider-secrets' --receipt ~/kv-retire.json
```
2026-10-09 (T03 founder session): CCR-2026-0039 applied at 10:30Z; readback
matched for the 8 boundary denies, policy and role. Custody move `moved`: all
four entries copied at coulomb v1 (operator-session from infotech v4) and the
infotech entries metadata-deleted. Duplicate
`activity-core/default/llm-connect-provider-secrets` retired; its first dry-run
refused on mount-wide `platform/metadata/*` survey grants, after which the check
was narrowed to data-path grants (`64ae594`). Receipts:
`docs/evidence/2026-10-09-fluid-telegram-t03-founder-session.json`.
2026-10-03: the historical D1 routing was withdrawn because provision/delivery already completed. Owner routing now uses decision `ab85ae8a-12a0-4945-ae64-1d3d86d5b26f`, specifically independent archive readback and coordinated interim audit bearer revocation acceptance. `needs_human` and the wait remain; resolving a decision requires owner receipt re-check, not automatic completion.
2026-10-03 (CUST-WP-0075): gate check. SECRETS-WP-0007-T04 is done (2026-09-27), so the gate named in the design is open. It is not the last one: the design says to confirm the exact live client registration and protected client-side custody before writing, and positive-login proof needs a real KeyCape service JWT. KeyCape's contract (`openbao-service-auth-contract.md`) and KEY-WP-0009 claim source registration only; the live registration of `secrets-engine-openbao` and its client-credential custody are "a separate approved custody action" that no workplan task owns yet (SECRETS-WP-0008-T06 waits on this task). Re-qualified with `blocked_on: message-from:key-cape`; key-cape was asked for the owning task id, which will replace it as `depends_on`. The design stays proposed and no child command was written. Not approvable in D1 yet.
@ -167,7 +176,7 @@ id: RPF-WP-0035-T03
status: wait
needs_human: true
decision_id: 62aa95e4-3ccc-4867-8806-5e3db005b483
blocking_reason: "Source ready 2026-10-09: CCR-2026-0039 (request type workload-kv-operator-matrix), silent custody move and duplicate-retire helpers. Waits on one attended founder session (commands in the 2026-10-09 T03 note), then ops-mason verification (MASON-WP-0005-T05) and the owner salt CAS probe."
blocking_reason: "Founder session done 2026-10-09: CCR-2026-0039 applied (readback matched), custody moved to coulomb, duplicate retired (docs/evidence/2026-10-09-fluid-telegram-t03-founder-session.json). Waits on ops-mason verification (MASON-WP-0005-T05: positive matrix, sibling/agent/non-member denial) and the owner salt CAS probe (FT-WP-0002)."
priority: high
state_hub_task_id: "f47e5bc5-6f3c-54bb-aa35-260ad03892ba"
```