From d2dbc19c254247652c49fda8721c80d53bca206a Mon Sep 17 00:00:00 2001 From: codex Date: Tue, 15 Sep 2026 02:08:39 +0200 Subject: [PATCH] Allocate sitting-requester CCR pair and record operator gates. CCR-2026-0026/0027 are proposed source only: new KV path, no apply, and no widening of 0024/0025. Record destroy-after-confirm for the npm duplicate, coordinated 0018 disablement, blocked historical NetKingdom paths, and no Forgejo retention cutover. Assistant: grok Assistant-Session: 01a0a23b-3bf0-7341-b4e5-9dc05f72573a --- .../sitting-requester.yaml | 47 ++++++++ ...d-decision-sitting-requester-verifier.yaml | 94 ++++++++++++++++ ...med-decision-sitting-requester-reader.yaml | 103 ++++++++++++++++++ ...net-kingdom-credential-custody-contract.md | 4 + ...rmed-decision-sitting-requester-client.hcl | 7 ++ ...pe-informed-decision-sitting-requester.hcl | 7 ++ workplans/README.md | 1 + ...7-keycape-live-secret-exposure-recovery.md | 7 +- ...-WP-0035-credential-lane-implementation.md | 14 ++- ...-0038-forgejo-scaleway-primary-coverage.md | 6 +- ...042-informed-decision-sitting-requester.md | 46 ++++++++ 11 files changed, 332 insertions(+), 4 deletions(-) create mode 100644 argocd/platform-addons/openbao-secretstore/sitting-requester.yaml create mode 100644 credential-change-requests/CCR-2026-0026-informed-decision-sitting-requester-verifier.yaml create mode 100644 credential-change-requests/CCR-2026-0027-informed-decision-sitting-requester-reader.yaml create mode 100644 openbao/policies/workload-kv-read-informed-decision-sitting-requester-client.hcl create mode 100644 openbao/policies/workload-kv-read-keycape-informed-decision-sitting-requester.hcl create mode 100644 workplans/RPF-WP-0042-informed-decision-sitting-requester.md diff --git a/argocd/platform-addons/openbao-secretstore/sitting-requester.yaml b/argocd/platform-addons/openbao-secretstore/sitting-requester.yaml new file mode 100644 index 0000000..059791e --- /dev/null +++ b/argocd/platform-addons/openbao-secretstore/sitting-requester.yaml @@ -0,0 +1,47 @@ +# CCR-2026-0026 (INFD-WP-0002, RPF-WP-0042). Source only. Do not apply from this +# file. KeyCape env KEYCAPE_INFORMED_DECISION_SITTING_REQUESTER_CLIENT_SECRET +# uses Kubernetes Secret key client-secret; OpenBao field is CLIENT_SECRET. +apiVersion: external-secrets.io/v1 +kind: ClusterSecretStore +metadata: + name: openbao-keycape-informed-decision-sitting-requester + labels: + app.kubernetes.io/part-of: railiance-gitops + railiance-platform/component: external-secrets + app.kubernetes.io/name: keycape +spec: + provider: + vault: + server: http://openbao.openbao.svc:8200 + path: platform + version: v2 + auth: + kubernetes: + mountPath: kubernetes + role: external-secrets-keycape-informed-decision-sitting-requester + serviceAccountRef: + name: external-secrets + namespace: external-secrets + conditions: + - namespaces: + - sso +--- +apiVersion: external-secrets.io/v1 +kind: ExternalSecret +metadata: + name: keycape-informed-decision-sitting-requester-client + namespace: sso +spec: + refreshInterval: 5m + secretStoreRef: + kind: ClusterSecretStore + name: openbao-keycape-informed-decision-sitting-requester + target: + name: keycape-informed-decision-sitting-requester-client + creationPolicy: Owner + deletionPolicy: Retain + data: + - secretKey: client-secret + remoteRef: + key: workloads/informed-decision/sitting-requester + property: CLIENT_SECRET diff --git a/credential-change-requests/CCR-2026-0026-informed-decision-sitting-requester-verifier.yaml b/credential-change-requests/CCR-2026-0026-informed-decision-sitting-requester-verifier.yaml new file mode 100644 index 0000000..8006eec --- /dev/null +++ b/credential-change-requests/CCR-2026-0026-informed-decision-sitting-requester-verifier.yaml @@ -0,0 +1,94 @@ +id: CCR-2026-0026 +kind: credential-change-request +schema_version: 1 +request_type: workload-kv-read +title: Informed Decision sitting-requester KeyCape verifier custody +status: proposed +created: '2026-09-15' +updated: '2026-09-15' +requester: + agent: grok + reason: INFD-WP-0002-T03 requested a create-only sitting presenter whose binding.actor + is informed-decision. Allocate a new CCR pair. Do not widen CCR-2026-0024, CCR-2026-0025 + or platform/workloads/secrets-engine/approval-requester. +review: + required: true + required_approvers: + - platform-operator + - key-cape-owner + comments: + - at: '2026-09-15' + reviewer: operator instruction in Grok session + decision: allocated + comment: Operator selected allocation of the sitting-requester CCR pair. Source + only. No OpenBao apply, no secret seed, no KeyCape registration, and no sitting + POST from this allocation. +target: + domain: financials + tenant: platform + workload: informed-decision + environment: production + purpose: create-only sitting requester KeyCape verifier custody; approval:create + only; subject informed-decision; audience approval-engine. +openbao: + mount: platform + kv_path: platform/workloads/informed-decision/sitting-requester + fields: + - CLIENT_SECRET + policy_name: workload-kv-read-keycape-informed-decision-sitting-requester + policy_file: openbao/policies/workload-kv-read-keycape-informed-decision-sitting-requester.hcl + auth: + method: kubernetes + mount: kubernetes + role: external-secrets-keycape-informed-decision-sitting-requester + bound_claims: + service_account_names: + - external-secrets + service_account_namespaces: + - external-secrets + bound_claims_confirmed: true + policies: + - workload-kv-read-keycape-informed-decision-sitting-requester + ttl: 15m +access_frontdoor: + type: ops-warden + catalog_id: informed-decision-sitting-requester-login + selector: Informed Decision create-only sitting requester + command: warden access informed-decision-sitting-requester-login --exec -- + resolvable: false + readiness: pending-review +delivery: + surface: external-secrets + target: sso/keycape-informed-decision-sitting-requester-client via ESO; env KEYCAPE_INFORMED_DECISION_SITTING_REQUESTER_CLIENT_SECRET +risk: + classification: high + notes: + - Credential authenticates only the separate approval:create sitting requester. + Human disposition remains on the public PKCE client informed-decision-approver. + - Do not widen CCR-2026-0024/0025 or secrets-engine/approval-requester. + - No approval, consume, or read scope. No sitting POST until exchange proof exists. +verification: + positive: + - Exact path read of CLIENT_SECRET for the KeyCape verifier ServiceAccount only. + - Sibling secrets-engine/approval-requester and parent listing denied. + negative: + - Approval and consume scopes refused at token exchange; wrong secret refused. + - Sibling KV paths and parent listing denied. + activation_conditions: + - KeyCape row informed-decision-sitting-requester exists and remains unregistered + until attended CAS=0 custody and exact policy/auth readback. + - Separate reader verification and no human entry synthesized. + - No sitting POST until exchange proof exists. +lifecycle: + deactivate: Disable the informed-decision-sitting-requester KeyCape registration + and detach only these two sitting-requester reader roles. Preserve CCR-2026-0024/0025 + and existing consumer/verifier lanes. + rotate: Rotate through KeyCape and platform using a new version with predecessor + refusal proof. + compromised: Disable sitting-requester issuance first; revoke sessions and rotate + under attended owner authority. +state_hub: + workplan_id: RPF-WP-0042 + task_id: RPF-WP-0042-T01 + related_request: CCR-2026-0027 + related_workplan: INFD-WP-0002 diff --git a/credential-change-requests/CCR-2026-0027-informed-decision-sitting-requester-reader.yaml b/credential-change-requests/CCR-2026-0027-informed-decision-sitting-requester-reader.yaml new file mode 100644 index 0000000..e0a2b9a --- /dev/null +++ b/credential-change-requests/CCR-2026-0027-informed-decision-sitting-requester-reader.yaml @@ -0,0 +1,103 @@ +id: CCR-2026-0027 +kind: credential-change-request +schema_version: 1 +request_type: workload-kv-read +title: Informed Decision sitting-requester attended operator reader +status: proposed +created: '2026-09-15' +updated: '2026-09-15' +requester: + agent: grok + reason: INFD-WP-0002-T03 requested a create-only sitting presenter whose binding.actor + is informed-decision. Allocate a new CCR pair. Do not widen CCR-2026-0024, CCR-2026-0025 + or platform/workloads/secrets-engine/approval-requester. +review: + required: true + required_approvers: + - platform-operator + - key-cape-owner + comments: + - at: '2026-09-15' + reviewer: operator instruction in Grok session + decision: allocated + comment: Operator selected allocation of the sitting-requester CCR pair. Source + only. No OpenBao apply, no secret seed, and no sitting POST from this allocation. +target: + domain: financials + tenant: platform + workload: informed-decision + environment: production + purpose: create-only sitting requester attended operator reader; approval:create + only; subject informed-decision; audience approval-engine. +openbao: + mount: platform + kv_path: platform/workloads/informed-decision/sitting-requester + fields: + - CLIENT_SECRET + policy_name: workload-kv-read-informed-decision-sitting-requester-client + policy_file: openbao/policies/workload-kv-read-informed-decision-sitting-requester-client.hcl + auth: + method: oidc + mount: netkingdom + role: informed-decision-sitting-requester-workload-kv-read + allowed_redirect_uris: + - https://bao.coulomb.social/ui/vault/auth/netkingdom/oidc/callback + - http://localhost:8250/oidc/callback + - http://127.0.0.1:8250/oidc/callback + oidc_scopes: + - openid + - profile + - email + - groups + user_claim: sub + groups_claim: groups + bound_claims: + groups: + - net-kingdom-admins + bound_claims_confirmed: true + policies: + - workload-kv-read-informed-decision-sitting-requester-client + ttl: 15m +access_frontdoor: + type: ops-warden + catalog_id: informed-decision-sitting-requester-login + selector: Informed Decision create-only sitting requester + command: warden access informed-decision-sitting-requester-login --exec -- + resolvable: false + readiness: pending-review +delivery: + surface: operator-workstation + target: Contained attended reader session; secret stays in memory for native requester + exchange; no retained file or raw output. +risk: + classification: high + notes: + - Credential authenticates only the separate approval:create sitting requester. + Human disposition remains on the public PKCE client informed-decision-approver. + - Do not widen CCR-2026-0024/0025 or secrets-engine/approval-requester. + - Bound group is net-kingdom-admins, matching CCR-2026-0019/0025 operator binding. +verification: + positive: + - Exact path read of CLIENT_SECRET for the attended operator identity only. + - Sibling secrets-engine/approval-requester and parent listing denied. + negative: + - Approval and consume scopes refused at token exchange; wrong secret refused. + - Sibling KV paths and parent listing denied. + activation_conditions: + - Attended platform authority, CAS=0 custody, exact policy/auth readback and synchronized + verifier delivery. + - Separate reader verification and no human entry synthesized. + - No sitting POST until exchange proof exists. +lifecycle: + deactivate: Disable the informed-decision-sitting-requester KeyCape registration + and detach only these two sitting-requester reader roles. Preserve CCR-2026-0024/0025 + and existing consumer/verifier lanes. + rotate: Rotate through KeyCape and platform using a new version with predecessor + refusal proof. + compromised: Disable sitting-requester issuance first; revoke sessions and rotate + under attended owner authority. +state_hub: + workplan_id: RPF-WP-0042 + task_id: RPF-WP-0042-T01 + related_request: CCR-2026-0026 + related_workplan: INFD-WP-0002 diff --git a/docs/net-kingdom-credential-custody-contract.md b/docs/net-kingdom-credential-custody-contract.md index f428902..45240a9 100644 --- a/docs/net-kingdom-credential-custody-contract.md +++ b/docs/net-kingdom-credential-custody-contract.md @@ -45,6 +45,10 @@ The routing lane is registered but remains `resolvable: false`. No restoration is authorized until the OpenBao owner publishes the missing metadata and the attended handoff is approved. +Operator decision 2026-09-15: leave both historical resolver lanes blocked. +Do not invent mount, path, or field names. The KeyCape factor service lane +below is separate and does not close this gate. + ## KeyCape factor service lane — authorized setup, 2026-09-13 RPF-WP-0040 / CCR-2026-0023 establish a new dedicated service lane. The user, diff --git a/openbao/policies/workload-kv-read-informed-decision-sitting-requester-client.hcl b/openbao/policies/workload-kv-read-informed-decision-sitting-requester-client.hcl new file mode 100644 index 0000000..f2079e8 --- /dev/null +++ b/openbao/policies/workload-kv-read-informed-decision-sitting-requester-client.hcl @@ -0,0 +1,7 @@ +path "platform/data/workloads/informed-decision/sitting-requester" { + capabilities = ["read"] +} + +path "platform/metadata/workloads/informed-decision/sitting-requester" { + capabilities = ["read"] +} diff --git a/openbao/policies/workload-kv-read-keycape-informed-decision-sitting-requester.hcl b/openbao/policies/workload-kv-read-keycape-informed-decision-sitting-requester.hcl new file mode 100644 index 0000000..f2079e8 --- /dev/null +++ b/openbao/policies/workload-kv-read-keycape-informed-decision-sitting-requester.hcl @@ -0,0 +1,7 @@ +path "platform/data/workloads/informed-decision/sitting-requester" { + capabilities = ["read"] +} + +path "platform/metadata/workloads/informed-decision/sitting-requester" { + capabilities = ["read"] +} diff --git a/workplans/README.md b/workplans/README.md index 38028a7..bf7d86d 100644 --- a/workplans/README.md +++ b/workplans/README.md @@ -14,6 +14,7 @@ plans is not a count of missing implementations or independent incidents. | [RPF-WP-0035](RPF-WP-0035-credential-lane-implementation.md) | Three remaining lanes: secrets-engine JWT, Fluid operator KV, KeyCape approval clients | Signing T04 is complete; T05 admission answered and awaiting owner approval plus a founder-attended window. | | [RPF-WP-0036](RPF-WP-0036-platform-service-assurance.md) | Implemented local assurance/admission; waits for recurring restore evidence, Q2 reception and owner handoff | Run the assurance commands; live acceptance and external ownership remain gated. | | [RPF-WP-0038](RPF-WP-0038-forgejo-scaleway-primary-coverage.md) | Native backup, full Scaleway archive recovery and 273 MiB Nextcloud essentials recovery verified; scheduled tier cutover remains | Bind recurring caller/dependencies, verified inventory, quota checks and separate owner retention. | +| [RPF-WP-0042](RPF-WP-0042-informed-decision-sitting-requester.md) | Sitting-requester CCR-2026-0026/0027 allocated; no apply | Do not widen 0024/0025. Attended seed waits on owner reviews and KeyCape row. | RPF-WP-0036-T02/T05/T07 are complete; T03/T04/T06 retain the remaining acceptance gates. Treat credential exposure closure as the highest-priority attended diff --git a/workplans/RPF-WP-0027-keycape-live-secret-exposure-recovery.md b/workplans/RPF-WP-0027-keycape-live-secret-exposure-recovery.md index 19e595a..9f789b7 100644 --- a/workplans/RPF-WP-0027-keycape-live-secret-exposure-recovery.md +++ b/workplans/RPF-WP-0027-keycape-live-secret-exposure-recovery.md @@ -9,7 +9,7 @@ flavor: implementation owner: codex topic_slug: railiance created: "2026-08-23" -updated: "2026-09-05" +updated: "2026-09-15" related: - KEY-WP-0011 origin: routed @@ -137,6 +137,11 @@ publication, update `docs/net-kingdom-credential-custody-contract.md`, ask ops-warden to refresh lane resolvability, and pass only protected inputs to NetKingdom's minimal resolver reconciliation flow. +**Operator decision, 2026-09-15:** leave both historical resolver lanes blocked. +Do not invent mount/path/field names. The KeyCape factor service lane from +RPF-WP-0040 remains the separate active custody; it does not close these +incident lanes. + ## Portfolio review — 2026-09-05 INTENT binding: secure custody and incident closure. The goal above is historical; diff --git a/workplans/RPF-WP-0035-credential-lane-implementation.md b/workplans/RPF-WP-0035-credential-lane-implementation.md index e0e22a8..1f3a819 100644 --- a/workplans/RPF-WP-0035-credential-lane-implementation.md +++ b/workplans/RPF-WP-0035-credential-lane-implementation.md @@ -8,7 +8,7 @@ status: blocked flavor: implementation owner: codex created: "2026-09-05" -updated: "2026-09-11" +updated: "2026-09-15" related: - RPF-WP-0032 - RPF-WP-0033 @@ -247,7 +247,7 @@ Rotation is a distinct, version-guarded operation. ```task id: RPF-WP-0035-T07 -status: todo +status: wait priority: high state_hub_task_id: "0dd7c9a5-65a0-53fc-b6c3-5ad96ee56f7b" ``` @@ -271,6 +271,11 @@ then a working production lane has been running off an ungoverned duplicate, and the governed lane's acceptance evidence describes a path the consumer does not use. That is worth establishing before anything is removed. +**Operator decision, 2026-09-15:** destroy the legacy path after confirming the +governed lane is the live consumer. Do not wrap `secret/coulomb/whynot-design/npm/publish` +in a CCR. Value remains unread. Platform will ask secrets-engine which path +publish actually reads before any attended destroy. + **Unblock:** secrets-engine confirms which location their publish actually reads and whether the two hold the same value; the owner of the legacy path is identified; and a metadata-or-field-name read of the legacy path is admitted so @@ -330,6 +335,11 @@ disables that live registration nor accepts indefinite retention. Keep this disposition in T06; it is separate from the wanted CCR-2026-0019 factory reader. No unilateral issuer/config/Secret change is authorized by this closeout. +**Operator decision, 2026-09-15:** coordinated disablement with KeyCape and +Approval Engine. Platform will not disable the live registration or verifier +delivery unilaterally. T06 stays `wait` until both owners confirm the joint +disablement sequence. + Residual handoff from RPF-WP-0035-T05; consumes the completed verifier custody without extending CCR-2026-0017/0018. Owner: railiance-platform with the named secrets-engine and approval-engine operator consumers. diff --git a/workplans/RPF-WP-0038-forgejo-scaleway-primary-coverage.md b/workplans/RPF-WP-0038-forgejo-scaleway-primary-coverage.md index f819e52..77f5899 100644 --- a/workplans/RPF-WP-0038-forgejo-scaleway-primary-coverage.md +++ b/workplans/RPF-WP-0038-forgejo-scaleway-primary-coverage.md @@ -8,7 +8,7 @@ status: active flavor: implementation owner: codex created: "2026-09-06" -updated: "2026-09-06" +updated: "2026-09-15" state_hub_workstream_id: "7beec1a7-aa82-5a36-9a66-6b60008a2455" --- @@ -114,3 +114,7 @@ leave a successful restore status. Historical primary decryption receipts remain accepted explicitly, while new decryption retains its own schema. No repeat upload, expiry or scheduled caller change was made; T04 remains in progress for the existing durable caller, inventory, quota and retention gates. + +**Operator decision, 2026-09-15:** do not expire retained backups or cut over +scheduled secondary delivery. The planner and attended executor stay idle until +durable caller/inventory/quota gates are closed. diff --git a/workplans/RPF-WP-0042-informed-decision-sitting-requester.md b/workplans/RPF-WP-0042-informed-decision-sitting-requester.md new file mode 100644 index 0000000..d0bd1b5 --- /dev/null +++ b/workplans/RPF-WP-0042-informed-decision-sitting-requester.md @@ -0,0 +1,46 @@ +--- +id: RPF-WP-0042 +type: workplan +title: "Allocate Informed Decision sitting-requester custody" +domain: financials +repo: railiance-platform +status: ready +flavor: implementation +owner: grok +topic_slug: railiance +created: "2026-09-15" +updated: "2026-09-15" +related: [INFD-WP-0002] +--- + +INFD-WP-0002 requested a create-only KeyCape sitting presenter. Platform +allocates a new CCR pair. Do not widen CCR-2026-0024, CCR-2026-0025, or +`platform/workloads/secrets-engine/approval-requester`. No apply, secret seed, +or sitting POST from allocation. + +## Allocate the verifier and attended-reader CCR pair + +```task +id: RPF-WP-0042-T01 +status: done +priority: high +``` + +CCR-2026-0026 (KeyCape ESO verifier) and CCR-2026-0027 (attended OIDC reader) +use KV `platform/workloads/informed-decision/sitting-requester`, field +`CLIENT_SECRET` only. Exact-path policies, Kubernetes ESO role, and +`net-kingdom-admins` reader binding are source-declared. Front door remains +non-resolvable. ESO projection is unapplied source. + +## Attended first provision and exchange proof + +```task +id: RPF-WP-0042-T02 +status: wait +priority: high +``` + +Requires named owner reviews, KeyCape row `informed-decision-sitting-requester`, +attended CAS=0 custody, exact policy/auth readback, sibling +`secrets-engine/approval-requester` denial, and create-only token-exchange proof. +No sitting POST until that proof exists.