coulomb/railiance-platform
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

security: record explicit approval of provider share normalization
Some checks are pending
CI Smoke / host-smoke (push) Waiting to run
Details
CI Smoke / container-smoke (push) Waiting to run
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a13eab-1e6a-7b33-9c37-372e90ada3a2
This commit is contained in:
codex 2026-10-16 07:44:37 +02:00
parent 99fd21ee37
commit d79079bb21
2 changed files with 26 additions and 20 deletions
Download patch file Download diff file Expand all files Collapse all files

23
credential-change-requests/CCR-2026-0048-net-kingdom-backup-publisher.yaml
View file

@ -22,22 +22,22 @@
{
"reviewer": "User (platform-owner)",
"decision": "approved",
"source_ref": "statehub:decision:40bfae40-6108-4e51-8613-073339f5345f",
"comment": "Operator approved the exact prepared live packet in this conversation: Good, i approve. Native claim confirmation and archive recovery remain required before activation.",
"source_ref": "statehub:decision:5edd5203-fae7-461b-8775-5d22b7873971",
"comment": "Operator approved initial live packet and subsequently explicitly approved provider-added folder-only re-sharing (publisher21/retention25). Native admission and independent recovery gates remain.",
"reviewed_at": "2026-10-15T23:51:21.372915+00:00"
},
{
"reviewer": "User (net-kingdom-owner)",
"decision": "approved",
"source_ref": "statehub:decision:40bfae40-6108-4e51-8613-073339f5345f",
"comment": "Operator approved the exact prepared live packet in this conversation: Good, i approve. Native claim confirmation and archive recovery remain required before activation.",
"source_ref": "statehub:decision:5edd5203-fae7-461b-8775-5d22b7873971",
"comment": "Operator approved initial live packet and subsequently explicitly approved provider-added folder-only re-sharing (publisher21/retention25). Native admission and independent recovery gates remain.",
"reviewed_at": "2026-10-15T23:51:21.372938+00:00"
},
{
"reviewer": "User (backup-share-owner)",
"decision": "approved",
"source_ref": "statehub:decision:40bfae40-6108-4e51-8613-073339f5345f",
"comment": "Operator approved the exact prepared live packet in this conversation: Good, i approve. Native claim confirmation and archive recovery remain required before activation.",
"source_ref": "statehub:decision:5edd5203-fae7-461b-8775-5d22b7873971",
"comment": "Operator approved initial live packet and subsequently explicitly approved provider-added folder-only re-sharing (publisher21/retention25). Native admission and independent recovery gates remain.",
"reviewed_at": "2026-10-15T23:51:21.372944+00:00"
}
]
@ -87,10 +87,12 @@
"account_owner": "Backup",
"folder": "/railiance-backups/net-kingdom-identity",
"share_type": 3,
"share_permissions": 5,
"share_permissions": 21,
"label": "net-kingdom-identity-publisher",
"age_private_key_delivered": false,
"backup_account_password_delivered": false
"backup_account_password_delivered": false,
"provider_added_resharing_approved": true,
"scope_approval_ref": "statehub:decision:5edd5203-fae7-461b-8775-5d22b7873971"
},
"delivery": {
"surface": "ESO-managed Secret",
@ -105,10 +107,11 @@
"classification": "high",
"notes": [
"Secret-bearing capture is limited to the four reviewed identity services; source/cluster/PVC bindings and private staging are mandatory.",
"Publisher can read/create in only this folder; retention can read/delete in only this folder. Neither grants update, reshare, other folders or account administration.",
"Publisher can read/create in only this folder; retention can read/delete in only this folder. Both also include explicitly owner-approved provider-added re-sharing, but neither grants update, other folders or account administration.",
"Compromise of the retention token can destroy backups in this folder; keep it separate from the publisher and retain independent custody/recovery points.",
"Node root and ESO administration are inside this credential boundary. Coding agents must be denied the new data/metadata paths.",
"KV initial CAS=0 only; preserve existing values and refuse drift. No rotation of service keys, age keys, operator credentials or existing shares."
"KV initial CAS=0 only; preserve existing values and refuse drift. No rotation of service keys, age keys, operator credentials or existing shares.",
"Nextcloud adds permission16 to read-enabled public links. User approved exact normalized21/25 on2026-10-16; tokens remain confined to the encrypted backup folder. Original5/9 attempt failed before credential publication."
]
},
"verification": {

23
credential-change-requests/CCR-2026-0049-net-kingdom-backup-retention.yaml
View file

@ -22,22 +22,22 @@
{
"reviewer": "User (platform-owner)",
"decision": "approved",
"source_ref": "statehub:decision:40bfae40-6108-4e51-8613-073339f5345f",
"comment": "Operator approved the exact prepared live packet in this conversation: Good, i approve. Native claim confirmation and archive recovery remain required before activation.",
"source_ref": "statehub:decision:5edd5203-fae7-461b-8775-5d22b7873971",
"comment": "Operator approved initial live packet and subsequently explicitly approved provider-added folder-only re-sharing (publisher21/retention25). Native admission and independent recovery gates remain.",
"reviewed_at": "2026-10-15T23:51:21.374014+00:00"
},
{
"reviewer": "User (net-kingdom-owner)",
"decision": "approved",
"source_ref": "statehub:decision:40bfae40-6108-4e51-8613-073339f5345f",
"comment": "Operator approved the exact prepared live packet in this conversation: Good, i approve. Native claim confirmation and archive recovery remain required before activation.",
"source_ref": "statehub:decision:5edd5203-fae7-461b-8775-5d22b7873971",
"comment": "Operator approved initial live packet and subsequently explicitly approved provider-added folder-only re-sharing (publisher21/retention25). Native admission and independent recovery gates remain.",
"reviewed_at": "2026-10-15T23:51:21.374033+00:00"
},
{
"reviewer": "User (backup-share-owner)",
"decision": "approved",
"source_ref": "statehub:decision:40bfae40-6108-4e51-8613-073339f5345f",
"comment": "Operator approved the exact prepared live packet in this conversation: Good, i approve. Native claim confirmation and archive recovery remain required before activation.",
"source_ref": "statehub:decision:5edd5203-fae7-461b-8775-5d22b7873971",
"comment": "Operator approved initial live packet and subsequently explicitly approved provider-added folder-only re-sharing (publisher21/retention25). Native admission and independent recovery gates remain.",
"reviewed_at": "2026-10-15T23:51:21.374039+00:00"
}
]
@ -87,10 +87,12 @@
"account_owner": "Backup",
"folder": "/railiance-backups/net-kingdom-identity",
"share_type": 3,
"share_permissions": 9,
"share_permissions": 25,
"label": "net-kingdom-identity-retention",
"age_private_key_delivered": false,
"backup_account_password_delivered": false
"backup_account_password_delivered": false,
"provider_added_resharing_approved": true,
"scope_approval_ref": "statehub:decision:5edd5203-fae7-461b-8775-5d22b7873971"
},
"delivery": {
"surface": "ESO-managed Secret",
@ -105,10 +107,11 @@
"classification": "high",
"notes": [
"Secret-bearing capture is limited to the four reviewed identity services; source/cluster/PVC bindings and private staging are mandatory.",
"Publisher can read/create in only this folder; retention can read/delete in only this folder. Neither grants update, reshare, other folders or account administration.",
"Publisher can read/create in only this folder; retention can read/delete in only this folder. Both also include explicitly owner-approved provider-added re-sharing, but neither grants update, other folders or account administration.",
"Compromise of the retention token can destroy backups in this folder; keep it separate from the publisher and retain independent custody/recovery points.",
"Node root and ESO administration are inside this credential boundary. Coding agents must be denied the new data/metadata paths.",
"KV initial CAS=0 only; preserve existing values and refuse drift. No rotation of service keys, age keys, operator credentials or existing shares."
"KV initial CAS=0 only; preserve existing values and refuse drift. No rotation of service keys, age keys, operator credentials or existing shares.",
"Nextcloud adds permission16 to read-enabled public links. User approved exact normalized21/25 on2026-10-16; tokens remain confined to the encrypted backup folder. Original5/9 attempt failed before credential publication."
]
},
"verification": {