coulomb/railiance-platform
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Record native ESO result and prepare scoped self-token amendment
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a10780-6d41-7952-9718-dfbc1f41236f
This commit is contained in:
tegwick 2026-10-04 23:21:55 +02:00
parent f7776013af
commit e84b68db01
7 changed files with 111 additions and 41 deletions
Download patch file Download diff file Expand all files Collapse all files

58
docs/provisioning-windows/2026-10-04-1000/informed-decision/checklist.md
View file

@ -1,41 +1,29 @@
# Requester delivery: approved, awaiting attended execution
# Requester delivery: metadata applied; ESO amendment pending
CCR-2026-0032 was approved by Bernd Worsch in the informed-decision session on
2026-10-04 after owner runtime acceptance at c084600. This is the exact requester
delivery approval; broader service cutover and issuer rotation remain separate.
The founder completed the attended metadata child with exit zero. Receipt:
`docs/evidence/requester-metadata/626537db6f7e45788bc0538054225ae5.json`.
ArgoCD application informed-decision-requester successfully synced manifest
revision 4332c391ea7f66479f67968222a45be4fc6e2f90. It has no automated sync or
pruning. The decision service deployment was not changed.
Approved CCR SHA256:
`c54dd86fd1bd754e64b135f02cac8d9a8f4db314cb3ca44c9645565aa816eee7`
Native validation exposed a missing prerequisite: ESO calls
`auth/token/lookup-self`, which the approved exact-path-only policy denies (403).
The amendment adds exactly these capabilities to the same reader policy:
The metadata child validates this digest, approved status, confirmed reviewed
binding, policy and role before execution. It compares both live objects before
writing missing metadata, refuses conflicts, and reads back exact configuration.
It neither reads credential values nor deploys Kubernetes objects.
Run from the founder's terminal with the existing OpenBao tunnel and browser:
```sh
BAO_ADDR=http://127.0.0.1:18200 VAULT_ADDR=http://127.0.0.1:18200 \
warden access openbao-platform-admin-login --exec -- \
python3 /home/worsch/railiance-platform/scripts/informed_decision_requester_metadata.py \
--expected-ccr-sha256 c54dd86fd1bd754e64b135f02cac8d9a8f4db314cb3ca44c9645565aa816eee7
```hcl
path "auth/token/lookup-self" { capabilities = ["read"] }
path "auth/token/revoke-self" { capabilities = ["update"] }
```
Warden performs OIDC/MFA, runs the silent child, revokes its session and removes
private custody. Return only the exit code. Exit zero confirms this metadata
operation and Warden cleanup; it does not prove workload delivery or acceptance.
On nonzero exit, inspect bounded native metadata before any retry.
No new data paths, metadata listing, default policy, TTL, account, namespace,
audience or approval scopes are proposed. These are self-token operations only.
CCR-2026-0032 is proposed for this amendment; previous approval/application
remain in its review history. Do not rerun the superseded command/digest.
After successful metadata execution, continue owner-controlled ESO deployment,
exact workload positive/negative proof, mounted projection and requester exchange.
Keep the receipt-contract checks pending until observed. No credential rotation
is included. Checklist complete: false; no live metadata applied by the agent.
## Helper repair after exit 11
The first attended attempt reported child_failed. Installed CLI testing exposed
an absence-diagnostic mismatch, now fixed. The exact CCR digest and command
above remain valid. The child compares both current objects before any writes,
and now records fixed phase/exit metadata under
`docs/evidence/requester-metadata/`. No CLI output or credential data is retained.
Report only the Warden exit code; the agent can inspect the bounded local receipt.
After founder approval, record the amended approved CCR digest. The updated
contained helper compares both objects before replacing only the exact previous
policy with the exact amended policy, preserves the role and refuses any other
drift. Fourteen helper tests pass, including predecessor upgrade and conflict
refusal. Run through the same attended platform-admin lane; it remains silent
and records fixed phase/exit metadata. Then verify ESO readiness and native scope,
projection/exchange and cleanup receipts. Checklist complete: false.