retain exact historical owner-review revisions
Assistant: codex Assistant-Model: gpt-6.1-sol Assistant-Session: 01a126e1-76f8-7643-8cf3-e93336539ade
This commit is contained in:
codex
parent
62bbdee811
commit
f814c744fd
4 changed files with 201 additions and 0 deletions
|
|
@ -0,0 +1,27 @@
|
|||
# Platform owner confirmation — narrow proposal refinement
|
||||
|
||||
Disposition: **agree to the amended design**, proposal
|
||||
`KEY-WP-0039-T02/coordinated-negatives-v2`, SHA-256 `23f13d2a5a4204f749f35c5d44ef39d213838cd2fce1c36fb4775254ef1c7f09`.
|
||||
This refines `RPF-REVIEW-20261011-KEY0039-v2` as one review trial, not another
|
||||
scored success or a live authorization. Exact source hashes are retained in
|
||||
`2026-10-11-keycape-openbao-negative-session-owner-review-refinement.sources.json`.
|
||||
|
||||
Independently compared original proposal SHA-256 `d7b6d9782a2a39df02a36f806836158b75ed2d4a3aafe3db73fff316b551043d` with the amended
|
||||
packet. Exactly one paragraph changed: Platform's effective capability-denial
|
||||
matrix now includes `sys/policies/acl/*`, `auth/*/role/*`, and
|
||||
`auth/token/create`, in addition to both guarded KV data and metadata paths.
|
||||
No other proposal bytes changed. Runner remains SHA-256
|
||||
`bb9610babf44a959342bac700bb5712e97f400b44c4d0659d21df4426e616e19`.
|
||||
Original review and its unsuccessful condition are preserved as history; this
|
||||
amendment satisfies condition 1 without rewriting the original revision.
|
||||
|
||||
Platform re-agrees the explicit audience pin and temporary matching expiry
|
||||
client, positive-control acceptance followed by immediate successful revoke,
|
||||
complete effective-denial matrix, owner-separated no-fallback proof and verified
|
||||
finally cleanup. Source design review can satisfy Platform's portion of
|
||||
KEY-WP-0039-T01 after other required owner concurrence. Runtime metadata,
|
||||
normalized leeway, exact founder-scoped approval, native execution and cleanup
|
||||
remain preflight/execution gates; their current absence does not make this
|
||||
reviewed design incomplete or prove them achieved. KEY-WP-0039-T02 and
|
||||
RPF-WP-0035-T02 remain open. No probe, token, live Secret or mutation was read
|
||||
or executed during this confirmation.
|
||||
|
|
@ -0,0 +1,21 @@
|
|||
{
|
||||
"review_id": "RPF-REVIEW-20261011-KEY0039-v2-refinement-1",
|
||||
"refines": "RPF-REVIEW-20261011-KEY0039-v2",
|
||||
"original_proposal_sha256": "d7b6d9782a2a39df02a36f806836158b75ed2d4a3aafe3db73fff316b551043d",
|
||||
"amended_proposal_sha256": "23f13d2a5a4204f749f35c5d44ef39d213838cd2fce1c36fb4775254ef1c7f09",
|
||||
"original_review_sha256": "33b0d7f22634c804d364e84f83133d50079820a8a98758ceb5186893a7c24782",
|
||||
"original_review_sources_sha256": "1c030bafcc0456d690f24bb6e19b756f87e30037b94139a7646495ebb1319876",
|
||||
"runner_sha256": "bb9610babf44a959342bac700bb5712e97f400b44c4d0659d21df4426e616e19",
|
||||
"disposition": "agree-design",
|
||||
"change_scope": "exact paragraph adds three omitted CCR-required capabilities deny paths; no other bytes changed",
|
||||
"original_condition_outcome": "original proposal omitted required paths; condition1 satisfied by explicit narrow refinement, original outcome preserved",
|
||||
"native_execution": false,
|
||||
"human_live_approval": false,
|
||||
"live_gates_remaining": [
|
||||
"actual role/config raw and effective leeway metadata",
|
||||
"net-kingdom live registry custody concurrence",
|
||||
"exact final scoped foundergo",
|
||||
"native eight refusals, expiry acceptance+selfrevoke, effective denial and preserved nofallback",
|
||||
"verified cleanup and health"
|
||||
]
|
||||
}
|
||||
|
|
@ -0,0 +1,66 @@
|
|||
# Platform owner review — KeyCape OpenBao negative session v2
|
||||
|
||||
Disposition: **agree with conditions** for the exact source hashes retained in
|
||||
`2026-10-11-keycape-openbao-negative-session-owner-review.sources.json`.
|
||||
Review ID `RPF-REVIEW-20261011-KEY0039-v2`; proposal
|
||||
`KEY-WP-0039-T02/coordinated-negatives-v2`. This is independent Platform owner
|
||||
re-agreement, not founder approval, an executable grant, or native acceptance.
|
||||
No token, live Secret, login or mutation was accessed for this review.
|
||||
|
||||
The amended packet correctly makes non-audience probes pin
|
||||
`secrets-engine-openbao`; KeyCape defaults audience to clientId otherwise, so
|
||||
a subject/tenant/roles/scope refusal would be confounded. The runner requires
|
||||
exactly the designated difference among six bound claims and issuer match.
|
||||
Existing human and coding-agent tokens deliberately establish only class
|
||||
refusal, not isolated principal_type enforcement; absent coding-agent custody
|
||||
stays inconclusive, not silently skipped. The expiry registration matches every
|
||||
bound claim, has one-minute issuance, is first accepted, and its resulting
|
||||
OpenBao session must be successfully revoke-self'ed immediately. Only then is
|
||||
the same JWT tested beyond expiry. This knowingly creates a temporary credential
|
||||
capable of login as secrets-engine; the earlier CCR approval does not authorize
|
||||
creating that registration.
|
||||
|
||||
17 synthetic runner tests pass. They substantiate semantic classifications,
|
||||
positive expiry control, confirmed revocation, transport/ambiguous failures,
|
||||
claim isolation, redirect refusal and nonretention. They do not prove native
|
||||
RS256 issuance/signature verification, current role, or cleanup. Unexpected
|
||||
acceptance fails the case; failed revoke halts further presentations. A later
|
||||
cleanup does not rewrite failed or uncertain outcomes.
|
||||
|
||||
## Conditions before execution or task closure
|
||||
|
||||
1. Restore the complete CCR-2026-0038 capability-deny acceptance matrix in the
|
||||
final session packet. The reviewed proposal mentions the guarded KV data and
|
||||
metadata paths but omits `sys/policies/acl/*`, `auth/*/role/*`, and
|
||||
`auth/token/create`, all explicitly required by the applied CCR. Platform
|
||||
retains effective-policy checks and service-session revocation separately
|
||||
from KeyCape's negative runner; no KV value read is needed.
|
||||
2. Obtain value-free live role/config readback immediately before mutation and
|
||||
retain exact binding/policy/issuer/algorithm plus raw and normalized leeway.
|
||||
The source role has no expiration_leeway field. Omitted/zero means 150 seconds and
|
||||
-1 disables it according to [OpenBao JWT API](https://openbao.org/api-docs/2.5.x/auth/jwt/);
|
||||
this does not establish what the live role currently carries. Normalize a
|
||||
duration-string value if present; do not pass raw -1 to the runner. Stop on
|
||||
unreviewed role or registry changes.
|
||||
3. Obtain NetKingdom concurrence on temporary registry/envrefs and restart
|
||||
custody, then separate founder approval naming the exact final source
|
||||
revision/digests, six clients, unique transient Secret/envrefs, bounded
|
||||
attended window and rollback. Owner re-agreement here supplies no live go.
|
||||
4. Retain eight semantically valid native refusal receipts, expiry positive
|
||||
acceptance/revocation, unchanged-or-repeated consumer no-fallback proof and
|
||||
full effective capability denial. No-fallback is a secrets-engine consumer
|
||||
obligation; the login-only runner cannot prove it. Retain finally cleanup:
|
||||
six registrations/envrefs absent, invalid_client for each removed client,
|
||||
transient Secret/private files removed and health/positive behavior restored.
|
||||
Issued JWT residual TTL remains even after registration removal.
|
||||
|
||||
The temporary secrets remain attended Kubernetes delivery only, with no OpenBao
|
||||
custody or retained files beyond the stated session. Production registration,
|
||||
client credential, role, policy and custody are unchanged. Concurrent source or
|
||||
Deployment change requires owner reconciliation, not blanket baseline overwrite.
|
||||
|
||||
RPF-WP-0035-T02 remains open until those native receipts exist.
|
||||
MASON-WP-0009-T05 separately retains operator/ESO capabilities, nonmember refusal
|
||||
and routing activation. Neither task is closed by this review or by 17 tests.
|
||||
Any source amendment changes the reviewed hash and requires explicit narrow
|
||||
review confirmation; this receipt preserves the reviewed revision.
|
||||
|
|
@ -0,0 +1,87 @@
|
|||
{
|
||||
"reviewer_role": "railiance-platform owner",
|
||||
"agent_assignment": "dedicated independent owner review",
|
||||
"review_id": "RPF-REVIEW-20261011-KEY0039-v2",
|
||||
"proposal_id": "KEY-WP-0039-T02/coordinated-negatives-v2",
|
||||
"disposition": "agree-with-conditions",
|
||||
"human_live_approval": false,
|
||||
"native_execution": false,
|
||||
"tests": {
|
||||
"command": "PYTHONDONTWRITEBYTECODE=1 python3 -m unittest discover -s /tmp/jwt-acceptance-stage/key-cape/scripts -p test_openbao_negative_probe.py -v",
|
||||
"passed": 17,
|
||||
"scope": "synthetic runner mechanics, not issuer/verifier acceptance"
|
||||
},
|
||||
"sources": [
|
||||
{
|
||||
"path": "/home/worsch/railiance-platform/AGENTS.md",
|
||||
"sha256": "8d2f1a165e3f4eecf2e6e1d6a19c4bac9e8dcb64a76650e7185d55722f233c8b",
|
||||
"kind": "current-owner-source"
|
||||
},
|
||||
{
|
||||
"path": "/home/worsch/railiance-platform/INTENT.md",
|
||||
"sha256": "12c6540735af591f7a4a9fe85ff10d3cd00eec55b5b6b1ddf148abf2d3ac9a9c",
|
||||
"kind": "current-owner-source"
|
||||
},
|
||||
{
|
||||
"path": "/home/worsch/railiance-platform/credential-change-requests/CCR-2026-0038-secrets-engine-service-jwt-login.yaml",
|
||||
"sha256": "65b2cfb772623da59c351033ab4eb2ec7adfbd109778e787c7fe1b0e185a3bc0",
|
||||
"kind": "current-owner-source"
|
||||
},
|
||||
{
|
||||
"path": "/home/worsch/railiance-platform/openbao/auth/secrets-engine-jwt-role.json",
|
||||
"sha256": "529dc23193be42cbe0d4440f902a64ca7c9158da158c9da13396aa0030480f40",
|
||||
"kind": "current-owner-source"
|
||||
},
|
||||
{
|
||||
"path": "/home/worsch/railiance-platform/openbao/auth/keycape-services-config.json",
|
||||
"sha256": "a059cbf0985c9f114a67e8bb0e0a0cb0ffcab7cffc402ca477b80963a5a7b12a",
|
||||
"kind": "current-owner-source"
|
||||
},
|
||||
{
|
||||
"path": "/home/worsch/railiance-platform/openbao/policies/secrets-engine-login-self.hcl",
|
||||
"sha256": "d1a2969dd2949c822972e9b32243650567ac123a669f3fc609e9bfea977bb4eb",
|
||||
"kind": "current-owner-source"
|
||||
},
|
||||
{
|
||||
"path": "/home/worsch/key-cape/docs/openbao-negative-probe-clients.yaml",
|
||||
"sha256": "4f38badef723c08871a28a446707e71be1d3cba8b4c3bcedb2759be65e4e3ed5",
|
||||
"kind": "current-owner-source"
|
||||
},
|
||||
{
|
||||
"path": "/home/worsch/key-cape/config/service-clients.example.yaml",
|
||||
"sha256": "b7e17698a0946f387c481b7e27fe9ddea22cdd9db2e34e32a50457e02a34b18e",
|
||||
"kind": "current-owner-source"
|
||||
},
|
||||
{
|
||||
"path": "/tmp/jwt-acceptance-stage/key-cape/docs/openbao-negative-probe-session-proposal.md",
|
||||
"owner_path": "key-cape/docs/openbao-negative-probe-session-proposal.md",
|
||||
"sha256": "d7b6d9782a2a39df02a36f806836158b75ed2d4a3aafe3db73fff316b551043d",
|
||||
"kind": "reviewed-staged-revision"
|
||||
},
|
||||
{
|
||||
"path": "/tmp/jwt-acceptance-stage/key-cape/scripts/openbao_negative_probe.py",
|
||||
"owner_path": "key-cape/scripts/openbao_negative_probe.py",
|
||||
"sha256": "bb9610babf44a959342bac700bb5712e97f400b44c4d0659d21df4426e616e19",
|
||||
"kind": "reviewed-staged-revision"
|
||||
},
|
||||
{
|
||||
"path": "/tmp/jwt-acceptance-stage/key-cape/scripts/test_openbao_negative_probe.py",
|
||||
"owner_path": "key-cape/scripts/test_openbao_negative_probe.py",
|
||||
"sha256": "08d5598357c4db72672b2c4dc21ef09711ac4f9873fb29f8a6949d34afb8d85c",
|
||||
"kind": "reviewed-staged-revision"
|
||||
},
|
||||
{
|
||||
"path": "/tmp/jwt-acceptance-stage/key-cape/workplans/KEY-WP-0039-openbao-negative-probe-tokens.md",
|
||||
"owner_path": "key-cape/workplans/KEY-WP-0039-openbao-negative-probe-tokens.md",
|
||||
"sha256": "11fe539f914bdb7036236ffc112bc701ebf864d0929b2ee88e2d66ec470d53d4",
|
||||
"kind": "reviewed-staged-revision"
|
||||
}
|
||||
],
|
||||
"external_reference": "https://openbao.org/api-docs/2.5.x/auth/jwt/",
|
||||
"conditions": [
|
||||
"Restore complete CCR0038 capabilities deny matrix: guarded KV data+metadata, sys/policies/acl/*, auth/*/role/*, auth/token/create; retain service-session revoke receipt.",
|
||||
"Capture actual live role/config metadata and raw/effective expiration leeway; source omission alone is not live verification. Abort on different binding/policy/issuer/algorithm or unreviewed registry.",
|
||||
"Final exact revision, six temporary clients/Secret/envrefs, attended bounded window, net-kingdom owner concurrence and separate founder scopedgo required.",
|
||||
"Require all eight semantically appropriate negatives, valid expiry acceptance/selfrevoke, preserved nofallback evidence and verified finallycleanup; runner all_refused alone cannot finish owner tasks."
|
||||
]
|
||||
}
|
||||
Loading…
Add table
Add a link
Reference in a new issue