diff --git a/docs/reviews/2026-10-11-keycape-openbao-negative-session-owner-review-refinement.md b/docs/reviews/2026-10-11-keycape-openbao-negative-session-owner-review-refinement.md new file mode 100644 index 0000000..adb80e6 --- /dev/null +++ b/docs/reviews/2026-10-11-keycape-openbao-negative-session-owner-review-refinement.md @@ -0,0 +1,27 @@ +# Platform owner confirmation — narrow proposal refinement + +Disposition: **agree to the amended design**, proposal +`KEY-WP-0039-T02/coordinated-negatives-v2`, SHA-256 `23f13d2a5a4204f749f35c5d44ef39d213838cd2fce1c36fb4775254ef1c7f09`. +This refines `RPF-REVIEW-20261011-KEY0039-v2` as one review trial, not another +scored success or a live authorization. Exact source hashes are retained in +`2026-10-11-keycape-openbao-negative-session-owner-review-refinement.sources.json`. + +Independently compared original proposal SHA-256 `d7b6d9782a2a39df02a36f806836158b75ed2d4a3aafe3db73fff316b551043d` with the amended +packet. Exactly one paragraph changed: Platform's effective capability-denial +matrix now includes `sys/policies/acl/*`, `auth/*/role/*`, and +`auth/token/create`, in addition to both guarded KV data and metadata paths. +No other proposal bytes changed. Runner remains SHA-256 +`bb9610babf44a959342bac700bb5712e97f400b44c4d0659d21df4426e616e19`. +Original review and its unsuccessful condition are preserved as history; this +amendment satisfies condition 1 without rewriting the original revision. + +Platform re-agrees the explicit audience pin and temporary matching expiry +client, positive-control acceptance followed by immediate successful revoke, +complete effective-denial matrix, owner-separated no-fallback proof and verified +finally cleanup. Source design review can satisfy Platform's portion of +KEY-WP-0039-T01 after other required owner concurrence. Runtime metadata, +normalized leeway, exact founder-scoped approval, native execution and cleanup +remain preflight/execution gates; their current absence does not make this +reviewed design incomplete or prove them achieved. KEY-WP-0039-T02 and +RPF-WP-0035-T02 remain open. No probe, token, live Secret or mutation was read +or executed during this confirmation. diff --git a/docs/reviews/2026-10-11-keycape-openbao-negative-session-owner-review-refinement.sources.json b/docs/reviews/2026-10-11-keycape-openbao-negative-session-owner-review-refinement.sources.json new file mode 100644 index 0000000..c35839b --- /dev/null +++ b/docs/reviews/2026-10-11-keycape-openbao-negative-session-owner-review-refinement.sources.json @@ -0,0 +1,21 @@ +{ + "review_id": "RPF-REVIEW-20261011-KEY0039-v2-refinement-1", + "refines": "RPF-REVIEW-20261011-KEY0039-v2", + "original_proposal_sha256": "d7b6d9782a2a39df02a36f806836158b75ed2d4a3aafe3db73fff316b551043d", + "amended_proposal_sha256": "23f13d2a5a4204f749f35c5d44ef39d213838cd2fce1c36fb4775254ef1c7f09", + "original_review_sha256": "33b0d7f22634c804d364e84f83133d50079820a8a98758ceb5186893a7c24782", + "original_review_sources_sha256": "1c030bafcc0456d690f24bb6e19b756f87e30037b94139a7646495ebb1319876", + "runner_sha256": "bb9610babf44a959342bac700bb5712e97f400b44c4d0659d21df4426e616e19", + "disposition": "agree-design", + "change_scope": "exact paragraph adds three omitted CCR-required capabilities deny paths; no other bytes changed", + "original_condition_outcome": "original proposal omitted required paths; condition1 satisfied by explicit narrow refinement, original outcome preserved", + "native_execution": false, + "human_live_approval": false, + "live_gates_remaining": [ + "actual role/config raw and effective leeway metadata", + "net-kingdom live registry custody concurrence", + "exact final scoped foundergo", + "native eight refusals, expiry acceptance+selfrevoke, effective denial and preserved nofallback", + "verified cleanup and health" + ] +} diff --git a/docs/reviews/2026-10-11-keycape-openbao-negative-session-owner-review.md b/docs/reviews/2026-10-11-keycape-openbao-negative-session-owner-review.md new file mode 100644 index 0000000..2af611f --- /dev/null +++ b/docs/reviews/2026-10-11-keycape-openbao-negative-session-owner-review.md @@ -0,0 +1,66 @@ +# Platform owner review — KeyCape OpenBao negative session v2 + +Disposition: **agree with conditions** for the exact source hashes retained in +`2026-10-11-keycape-openbao-negative-session-owner-review.sources.json`. +Review ID `RPF-REVIEW-20261011-KEY0039-v2`; proposal +`KEY-WP-0039-T02/coordinated-negatives-v2`. This is independent Platform owner +re-agreement, not founder approval, an executable grant, or native acceptance. +No token, live Secret, login or mutation was accessed for this review. + +The amended packet correctly makes non-audience probes pin +`secrets-engine-openbao`; KeyCape defaults audience to clientId otherwise, so +a subject/tenant/roles/scope refusal would be confounded. The runner requires +exactly the designated difference among six bound claims and issuer match. +Existing human and coding-agent tokens deliberately establish only class +refusal, not isolated principal_type enforcement; absent coding-agent custody +stays inconclusive, not silently skipped. The expiry registration matches every +bound claim, has one-minute issuance, is first accepted, and its resulting +OpenBao session must be successfully revoke-self'ed immediately. Only then is +the same JWT tested beyond expiry. This knowingly creates a temporary credential +capable of login as secrets-engine; the earlier CCR approval does not authorize +creating that registration. + +17 synthetic runner tests pass. They substantiate semantic classifications, +positive expiry control, confirmed revocation, transport/ambiguous failures, +claim isolation, redirect refusal and nonretention. They do not prove native +RS256 issuance/signature verification, current role, or cleanup. Unexpected +acceptance fails the case; failed revoke halts further presentations. A later +cleanup does not rewrite failed or uncertain outcomes. + +## Conditions before execution or task closure + +1. Restore the complete CCR-2026-0038 capability-deny acceptance matrix in the + final session packet. The reviewed proposal mentions the guarded KV data and + metadata paths but omits `sys/policies/acl/*`, `auth/*/role/*`, and + `auth/token/create`, all explicitly required by the applied CCR. Platform + retains effective-policy checks and service-session revocation separately + from KeyCape's negative runner; no KV value read is needed. +2. Obtain value-free live role/config readback immediately before mutation and + retain exact binding/policy/issuer/algorithm plus raw and normalized leeway. + The source role has no expiration_leeway field. Omitted/zero means 150 seconds and + -1 disables it according to [OpenBao JWT API](https://openbao.org/api-docs/2.5.x/auth/jwt/); + this does not establish what the live role currently carries. Normalize a + duration-string value if present; do not pass raw -1 to the runner. Stop on + unreviewed role or registry changes. +3. Obtain NetKingdom concurrence on temporary registry/envrefs and restart + custody, then separate founder approval naming the exact final source + revision/digests, six clients, unique transient Secret/envrefs, bounded + attended window and rollback. Owner re-agreement here supplies no live go. +4. Retain eight semantically valid native refusal receipts, expiry positive + acceptance/revocation, unchanged-or-repeated consumer no-fallback proof and + full effective capability denial. No-fallback is a secrets-engine consumer + obligation; the login-only runner cannot prove it. Retain finally cleanup: + six registrations/envrefs absent, invalid_client for each removed client, + transient Secret/private files removed and health/positive behavior restored. + Issued JWT residual TTL remains even after registration removal. + +The temporary secrets remain attended Kubernetes delivery only, with no OpenBao +custody or retained files beyond the stated session. Production registration, +client credential, role, policy and custody are unchanged. Concurrent source or +Deployment change requires owner reconciliation, not blanket baseline overwrite. + +RPF-WP-0035-T02 remains open until those native receipts exist. +MASON-WP-0009-T05 separately retains operator/ESO capabilities, nonmember refusal +and routing activation. Neither task is closed by this review or by 17 tests. +Any source amendment changes the reviewed hash and requires explicit narrow +review confirmation; this receipt preserves the reviewed revision. diff --git a/docs/reviews/2026-10-11-keycape-openbao-negative-session-owner-review.sources.json b/docs/reviews/2026-10-11-keycape-openbao-negative-session-owner-review.sources.json new file mode 100644 index 0000000..9b2b704 --- /dev/null +++ b/docs/reviews/2026-10-11-keycape-openbao-negative-session-owner-review.sources.json @@ -0,0 +1,87 @@ +{ + "reviewer_role": "railiance-platform owner", + "agent_assignment": "dedicated independent owner review", + "review_id": "RPF-REVIEW-20261011-KEY0039-v2", + "proposal_id": "KEY-WP-0039-T02/coordinated-negatives-v2", + "disposition": "agree-with-conditions", + "human_live_approval": false, + "native_execution": false, + "tests": { + "command": "PYTHONDONTWRITEBYTECODE=1 python3 -m unittest discover -s /tmp/jwt-acceptance-stage/key-cape/scripts -p test_openbao_negative_probe.py -v", + "passed": 17, + "scope": "synthetic runner mechanics, not issuer/verifier acceptance" + }, + "sources": [ + { + "path": "/home/worsch/railiance-platform/AGENTS.md", + "sha256": "8d2f1a165e3f4eecf2e6e1d6a19c4bac9e8dcb64a76650e7185d55722f233c8b", + "kind": "current-owner-source" + }, + { + "path": "/home/worsch/railiance-platform/INTENT.md", + "sha256": "12c6540735af591f7a4a9fe85ff10d3cd00eec55b5b6b1ddf148abf2d3ac9a9c", + "kind": "current-owner-source" + }, + { + "path": "/home/worsch/railiance-platform/credential-change-requests/CCR-2026-0038-secrets-engine-service-jwt-login.yaml", + "sha256": "65b2cfb772623da59c351033ab4eb2ec7adfbd109778e787c7fe1b0e185a3bc0", + "kind": "current-owner-source" + }, + { + "path": "/home/worsch/railiance-platform/openbao/auth/secrets-engine-jwt-role.json", + "sha256": "529dc23193be42cbe0d4440f902a64ca7c9158da158c9da13396aa0030480f40", + "kind": "current-owner-source" + }, + { + "path": "/home/worsch/railiance-platform/openbao/auth/keycape-services-config.json", + "sha256": "a059cbf0985c9f114a67e8bb0e0a0cb0ffcab7cffc402ca477b80963a5a7b12a", + "kind": "current-owner-source" + }, + { + "path": "/home/worsch/railiance-platform/openbao/policies/secrets-engine-login-self.hcl", + "sha256": "d1a2969dd2949c822972e9b32243650567ac123a669f3fc609e9bfea977bb4eb", + "kind": "current-owner-source" + }, + { + "path": "/home/worsch/key-cape/docs/openbao-negative-probe-clients.yaml", + "sha256": "4f38badef723c08871a28a446707e71be1d3cba8b4c3bcedb2759be65e4e3ed5", + "kind": "current-owner-source" + }, + { + "path": "/home/worsch/key-cape/config/service-clients.example.yaml", + "sha256": "b7e17698a0946f387c481b7e27fe9ddea22cdd9db2e34e32a50457e02a34b18e", + "kind": "current-owner-source" + }, + { + "path": "/tmp/jwt-acceptance-stage/key-cape/docs/openbao-negative-probe-session-proposal.md", + "owner_path": "key-cape/docs/openbao-negative-probe-session-proposal.md", + "sha256": "d7b6d9782a2a39df02a36f806836158b75ed2d4a3aafe3db73fff316b551043d", + "kind": "reviewed-staged-revision" + }, + { + "path": "/tmp/jwt-acceptance-stage/key-cape/scripts/openbao_negative_probe.py", + "owner_path": "key-cape/scripts/openbao_negative_probe.py", + "sha256": "bb9610babf44a959342bac700bb5712e97f400b44c4d0659d21df4426e616e19", + "kind": "reviewed-staged-revision" + }, + { + "path": "/tmp/jwt-acceptance-stage/key-cape/scripts/test_openbao_negative_probe.py", + "owner_path": "key-cape/scripts/test_openbao_negative_probe.py", + "sha256": "08d5598357c4db72672b2c4dc21ef09711ac4f9873fb29f8a6949d34afb8d85c", + "kind": "reviewed-staged-revision" + }, + { + "path": "/tmp/jwt-acceptance-stage/key-cape/workplans/KEY-WP-0039-openbao-negative-probe-tokens.md", + "owner_path": "key-cape/workplans/KEY-WP-0039-openbao-negative-probe-tokens.md", + "sha256": "11fe539f914bdb7036236ffc112bc701ebf864d0929b2ee88e2d66ec470d53d4", + "kind": "reviewed-staged-revision" + } + ], + "external_reference": "https://openbao.org/api-docs/2.5.x/auth/jwt/", + "conditions": [ + "Restore complete CCR0038 capabilities deny matrix: guarded KV data+metadata, sys/policies/acl/*, auth/*/role/*, auth/token/create; retain service-session revoke receipt.", + "Capture actual live role/config metadata and raw/effective expiration leeway; source omission alone is not live verification. Abort on different binding/policy/issuer/algorithm or unreviewed registry.", + "Final exact revision, six temporary clients/Secret/envrefs, attended bounded window, net-kingdom owner concurrence and separate founder scopedgo required.", + "Require all eight semantically appropriate negatives, valid expiry acceptance/selfrevoke, preserved nofallback evidence and verified finallycleanup; runner all_refused alone cannot finish owner tasks." + ] +}