id: CCR-2026-0039
kind: credential-change-request
schema_version: 1
request_type: workload-kv-operator-matrix
title: fluid-telegram hall-of-helix attended operator KV lane (per-path matrix, OIDC
  aal2)
status: applied
created: '2026-10-09'
updated: '2026-10-09'
requester:
  agent: railiance-platform
  reason: RPF-WP-0035-T03. Founder approved ops-mason plan fluid-telegram-operator-credential-lane
    2026-10-09 (approved_spec_sha256 41a0ca2746aa93b6ee9d1ca631517d680ade95c56e7a38b75a55209ef2316b73)
    and ruled the tenant segment stays coulomb (ops-mason message b72ff77d). Design
    docs/credential-lane-designs/fluid-telegram-operator-kv.md; key-cape confirmed
    groups and aal2 claims (message b2ed890f, key-cape e0b5fae).
review:
  required: true
  required_approvers:
  - platform-owner
  - fluid-telegram-owner
  - key-cape-owner
  comments:
  - at: '2026-10-09T10:29:55+00:00'
    reviewer: platform-owner, fluid-telegram-owner, key-cape-owner (founder Bernd
      Worsch)
    decision: approved
    comment: 'Approve ops-mason plan fluid-telegram-operator-credential-lane (spec
      41a0ca27): four-entry matrix at coulomb/fluid-telegram/hall-of-helix, OIDC role
      on netkingdom, agent denies.'
  - at: '2026-10-09T10:29:55+00:00'
    reviewer: founder
    decision: binding_confirmed
    comment: groups=[fluid-telegram-operators] (LLDAP, member tegwick) and /assurance/level=aal2
      match key-cape b2ed890f.
target:
  domain: infotech
  tenant: coulomb
  workload: fluid-telegram
  environment: production
  purpose: Let a member of fluid-telegram-operators with a verified second factor
    run the attended provisioner for campaign hall-of-helix with exactly the four-entry
    matrix.
openbao:
  mount: platform
  campaign_path: platform/workloads/coulomb/fluid-telegram/hall-of-helix
  policy_name: workload-kv-fluid-telegram-hall-of-helix-operator
  policy_file: openbao/policies/workload-kv-fluid-telegram-hall-of-helix-operator.hcl
  boundary_overlay_file: openbao/fluid-telegram/agent-deny-overlay.hcl
  matrix:
  - entry: operator-app
    fields:
    - api_id
    - api_hash
    capabilities:
    - read
  - entry: operator-session
    fields:
    - session_b64
    capabilities:
    - create
    - read
    - update
  - entry: bot-token
    fields:
    - token
    capabilities:
    - create
    - read
    - update
  - entry: redaction-salt
    fields:
    - salt
    capabilities:
    - create
    - read
  auth:
    method: oidc
    mount: netkingdom
    role: fluid-telegram-hall-of-helix-workload-kv
    role_file: openbao/auth/fluid-telegram-hall-of-helix-oidc-role.json
    bound_claims_confirmed: true
founder_confirmation_items:
- bound_claims_confirmed stays false until the founder confirms groups=[fluid-telegram-operators]
  (LLDAP group, single member tegwick) and /assurance/level=aal2 against the key-cape
  confirmation b2ed890f. applier-dry-run refuses until then.
- The matrix grants no metadata, list, patch or delete. The salt is create-only by
  ACL; first-write CAS 0 is the consumer's job (FT-WP-0002) and is verified by an
  owner-run probe, not by ACL parameters.
- The apply appends exact coding-agent denies on all four data and metadata paths
  to the live agent-high-risk-boundary policy, preserving its other content verbatim,
  and refuses if only some of those denies are already present.
access_frontdoor:
  type: none
  catalog_id: none
risk:
  level: high
  notes:
  - operator-session is a full Telegram account session. Membership of fluid-telegram-operators
    is the whole access decision; adding a member widens this lane's reach.
  - Tokens are 15m (30m maximum), no default policy, num_uses 0 so MTProto session
    persistence is not interrupted; the provisioner self-revokes at completion.
verification:
  positive:
  - Readback after apply matches source for boundary denies, policy text and role
    (done by applier-apply; prints nothing).
  - An approved member's token reports exactly the matrix capabilities on each entry.
  negative:
  - Parent, sibling workload and sibling campaign paths report deny.
  - A non-member, or a member without aal2, cannot obtain the role.
  - Coding-agent identities report deny on all four data and metadata paths.
  - Owner-run disposable probe: salt create succeeds, a second write is denied.
  activation_conditions:
  - Founder approval (three reviews) and bound_claims_confirmed true.
  - Custody moved from the infotech prefix with scripts/fluid_telegram_custody_move.py.
  evidence:
  - at: '2026-10-09T10:30:01+00:00'
    actor: founder
    kind: delegated_metadata_apply
    result: passed
    details:
    - Delegated metadata applier ran as founder using local bao CLI ambient authority.
    - 'Agent boundary denies ensured: sys/policies/acl/agent-high-risk-boundary (8
      exact paths)'
    - 'Policy metadata write: sys/policies/acl/workload-kv-fluid-telegram-hall-of-helix-operator'
    - 'OIDC role metadata write: auth/netkingdom/role/fluid-telegram-hall-of-helix-workload-kv'
    - Readback matched source for boundary denies, policy and role.
    - No secret values were read, written, printed, or accepted in argv.
lifecycle:
  deactivate: Delete auth/netkingdom/role/fluid-telegram-hall-of-helix-workload-kv
    first, then the policy; KV entries stay in custody pending an explicit retention
    decision.
  rotate: Session compromise needs Telegram-side session revocation; bot-token rotation
    needs provider replacement; salt rotation needs a data-owner decision.
  compromised: Delete the role, revoke issued tokens, revoke the Telegram session.
state_hub:
  workplan: RPF-WP-0035
  task: RPF-WP-0035-T03