id: CCR-2026-0047
kind: credential-change-request
schema_version: 1
request_type: workload-kv-read
title: rapp-qonto collector exact audit sender custody and delivery
status: applied
created: '2026-10-15'
updated: '2026-10-15'
requester:
  agent: codex
  reason: NK-WP-0035 operational receiver admission requires actual Qonto delivery. This proposed new
    grant requires explicit owner approval of the concrete packet; prior timing rollout approval does
    not approve it.
review:
  required: true
  required_approvers:
  - platform-operator
  - audit-core-owner
  - rapp-qonto-owner
  - qonto-assistant-owner
  comments:
  - at: '2026-10-15T19:27:15.042944+00:00'
    reviewer: user explicit session approval (platform-operator, audit-core-owner, rapp-qonto-owner,
      qonto-assistant-owner)
    decision: approved
    comment: User selected "Approve packet and proceed" for the complete exact packet including CCR-2026-0047
      new bearer/ESO lane, compatible source/receiver upgrades and migrations, exact registry admission,
      collector and one-hour observation. This approval applies to reviewed exact scopes; prerequisites,
      attended custody and independent receipts remain required.
target:
  domain: financials
  tenant: friendly:binky
  workload: rapp-qonto
  environment: production
  purpose: Sender rapp-qonto-collector, sole source qonto-assistant, sole tenant tenant:friendly:binky,
    may_write=true, may_read=false, secret_policy=redact. Envelope admission load-bearing; preserve
    the source declaration per-class distinction. One source heartbeat maps to audit-core.heartbeat
    covering only audit.deny. Wait 2f=7200s, effective deadline3f=10800s. No bank calls or authority
    changes.
openbao:
  mount: platform
  kv_path: platform/workloads/rapp-qonto/audit-sender
  fields:
  - AUDIT_TOKEN
  - CUSTODY_REQUEST
  policy_name: workload-kv-read-rapp-qonto-audit
  policy_file: openbao/policies/workload-kv-read-rapp-qonto-audit.hcl
  metadata_read: false
  auth:
    method: kubernetes
    mount: kubernetes
    role: external-secrets-rapp-qonto-audit
    bound_claims:
      service_account_names:
      - external-secrets
      service_account_namespaces:
      - external-secrets
    bound_claims_confirmed: true
    policies:
    - workload-kv-read-rapp-qonto-audit
    ttl: 15m
access_frontdoor:
  type: external-secrets
  catalog_id: rapp-qonto-audit
  readiness: pending-review
  resolvable: false
delivery:
  surface: external-secrets
  target: ClusterSecretStore openbao-rapp-qonto-audit restricted to namespace rapp-qonto; ExternalSecret
    and Secret rapp-qonto/rapp-qonto-audit-sender key bearer. Source manifests/rapp-qonto-audit-sender.yaml.
    No namespace is created.
risk:
  classification: high
  notes:
  - A bearer permits append only for exact collector sender/source/tenant. Own-source reconciliation
    is available as receiver contract, cross-source and other read routes remain refused.
  - The registry update reads existing sender credentials inside the attended platform process only.
    No registry is delivered to a producer.
  - OpenBao login TTL limits the ESO reader session, not the audit bearer. Revocation must remove the
    sender token from the receiver registry and prove refusal.
  - New paths extend the existing coding-agent deny boundary. No existing high-risk grant is widened.
verification:
  positive:
  - CAS=0 first provision; durable provenance-bound version1 resume without rotation; exact sender registry
    CAS merge preserves all existing credentials/senders/other fields.
  - ESO copies only AUDIT_TOKEN to the named bearer key, exact source/delivery readback, receiver registry
    delivery and compatible reload.
  - Actual capture, periodic real elapsed frame, per-instance reconciliation and independent observer
    acceptance remain required after provisioning.
  negative:
  - Proposed or missing owner approval refuses before native calls; drifted custody, sender or source
    hashes refuse.
  - Reader cannot read registry, sibling custody, metadata or parent listing; wrong service account/namespace
    refused; coding-agent boundary deny wins.
  - Wrong sender source/tenant and non-own-source read routes refused. Audit bearer revocation is separate
    from reader-session revoke.
  activation_conditions:
  - Explicit approval of this complete concrete packet from platform-operator, audit-core-owner, rapp-qonto-owner
    and qonto-assistant-owner.
  - Compatible immutable receiver release with cadence parser and per-instance reconciliation is deployed/ready
    before credential reads.
  - Use attended Warden platform-admin --exec envelope, no shell-exported credentials; keep nonsecret
    independent receipt and self-revoke.
  - Apply only reviewed exact policy/role/projection; retain custody on failure and resume explicitly;
    no destructive rollback or blind rotation.
  - No claim of operational completion until native positive/negative and independent observer receipts.
  evidence:
  - at: '2026-10-15T19:40:23.546597+00:00'
    actor: codex via attended user platform-admin (root execution)
    kind: cadence_receiver_custody_and_native_sender
    result: passed
    details:
    - "Native custody receipt receiver-custody-live.json: protected registry CAS15\u219216, version1\
      \ new sender custody, Approval credentials and all other senders preserved; exact readers/negative\
      \ checks/revocation, ESO values and loaded receiver registry matched."
    - Independent attended wrapper exit0/session self-revocation confirmed by root; initial rejected
      OPENBAO_TOKEN-ambient attempt made no credential mutation and session self-revocation was confirmed.
      Retry launch removed all three token aliases before OIDC.
    - 'Native collector source/tenant admission: heartbeat1 and deny1 reconciled for one exact instance;
      duplicate200, wrong-source400, wrong-tenant400, archive-read403, invalid-bearer401; pending0.
      Original202 receipts persisted across actual collector pod restart.'
    - Source receipts copied unchanged to docs/evidence/2026-10-15-cadence-receiver/. Status applied
      only; elapsed-hour periodic observation, independent protected observer readback and complete
      native matrix remain pending.
lifecycle:
  deactivate: Stop only collector; remove only its bearer from receiver via CAS and prove refusal; detach
    exact reader role and ESO projection; retain custody versions and evidence.
  rotate: Separate reviewed overlap-first change; this helper only provisions version1 and resumes without
    rotation.
  compromised: Stop collector and revoke its exact receiver bearer first; preserve evidence and perform
    separate reviewed rotation.
state_hub:
  related_workplan: NK-WP-0035