{ "id": "CCR-2026-0048", "kind": "credential-change-request", "schema_version": 1, "request_type": "workload-kv-read", "title": "NetKingdom identity backup publisher delivery", "status": "verified", "created": "2026-10-16", "updated": "2026-10-16", "requester": { "agent": "codex", "reason": "Operator requested implementation of missing full identity backup coverage under NK-WP-0049." }, "review": { "required": true, "required_approvers": [ "platform-owner", "net-kingdom-owner", "backup-share-owner" ], "comments": [ { "reviewer": "User (platform-owner)", "decision": "approved", "source_ref": "statehub:decision:5edd5203-fae7-461b-8775-5d22b7873971", "comment": "Operator approved initial live packet and subsequently explicitly approved provider-added folder-only re-sharing (publisher21/retention25). Native admission and independent recovery gates remain.", "reviewed_at": "2026-10-15T23:51:21.372915+00:00" }, { "reviewer": "User (net-kingdom-owner)", "decision": "approved", "source_ref": "statehub:decision:5edd5203-fae7-461b-8775-5d22b7873971", "comment": "Operator approved initial live packet and subsequently explicitly approved provider-added folder-only re-sharing (publisher21/retention25). Native admission and independent recovery gates remain.", "reviewed_at": "2026-10-15T23:51:21.372938+00:00" }, { "reviewer": "User (backup-share-owner)", "decision": "approved", "source_ref": "statehub:decision:5edd5203-fae7-461b-8775-5d22b7873971", "comment": "Operator approved initial live packet and subsequently explicitly approved provider-added folder-only re-sharing (publisher21/retention25). Native admission and independent recovery gates remain.", "reviewed_at": "2026-10-15T23:51:21.372944+00:00" } ] }, "target": { "domain": "infotech", "tenant": "platform", "workload": "net-kingdom-identity-backup", "environment": "production", "purpose": "publisher limited to new encrypted identity bundle folder; no age private key or Backup account password" }, "openbao": { "mount": "platform", "kv_path": "platform/workloads/net-kingdom/identity-backup/publisher", "fields": [ "NC_WEBDAV_TOKEN" ], "policy_name": "net-kingdom-backup-publisher-eso", "policy_file": "openbao/policies/net-kingdom-backup-publisher-eso.hcl", "metadata_read": false, "token_self_lifecycle": true, "auth": { "method": "kubernetes", "mount": "kubernetes", "role": "net-kingdom-backup-publisher-eso", "audience": "openbao", "ttl": "15m", "token_max_ttl": "15m", "token_explicit_max_ttl": "15m", "token_no_default_policy": true, "policies": [ "net-kingdom-backup-publisher-eso" ], "bound_claims": { "service_account_names": [ "net-kingdom-backup-publisher-eso" ], "service_account_namespaces": [ "sso" ] }, "bound_claims_confirmed": true } }, "provider": { "host": "nx4069.your-storageshare.de", "account_owner": "Backup", "folder": "/railiance-backups/net-kingdom-identity", "share_type": 3, "share_permissions": 21, "label": "net-kingdom-identity-publisher", "age_private_key_delivered": false, "backup_account_password_delivered": false, "provider_added_resharing_approved": true, "scope_approval_ref": "statehub:decision:5edd5203-fae7-461b-8775-5d22b7873971" }, "delivery": { "surface": "ESO-managed Secret", "namespace": "sso", "secret": "net-kingdom-backup-publisher", "key": "token", "service_account": "net-kingdom-backup-publisher-eso", "reader": "owner-controlled root backup publisher process on railiance01; no agent credential delivery", "cluster_uid": "a553c742-0115-43d4-99a4-a5ca56fe0786" }, "risk": { "classification": "high", "notes": [ "Secret-bearing capture is limited to the four reviewed identity services; source/cluster/PVC bindings and private staging are mandatory.", "Publisher can read/create in only this folder; retention can read/delete in only this folder. Both also include explicitly owner-approved provider-added re-sharing, but neither grants update, other folders or account administration.", "Compromise of the retention token can destroy backups in this folder; keep it separate from the publisher and retain independent custody/recovery points.", "Node root and ESO administration are inside this credential boundary. Coding agents must be denied the new data/metadata paths.", "KV initial CAS=0 only; preserve existing values and refuse drift. No rotation of service keys, age keys, operator credentials or existing shares.", "Nextcloud adds permission16 to read-enabled public links. User approved exact normalized21/25 on2026-10-16; tokens remain confined to the encrypted backup folder. Original5/9 attempt failed before credential publication." ] }, "verification": { "positive": [ "Exact share path/permissions and bounded KV/ESO role readback", "Ciphertext create/readback/hash and exact runtime token delivery", "Retention protects recovered point/newest/seven daily/two weekly and uses ETag-conditional deletion" ], "negative": [ "Publisher overwrite/delete denied; retention create/overwrite denied", "Sibling namespace/path/audience and KV write/metadata access denied", "Unapproved or changed CCR/source, wrong cluster, resource drift and malformed archive refuse execution" ], "activation_conditions": [ "Explicit platform, NetKingdom and Backup-share owner approval of this exact request and source packet.", "Native exact namespace/ServiceAccount/audience verification and bounded role readback; no coding-agent access.", "First real encrypted capture, off-host readback, independent-key recovery and cleanup before enabling timers.", "Retention protects the independently recovered point and newest backup; no automatic deletion of pre-existing backups." ], "actual_native_receipt": { "repository": "net-kingdom", "path": "docs/evidence/2026-10-16-identity-backup-live/publisher-native-delivery-verified.json", "source_ccr_sha256": "a7d5c356ce0c4df9de439a58ad3d36e1578f27cda327c9387e97cfc2e9dc7cdc", "status": "reader_and_delivery_verified", "kv_version": 1, "wrong_service_account_denied": true, "wrong_namespace_denied": true, "wrong_audience_denied": true, "bounded_policy_ttl": true, "eso_equality_verified": true, "temporary_reader_revoked": true }, "actual_archive_and_runtime_acceptance": { "owner_repo": "net-kingdom", "archive_recovery": "docs/evidence/2026-10-16-identity-backup-live/actual-full-recovery-review.json", "activation": "docs/evidence/2026-10-16-identity-backup-live/activation-review.json", "recurring_job": "docs/evidence/2026-10-16-identity-backup-live/recurring-job-review.json", "independent_owner_retrieval_and_key_recovery_passed": true, "systemd_job_result": "success", "timers_enabled": true, "retention_pinned_and_newest_protected": true, "native_full_service_authentication_claimed": false } }, "state_hub": { "workplan_id": "NK-WP-0049", "task_id": "NK-WP-0049-T03" }, "access_frontdoor": { "type": "platform-owner", "catalog_id": "net-kingdom-identity-backup-publisher", "readiness": "pending-review", "resolvable": false }, "lifecycle": { "deactivate": "Stop the corresponding timer, withdraw only this reader and disable its dedicated share under owner control; retain archives and recovery keys.", "rotate": "Separate owner-approved share replacement and KV CAS rotation, preserved old access until new readback and recovery pass; no silent replacement by this setup tool.", "compromised": "Fence this executor and revoke its dedicated share/reader. Treat retention-token compromise as possible loss of this folder; preserve independent recovery points and rotate only under incident authority." } }