id: CCR-2026-0021
kind: credential-change-request
schema_version: 1
request_type: workload-kv-read
title: approval-engine load-bearing audit sender custody and delivery
status: proposed
created: '2026-09-11'
updated: '2026-09-11'
requester:
  agent: codex
  reason: AUDIT-WP-0009-T09 and HFACT-WP-0001-T03 require the existing exact sender declaration. This
    request supplies the missing platform custody and ESO delivery; receiver compatibility and service
    rollout remain explicit gates.
review:
  required: true
  required_approvers:
  - platform-operator
  - audit-core-owner
  - approval-engine-owner
  comments: []
target:
  domain: financials
  tenant: platform
  workload: approval-engine
  environment: production
  purpose: Provide only the approval-engine sender with source=approval-engine, tenants=[tenant:platform],
    may_write=true, may_read=false, evidence_kind=load-bearing, secret_policy=redact. Preserve the
    existing receiver registry and every other sender.
openbao:
  mount: platform
  kv_path: platform/workloads/approval-engine/audit-sender
  fields:
  - AUDIT_TOKEN
  - CUSTODY_REQUEST
  policy_name: workload-kv-read-approval-engine-audit
  policy_file: openbao/policies/workload-kv-read-approval-engine-audit.hcl
  metadata_read: false
  auth:
    method: kubernetes
    mount: kubernetes
    role: external-secrets-approval-engine-audit
    bound_claims:
      service_account_names:
      - external-secrets
      service_account_namespaces:
      - external-secrets
    bound_claims_confirmed: true
    policies:
    - workload-kv-read-approval-engine-audit
    ttl: 15m
access_frontdoor:
  type: external-secrets
  catalog_id: approval-engine-audit
  readiness: pending-review
  resolvable: false
delivery:
  surface: external-secrets
  target: 'ClusterSecretStore openbao-approval-engine-audit restricted to namespace approval-engine;
    ExternalSecret and Secret approval-engine/approval-engine-audit, key audit-token. Source: manifests/factory-audit-senders.yaml.
    A missing namespace stays a workload-owner prerequisite; this packet creates none.'
risk:
  classification: high
  notes:
  - A bearer permits append for its exact sender and tenant, never reading or changing stored evidence.
  - The registry update reads existing sender credentials inside the attended platform process only.
    No registry is delivered to a producer.
  - OpenBao login TTL limits the ESO reader session, not the audit bearer. Revocation must remove
    the sender token from the receiver registry and prove refusal.
  - New paths extend the existing coding-agent deny boundary. No existing high-risk grant is widened.
verification:
  positive:
  - Independent CAS=0 token creation and exact sender merge with registry-version compare-and-set;
    repeated runs preserve both tokens and other registry fields.
  - ESO delivers only AUDIT_TOKEN into approval-engine/approval-engine-audit:audit-token; source and
    receiver copies agree without displaying values.
  - Compatible deployed receiver accepts and deduplicates a declared synthetic event for the exact
    sender and tenant, retaining load-bearing/redact declarations.
  negative:
  - Sibling sender path, full registry and parent listing are denied to each workload reader. Wrong
    service account/namespace and disallowed store namespace fail.
  - Receiver denies sibling source, wrong tenant, every read route and revoked token. No existing
    sender is removed or re-scoped.
  - Proposed or altered CCR, legacy receiver, malformed/duplicate registry identity, token collision,
    stale registry version or partial/conflicting custody refuses without overwriting.
  activation_conditions:
  - All three named owner reviews are approved before any native credential mutation.
  - A current image supporting evidence_kind is published/admitted by audit-core and deployed with
    its source scope and network policy; current c2fe39a image fails compatibility.
  - Use the Warden attended platform-admin login envelope; preserve independent receipt and revoke
    the session on exit.
  - Apply reviewed policy/auth metadata and ESO projection only after receiver compatibility and namespace
    readiness. An interrupted seed resumes from durable KV values, never blindly rotates or deletes.
  - Record native positive/negative evidence before declaring verified or active. Custody alone does
    not admit UI, human approval or factory execution.
lifecycle:
  deactivate: Stop the exact producer; remove only its admitted token from the registry using CAS
    and reload/verify receiver refusal. Then detach its reader policy and remove its ExternalSecret/projection,
    retaining KV versions for investigation. Do not delete audit events or other sender entries.
  rotate: 'Reviewed overlap-first rotation: append a replacement to this sender only, deliver it,
    prove acceptance, then remove the predecessor and prove refusal. The first-provision helper refuses
    rotation and unexpected existing values.'
  compromised: Stop affected producer and revoke the exact receiver token first; inspect affected
    source/tenant events, rotate through a separate reviewed action, and preserve the independent
    audit trail.
state_hub:
  workplan_id: RPF-WP-0035
  task_id: RPF-WP-0035-T08
  related_workplan: AUDIT-WP-0009-T09
  decision_id: 2c9fe9f0-034a-41d7-9d49-b99df488fdc8
  decision_api_url: http://127.0.0.1:8000/decisions/2c9fe9f0-034a-41d7-9d49-b99df488fdc8