id: CCR-2026-0032 kind: credential-change-request schema_version: 1 request_type: workload-kv-read title: Informed Decision create-only requester workload read status: applied created: '2026-10-04' updated: '2026-10-04' requester: agent: informed-decision reason: INFD-WP-0005-T05 request cd811073; prepare workload delivery of existing requester custody review: required: true required_approvers: - platform-owner - informed-decision-owner comments: - at: '2026-10-04' reviewer: Bernd Worsch decision: design_boundary_approved comment: Founder answered "I approve" to the prepared requester-delivery design for owner integration. Approves the exact existing-path reader, dedicated ESO identity, informed-decision namespace boundary, 15-minute reader tokens and read-only credential projection; namespace writer exposure and persistence beyond reader-token lifetime were disclosed. Owner runtime/binding acceptance and separate live deployment go remain; status stays proposed until those gates are satisfied. This does not resolve the broader intake rollout decision. - at: '2026-10-04T21:01:27+00:00' reviewer: codex decision: binding_confirmed comment: Owner source review confirmed exact intended Kubernetes binding informed-decision/informed-decision-eso and audience openbao; runtime source accepted in informed-decision c084600, immutable service 2768bd1 and dispatcher 410fb6b. Existing namespace and ESO controller account verified live; prior explicit SubjectAccessReview permits TokenRequest. Dedicated account deployment and native auth positive/negative receipts remain pending; this confirms the reviewed binding configuration, not a completed native login. - at: '2026-10-04T21:01:27+00:00' reviewer: Bernd Worsch decision: approved comment: 'Founder answered I approve to the concrete requester-delivery approval request after review of the release packet: dedicated ESO identity, existing exact requester path, 15-minute reader tokens and read-only projection into informed-decision. This is the separate live delivery go following prior design approval. Attended OpenBao OIDC/MFA and native verification remain required; broader lifecycle cutover and separate issuer rotation are not approved by this record.' - at: '2026-10-04T21:21:12.702154+00:00' reviewer: codex decision: amendment_proposed comment: Prior approved metadata was applied and verified by attended helper exit 0. ArgoCD delivered the three objects, but native ESO validation receives 403 at auth/token/lookup-self. Propose adding only lookup-self read and revoke-self update, as required by existing ESO reader pattern. Exact KV path, bound identity, audience, TTL and no-default-policy remain unchanged. This amendment requires founder approval and attended administration; prior approval is retained in history. - at: '2026-10-04T21:24:05+00:00' reviewer: Bernd Worsch decision: approved comment: 'Founder explicitly approved the two self-token permissions in this session: auth/token/lookup-self read and auth/token/revoke-self update. Authorizes exact-predecessor amendment of the already applied reader policy through fresh attended OpenBao login. Exact credential path, bound account/namespace/audience, 900-second limits, no-default-policy and create-only requester scopes remain unchanged.' - at: '2026-10-04T21:48:43.216200+00:00' reviewer: codex decision: native_delivery_proven comment: Founder attended amendment exited 0 with metadata_verified receipt. ArgoCD delivery is Synced; store Valid and ExternalSecret SecretSynced. Candidate image 804d89fb proved exact reader policy/TTL, wrong SA/namespace/audience and sibling/LIST denials, mounted file equality/mode, signed create-only exchange and excess-scope denials. Reader revoked and post-revoke lookup denied; temporary proofs removed. Verification workload only; production service mount/cutover acceptance remains pending. No issuer rotation performed. target: domain: financials tenant: platform workload: informed-decision environment: production purpose: Deliver existing create-only requester client to the review pod through namespace-restricted ESO openbao: mount: platform kv_path: platform/workloads/informed-decision/sitting-requester fields: - CLIENT_SECRET policy_name: workload-kv-read-informed-decision-sitting-requester-eso policy_file: openbao/policies/workload-kv-read-informed-decision-sitting-requester-eso.hcl metadata_read: false auth: method: kubernetes mount: kubernetes role: informed-decision-sitting-requester-eso audience: openbao ttl: 15m token_max_ttl: 15m token_explicit_max_ttl: 15m token_no_default_policy: true policies: - workload-kv-read-informed-decision-sitting-requester-eso bound_claims: service_account_names: - informed-decision-eso service_account_namespaces: - informed-decision bound_claims_confirmed: true token_self_lifecycle: true access_frontdoor: type: external-secrets catalog_id: informed-decision-sitting-requester-eso readiness: pending-review resolvable: false risk: classification: high notes: - The whole KV path is readable; the existing CLIENT_SECRET permits approval:create for subject informed-decision - Any ExternalSecret in the informed-decision namespace can reference this store; no other namespace is admitted - No approval:approve, approval:consume, sibling read, metadata listing or new client is granted verification: positive: - Owner-reviewed native exact identity and exact path proof required negative: - Owner-reviewed wrong identity, sibling GET and parent LIST denials required activation_conditions: - Exact CCR approval, confirmed identity, attended custody and native receipt acceptance required lifecycle: deactivate: Owner-reviewed delivery withdrawal and token revocation; exact rollback receipt required rotate: Separate version-guarded owner approval and contained value delivery required compromised: Owner incident process; no automatic read, reseed or cleanup scaffold: draft_only: true consumer_repo: informed-decision owner_repo: railiance-platform request_sha256: 83181c92b80d708246147d6ee06dafdab880ce88f4203dfc7499970aa52e312f catalog_request_sha256: null delivery: surface: external-secrets target: informed-decision/informed-decision-sitting-requester key client-secret; read-only projection into review pod review_bundle: docs/provisioning-windows/2026-10-04-1000/informed-decision metadata_child: scripts/informed_decision_requester_metadata.py state_hub: workplan_id: RPF-WP-0051 task_id: RPF-WP-0051-T03 related_workplan: INFD-WP-0005 decision_api_url: http://127.0.0.1:8000/decisions/0d6792b6-59e4-4fa0-887a-c4e51ea8e131