id: CCR-2026-0033 kind: credential-change-request schema_version: 1 request_type: workload-kv-read title: KeyCape secrets-engine-openbao issuer workload reader and authoritative custody status: applied created: '2026-10-04' updated: '2026-10-07' requester: agent: key-cape reason: 'KEY-WP-0037-T02 owner packet; issuer-side read of the authoritative secrets-engine-openbao client secret. Revised 2026-10-06 per founder direction (the secret lives only in OpenBao) and ops-mason plan keycape-secrets-engine-openbao-client-custody (658cdbc, MASON-WP-0009): consumer file and secrets-engine D1-D4 removed.' review: required: true required_approvers: - platform-owner - key-cape-owner - net-kingdom-owner comments: - at: '2026-10-07' reviewer: platform-owner (founder Bernd Worsch) decision: approved comment: Founder decision 2ab717e1-7881-491e-aed4-28946550c289 (resolved 2026-10-06) approves CCR-2026-0033 as platform-owner. Covers A1 (ops-mason design 658cdbc), A2 (this CCR and CCR-2026-0034 at 4a284f0, bound claims of both readers confirmed) and A3 (exactly one attended custody-child provision run, cas=0, KV version 1). Does not approve the policy/role/ESO apply, the NetKingdom env patch, the KeyCape registration, the restart or any rotation. - at: '2026-10-07' reviewer: key-cape-owner (founder Bernd Worsch) decision: approved comment: Founder decision 2ab717e1-7881-491e-aed4-28946550c289 (resolved 2026-10-06) approves CCR-2026-0033 as key-cape-owner. Covers A1 (ops-mason design 658cdbc), A2 (this CCR and CCR-2026-0034 at 4a284f0, bound claims of both readers confirmed) and A3 (exactly one attended custody-child provision run, cas=0, KV version 1). Does not approve the policy/role/ESO apply, the NetKingdom env patch, the KeyCape registration, the restart or any rotation. - at: '2026-10-07' reviewer: net-kingdom-owner (founder Bernd Worsch) decision: approved comment: Founder decision 2ab717e1-7881-491e-aed4-28946550c289 (resolved 2026-10-06) approves CCR-2026-0033 as net-kingdom-owner. Covers A1 (ops-mason design 658cdbc), A2 (this CCR and CCR-2026-0034 at 4a284f0, bound claims of both readers confirmed) and A3 (exactly one attended custody-child provision run, cas=0, KV version 1). Does not approve the policy/role/ESO apply, the NetKingdom env patch, the KeyCape registration, the restart or any rotation. - at: '2026-10-07' reviewer: platform-owner, key-cape-owner, net-kingdom-owner (founder Bernd Worsch) decision: approved comment: Founder decision 1fdd993b-8899-4f87-8a8e-636346bb9692 approves the token_self_lifecycle amendment (lookup-self and revoke-self on the ESO reader's own token) and one delegated re-apply of this CCR's policy and role. Nothing else changes. target: domain: infotech tenant: platform workload: keycape environment: production purpose: Hold the secrets-engine-openbao client secret authoritatively in platform KV and deliver it to the KeyCape issuer through sso-only ESO openbao: mount: platform kv_path: platform/workloads/keycape/secrets-engine-openbao fields: - CLIENT_SECRET policy_name: workload-kv-read-keycape-secrets-engine-openbao-eso policy_file: openbao/policies/workload-kv-read-keycape-secrets-engine-openbao-eso.hcl metadata_read: false token_self_lifecycle: true auth: method: kubernetes mount: kubernetes role: external-secrets-keycape-secrets-engine-openbao audience: openbao ttl: 15m token_max_ttl: 15m token_explicit_max_ttl: 15m token_no_default_policy: true policies: - workload-kv-read-keycape-secrets-engine-openbao-eso bound_claims: service_account_names: - external-secrets service_account_namespaces: - external-secrets bound_claims_confirmed: true kv_metadata: cas_required: true max_versions: 2 delete_version_after: 0s custom_metadata: owner: railiance-platform client_id: secrets-engine-openbao issuer: keycape readers: eso-sso-issuer,oidc-secrets-engine-operator ccr: CCR-2026-0033 plan: ops-mason/keycape-secrets-engine-openbao-client-custody classification: high rotation: event-driven+90d access_frontdoor: type: external-secrets catalog_id: keycape-secrets-engine-openbao-eso readiness: pending-review resolvable: false risk: classification: high notes: - Reads the whole path holding the secrets-engine-openbao confidential value - Only ExternalSecrets in namespace sso may use the store; sso namespace writers are within this boundary - 'One value, two copies: KV (authoritative) and the sso Secret (issuer delivery). The consumer holds no copy at rest; it reads in memory through CCR-2026-0034.' - 'Must stay on kubernetes auth: a KeyCape-issued identity would make KeyCape startup depend on KeyCape.' verification: positive: - Owner-reviewed native exact identity and exact path proof required negative: - Owner-reviewed wrong identity, sibling GET and parent LIST denials required - Metadata shows cas_required=true, max_versions=2 and the declared custom_metadata (value-free). activation_conditions: - Exact CCR approval, confirmed identity, attended custody and native receipt acceptance required evidence: - at: '2026-10-07T00:03:08+00:00' actor: founder kind: delegated_metadata_apply result: passed details: - Delegated metadata applier ran as founder using local bao CLI ambient authority. - 'Policy metadata write: sys/policies/acl/workload-kv-read-keycape-secrets-engine-openbao-eso' - 'Auth role metadata write: auth/kubernetes/role/external-secrets-keycape-secrets-engine-openbao' - No secret values were read, written, printed, or accepted in argv. - at: '2026-10-07T00:10:09+00:00' actor: founder kind: delegated_metadata_apply result: passed details: - Delegated metadata applier ran as founder using local bao CLI ambient authority. - 'Policy metadata write: sys/policies/acl/workload-kv-read-keycape-secrets-engine-openbao-eso' - 'Auth role metadata write: auth/kubernetes/role/external-secrets-keycape-secrets-engine-openbao' - No secret values were read, written, printed, or accepted in argv. lifecycle: deactivate: Owner-reviewed delivery withdrawal and token revocation; exact rollback receipt required rotate: 'Roll-forward only: custody child writes a new version with cas= under a standing rotation approval for this CCR (event-driven + 90d); never a read or restore of an old version' compromised: Owner incident process; no automatic read, reseed or cleanup scaffold: draft_only: true consumer_repo: key-cape owner_repo: railiance-platform request_sha256: ade2e10b0f65341051b955900c68931bdd56fd3a81bf452ae81229cc2390ad63 catalog_request_sha256: null state_hub: workplan_id: RPF-WP-0035 task_id: RPF-WP-0035-T02 related_workplan: KEY-WP-0037 delivery: surface: external-secrets target: sso/keycape-secrets-engine-openbao-client key client-secret; issuer-side delivery only review_bundle: docs/provisioning-windows/2026-10-04-1000/keycape consumer_delivery: none at rest; attended operator OIDC reader CCR-2026-0034 reads into secrets-engine process memory per command boundary_decision: id: 632a8893-0d6a-4591-a50b-40bbdb798f32 approves: custody boundary only (platform authoritative KV and least-privilege issuer delivery; secrets-engine-owned mode-0600 consumer file outside every worktree) does_not_approve: generation, KV write, fetch, delivery, registration or deployment note: 'The design narrows this boundary: the secrets-engine consumer file it approved is withdrawn (founder direction 2026-10-06).' path_correction: 'Candidate path platform/services/keycape/secrets-engine-openbao from the KeyCape packet is outside the platform-mount applier scope (WARDEN-WP-0028: platform/workloads/ only). Corrected to platform/workloads/keycape/secrets-engine-openbao, same field CLIENT_SECRET. The issuer binds to the sso Secret; the operator reader (CCR-2026-0034) reads the exact data path.' custody_child: script: scripts/keycape_secrets_engine_openbao_custody.py tests: tests/test_keycape_secrets_engine_openbao_custody.py status: source-only; never executed requires: - --approval-decision ; refused when absent, malformed, equal to the boundary decision, or not recorded in an approved review comment of this CCR - this CCR and sibling CCR-2026-0034 approved with platform-owner, key-cape-owner and net-kingdom-owner approvals and bound_claims_confirmed true - attended warden platform-admin envelope; no BAO_TOKEN/VAULT_TOKEN in environment - umask 077, shell tracing off - --rotate for any run after the first (cas=); without it an existing entry is refused generation: one secrets.token_urlsafe(48) value in process memory (64 chars); never in argv, environment, stdout, stderr, logs, Git or the hub authoritative_write: KV-v2 write with options.cas=0 (absent) or cas= (rotation, --rotate); value only in process memory and the bao stdin/HTTP body; metadata-only preflight receipt: O_EXCL 0600 JSON with booleans, KV version, request id, CAS, metadata applied/unchanged, CCR/decision ids and CCR digest only failure_cleanup: nothing to clean locally; a written KV version is retained and recorded; recovery is a fresh roll-forward run with --rotate (cas=), never a KV read metadata_write: kv metadata put of openbao.kv_metadata, compared before write against a metadata-only read; skipped when equal rotation_revocation: generation_and_authoritative_version: railiance-platform custody child, version-guarded, roll-forward issuer_pickup: 'key-cape / net-kingdom: ESO refresh then KeyCape restart immediately (exchanges fail closed 401 between KV write and restart)' consumer_pickup: 'automatic: the next secrets-engine command reads the latest version in memory (CCR-2026-0034)' disable_on_compromise: key-cape / net-kingdom remove registration first; platform rotates and detaches the CCR-2026-0034 role policy retire_versions: railiance-platform per separate destroy approval live_order: - 0 founder approvals A1 design, A2 this CCR + CCR-2026-0034 (three reviews, bound claims confirmed for both readers), A3 custody-child decision id - 1 attended custody child (this repo) writes KV v1 and metadata; non-secret receipt - 2 platform applies policies/roles (this CCR and CCR-2026-0034) and the sso-only ClusterSecretStore + ExternalSecret; Secret sso/keycape-secrets-engine-openbao-client exists (metadata receipt only) - 3 net-kingdom env patch secrets-engine-openbao-client.proposed.patch.yaml (NK-WP-0046) - 4 KeyCape registration merge (KEY-WP-0037-T03) - 5 KeyCape restart immediately after step 4 - 6 KeyCape live issuance check (KEY-WP-0037-T04) - 7 platform OpenBao JWT role/policy secrets-engine-openbao and login proof (RPF-WP-0035-T02) rollback: before_step_3: delete the CCR-2026-0034 OIDC role, then its policy; delete ExternalSecret (uid precondition), then the ESO role/policy; KV entry retained pending separate destroy approval after_step_3: net-kingdom rollout helper restores prior config/Deployment first, then the before_step_3 sequence cleanup_receipts: native, value-free, per step owner; a failed cleanup is recorded as open evidence founder_confirmation_items: - 'bound_claims_confirmed stays false until the founder confirms BOTH readers: this CCR (kubernetes, external-secrets/external-secrets, audience openbao) and sibling CCR-2026-0034 (OIDC, groups=net-kingdom-admins and /assurance/level=aal2).' - 'Approvals: A1 ops-mason design; A2 this CCR plus CCR-2026-0034 with platform-owner, key-cape-owner and net-kingdom-owner reviews; A3 the exact custody-child decision id (must differ from boundary decision 632a8893-0d6a-4591-a50b-40bbdb798f32).' runbook: docs/provisioning-windows/2026-10-04-1000/keycape/founder-runbook.md related: sibling_ccr: CCR-2026-0034 design: ops-mason plans/keycape-secrets-engine-openbao-client-custody.md (658cdbc)