c924ff2279
- CCR-2026-0040/0043 re-applied 2026-10-10T09:15Z. Probe: generated v1, a second run refused (already_present), tokens revoked, no value read, probe entry deleted. Receipts in docs/evidence. - CCR-2026-0038: login proof passed (secrets-engine a963a77); the consumer contract is published at docs/contracts/secrets-engine-openbao-jwt-login.yaml. RPF-WP-0035-T02 still waits on the negative claim checks. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 469992@bnt-lap001 Assistant-Session: e4b8e420-df0a-441d-83ae-7f19130594d9
105 lines
4.7 KiB
YAML
105 lines
4.7 KiB
YAML
id: CCR-2026-0040
|
|
kind: credential-change-request
|
|
schema_version: 1
|
|
request_type: custody-generate-grant
|
|
title: Broker grant keycape/client-secret-generate (create-only, generate in custody)
|
|
status: applied
|
|
created: '2026-10-09'
|
|
updated: '2026-10-10'
|
|
requester:
|
|
agent: railiance-platform
|
|
reason: RPF-WP-0054-T04. net-kingdom SecurityCaseType oidc-browser-relying-party
|
|
step mint-secret (lane keycape-client-secret-generate); ops-warden d9f889b1, ops-mason
|
|
789feb39. Founder chose the templated create-only grant 2026-10-09 (T02 option
|
|
A).
|
|
review:
|
|
required: true
|
|
required_approvers:
|
|
- platform-owner
|
|
- key-cape-owner
|
|
comments:
|
|
- at: '2026-10-09T17:18:53+00:00'
|
|
reviewer: platform-owner, key-cape-owner (founder Bernd Worsch)
|
|
decision: approved
|
|
comment: Approve create-only broker grant keycape/client-secret-generate (RPF-WP-0054-T02
|
|
option A).
|
|
target:
|
|
domain: infotech
|
|
tenant: platform
|
|
workload: keycape
|
|
environment: production
|
|
purpose: Let the credential broker create a new KeyCape confidential-client secret
|
|
at platform/workloads/keycape/<client_id> once, without any value leaving custody.
|
|
openbao:
|
|
grant_id: keycape/client-secret-generate
|
|
kv_prefix: platform/workloads/keycape
|
|
reserved_entries:
|
|
- secrets-engine-openbao
|
|
policy_name: keycape-client-secret-generate
|
|
policy_file: openbao/policies/keycape-client-secret-generate.hcl
|
|
issuer_policy: credential-broker-keycape-client-secret-generate-issuer
|
|
issuer_policy_file: openbao/policies/credential-broker-keycape-client-secret-generate-issuer.hcl
|
|
token_role: keycape-client-secret-generate
|
|
token_ttl: 5m
|
|
founder_confirmation_items:
|
|
- This apply writes two policies and one token role. It binds the issuer policy to
|
|
no identity, so nothing can mint the token until a separate review binds it to the
|
|
caller named in RPF-WP-0054-T01.
|
|
- Create-only on keycape/+ means a token can create a new client entry once and can
|
|
never change an existing one. Its widest misuse is an unused entry for a client
|
|
that does not exist.
|
|
access_frontdoor:
|
|
type: none
|
|
catalog_id: none
|
|
risk:
|
|
level: medium
|
|
notes:
|
|
- No data read, no update, no metadata write, no list, no delete. Exact denies on
|
|
reserved entries take precedence over the + glob.
|
|
- The token lives at most 5m and only inside the broker process.
|
|
verification:
|
|
positive:
|
|
- Readback after apply matches source for both policies and the token role (done
|
|
by applier-apply; prints nothing).
|
|
- Disposable probe (T05) creates probe-secret-generate-<date> at version 1.
|
|
negative:
|
|
- A second create on the probe path, a data read, update, delete and any path outside
|
|
keycape/ are denied for the grant token (sys/capabilities-self).
|
|
- The reserved entry keycape/secrets-engine-openbao reports deny on data and metadata.
|
|
activation_conditions:
|
|
- Founder approval (two reviews).
|
|
- Issuer binding reviewed after RPF-WP-0054-T01; probe passed (T05).
|
|
evidence:
|
|
- at: '2026-10-09T17:19:06+00:00'
|
|
actor: founder
|
|
kind: delegated_metadata_apply
|
|
result: passed
|
|
details:
|
|
- Delegated metadata applier ran as founder using local bao CLI ambient authority.
|
|
- 'Policy metadata write: sys/policies/acl/keycape-client-secret-generate'
|
|
- 'Issuer policy metadata write: sys/policies/acl/credential-broker-keycape-client-secret-generate-issuer'
|
|
- 'Token role metadata write: auth/token/roles/keycape-client-secret-generate'
|
|
- Readback matched source for both policies and the token role.
|
|
- Issuer policy is not bound to any identity by this apply.
|
|
- No secret values were read, written, printed, or accepted in argv.
|
|
- at: '2026-10-10T09:15:46+00:00'
|
|
actor: founder
|
|
kind: delegated_metadata_apply
|
|
result: passed
|
|
details:
|
|
- Delegated metadata applier ran as founder using local bao CLI ambient authority.
|
|
- 'Policy metadata write: sys/policies/acl/keycape-client-secret-generate'
|
|
- 'Issuer policy metadata write: sys/policies/acl/credential-broker-keycape-client-secret-generate-issuer'
|
|
- 'Token role metadata write: auth/token/roles/keycape-client-secret-generate'
|
|
- Readback matched source for both policies and the token role.
|
|
- Issuer policy is not bound to any identity by this apply.
|
|
- No secret values were read, written, printed, or accepted in argv.
|
|
lifecycle:
|
|
deactivate: Delete auth/token/roles/keycape-client-secret-generate, then both policies;
|
|
generated entries stay in custody with their cases.
|
|
rotate: Not applicable; rotation is a separate lane (RPF-WP-0054-T07).
|
|
compromised: Delete the token role and revoke outstanding tokens by accessor; review
|
|
metadata for entries without an accepted case.
|
|
state_hub:
|
|
workplan: RPF-WP-0054
|
|
task: RPF-WP-0054-T04
|