9460f6f200
Assistant: codex Assistant-Model: gpt-6.1-sol Assistant-Session: 01a126e1-76f8-7643-8cf3-e93336539ade
128 lines
5.8 KiB
JSON
128 lines
5.8 KiB
JSON
{
|
|
"schema": "platform-key39-coding-client-custody-proposal/v1",
|
|
"status": "proposed_source_only",
|
|
"formal_owner_agreement": false,
|
|
"native_authorized": false,
|
|
"credential_access_authorized": false,
|
|
"source_pins": [
|
|
{
|
|
"path": "/home/worsch/railiance-platform/AGENTS.md",
|
|
"sha256": "8d2f1a165e3f4eecf2e6e1d6a19c4bac9e8dcb64a76650e7185d55722f233c8b"
|
|
},
|
|
{
|
|
"path": "/home/worsch/railiance-platform/INTENT.md",
|
|
"sha256": "12c6540735af591f7a4a9fe85ff10d3cd00eec55b5b6b1ddf148abf2d3ac9a9c"
|
|
},
|
|
{
|
|
"path": "/home/worsch/railiance-platform/openbao/auth/coding-agent-jwt-role.json",
|
|
"sha256": "c72e836ab72713a49aa8fb84faa26e824ff1263b5a184600fca0c0284720ee3b"
|
|
},
|
|
{
|
|
"path": "/home/worsch/railiance-platform/openbao/policies/agent-high-risk-boundary.hcl",
|
|
"sha256": "ca3f27d8c099011ca44498ba1f50dea3eb6063c4a3bbbf9130e6881dd4e972f5"
|
|
},
|
|
{
|
|
"path": "/home/worsch/railiance-platform/openbao/policies/workload-kv-read-issue-core-runtime.hcl",
|
|
"sha256": "54b9f864f3435910143a860352aac5ecb3aa2cd7afb5e161bb304c12d821c55e"
|
|
},
|
|
{
|
|
"path": "/home/worsch/railiance-platform/docs/platform-tenant-essentials-review.md",
|
|
"sha256": "0b023c7a1bd58b1fac9b7ae746645dcf80fd3e5224c8399447fb90acbaba5c5c"
|
|
},
|
|
{
|
|
"path": "/home/worsch/key-cape/config/service-clients.example.yaml",
|
|
"sha256": "b7e17698a0946f387c481b7e27fe9ddea22cdd9db2e34e32a50457e02a34b18e"
|
|
},
|
|
{
|
|
"path": "/home/worsch/key-cape/src/internal/authclient/cli.go",
|
|
"sha256": "376a8e0d1d60825a8b3ef21d371e3fc353c0a34e461712a6899e264278edbe7f"
|
|
},
|
|
{
|
|
"path": "/home/worsch/key-cape/src/internal/authclient/client.go",
|
|
"sha256": "61fb150349c5d3714450a90834c59af9a579a8a649c4149297a402cfcf6e39c5"
|
|
},
|
|
{
|
|
"path": "/home/worsch/key-cape/docs/proposals/2026-10-11-key39-next-execution-prerequisites.json",
|
|
"sha256": "78288f6991910715b7ee8fdb2a32654418dd9becd5fccd254bab8d150420cfd3"
|
|
},
|
|
{
|
|
"path": "/home/worsch/net-kingdom/sso-mfa/k8s/keycape/deployment.yaml",
|
|
"sha256": "b21c04841245263861273133ac8bde06653deb88be3afef9596ed2fba9db631b"
|
|
},
|
|
{
|
|
"path": "/home/worsch/ops-warden/registry/routing/catalog.yaml",
|
|
"sha256": "09ee40df21b0ad8cad420be4613afcb1731967f68128631a94f9b96f3f31b318"
|
|
}
|
|
],
|
|
"identity": {
|
|
"issuer": "https://kc.coulomb.social",
|
|
"client_id": "codex-railiance-platform",
|
|
"audience": "codex-railiance-platform",
|
|
"subject": "service:codex:railiance-platform",
|
|
"tenant": "tenant:platform",
|
|
"principal_type": "service",
|
|
"roles": [
|
|
"coding-agent"
|
|
],
|
|
"scope": "openbao:login",
|
|
"max_lifetime_seconds": 900,
|
|
"issuer_env_reference": "KEYCAPE_CODEX_RAILIANCE_PLATFORM_CLIENT_SECRET"
|
|
},
|
|
"existing_role": {
|
|
"path": "auth/netkingdom/role/coding-agent",
|
|
"policies": [
|
|
"agent-high-risk-boundary",
|
|
"workload-kv-read-issue-core-runtime"
|
|
],
|
|
"ttl_seconds": 900,
|
|
"max_uses": 8,
|
|
"no_default_policy": true,
|
|
"source_is_not_native_observation": true
|
|
},
|
|
"proposed_coordinates": {
|
|
"binding_status": "new_candidate_not_admitted_or_observed",
|
|
"kv_mount": "platform",
|
|
"kv_path": "workloads/keycape/codex-railiance-platform",
|
|
"field": "CLIENT_SECRET",
|
|
"issuer_namespace": "sso",
|
|
"issuer_secret_name": "keycape-codex-railiance-platform-client",
|
|
"issuer_secret_key": "client-secret",
|
|
"issuer_serviceaccount_candidate": "keycape-codex-client-eso",
|
|
"coding_secret_direct_delivery_to_agent": false,
|
|
"founder_delivery": "separate exact attended one-use private custody-to-service-token invocation; only verified coding JWT JSON participates in reviewed KEY39 paired handoff"
|
|
},
|
|
"source_observations": {
|
|
"deployment_has_named_env_reference": false,
|
|
"exact_named_CCR_grant_catalog_receipt_found_in_bounded_search": false,
|
|
"current_live_client_registration_proven": false,
|
|
"current_custody_version_proven": false,
|
|
"current_issuer_matching_version_proven": false,
|
|
"current_delivery_host_profile_admitted": false,
|
|
"new_CCR_assigned": false
|
|
},
|
|
"missing_admission_gates": [
|
|
"Platform exact CCR/grant/catalogue and approved source revision for named client; no reuse of CCR0040 browser generation",
|
|
"Net issuer registration and exact env Secret reference; live value-free matched-version projection",
|
|
"Net dedicated namespace SecretStore/ExternalSecret serviceaccount, TokenRequest RBAC, issuer controller and Argo readiness ownership",
|
|
"Platform exact founder custody-reader role/capability denial and token budget/cleanup; no standing coding-role read grant",
|
|
"Founder host/process isolation from coding runtime, exact session/cert profile, continuous exclusive tmpfs and private environment/file custody",
|
|
"Key exact verified claim producer including all identity coordinates and finite lifetime; existing CLI alone does not bind subject/tenant/type/roles/max900",
|
|
"Fresh authenticated founder native revision and production maintenance exception when required",
|
|
"Actual node route/role/plugin and all effective leeway observation, negative refusal correlation, known-token revoke and unknown recovery"
|
|
],
|
|
"candidate_value_free_receipt_fields": [
|
|
"source_revision",
|
|
"CCR_id_and_digest",
|
|
"grant_id_and_digest",
|
|
"catalogue_id_and_digest",
|
|
"issuer_client_projection_digest",
|
|
"issuer_Secret_UID_resourceVersion_key_name_only",
|
|
"custody_logical_path_and_version_only",
|
|
"matched_version_attestation_no_value_or_secret_hash",
|
|
"ESO_role_ServiceAccount_namespace_UID_audience_policy_digests",
|
|
"founder_host_profile_process_isolation_attestation",
|
|
"exact_execution_envelope_digest",
|
|
"cleanup_status_and_unknown_effects"
|
|
],
|
|
"standing_doc_correction": "tenant:coulomb -> tenant:platform only; dated historical proof unchanged"
|
|
}
|