tegwick
b51e91cc6f
Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a10780-6d41-7952-9718-dfbc1f41236f
192 lines
10 KiB
Markdown
192 lines
10 KiB
Markdown
---
|
|
id: RPF-WP-0051
|
|
type: workplan
|
|
title: "Prepare and admit informed-decision requester workload delivery"
|
|
domain: financials
|
|
repo: railiance-platform
|
|
status: finished
|
|
owner: codex
|
|
topic_slug: platform-services
|
|
created: "2026-10-04"
|
|
updated: "2026-10-05"
|
|
flavor: implementation
|
|
origin: routed
|
|
origin_ref: "RPF-WP-0050-T03; INFD-WP-0005-T05; cd811073-d6db-41cf-8a57-10df0b360eab"
|
|
state_hub_workstream_id: "a27c47bc-4b0d-513b-bfb2-1eb404fde5a9"
|
|
---
|
|
|
|
The founder selected existing batched attended custody and delegated relevance
|
|
selection for the 2026-10-04 10:00 Europe/Berlin preparation window, then directed
|
|
platform to continue. This work owns the new workload reader for existing
|
|
requester custody. Existing issuer registration and applied CCR-2026-0026/0027
|
|
are preserved. Private listener, TokenReview transport, runtime OIDC exchange,
|
|
submitter admission and live intake rollout remain separately owned.
|
|
|
|
## Prepare exact workload reader and owner review bundle
|
|
|
|
```task
|
|
id: RPF-WP-0051-T01
|
|
status: done
|
|
priority: high
|
|
state_hub_task_id: "3de19f19-d18a-5714-858e-db8dc05e44ca"
|
|
```
|
|
|
|
Allocate proposed CCR-2026-0032; render exact-path policy and prospective
|
|
Kubernetes-auth role, namespace-restricted ESO, dedicated auth ServiceAccount
|
|
and read-only review-pod mount proposal. Keep the bundle outside all active
|
|
GitOps rendering. Validate the actual source bundle and record its digests;
|
|
preparation supplies no credentials, admitted identity or native receipt.
|
|
|
|
2026-10-04: Prepared and validated actual proposed CCR-2026-0032 and generator
|
|
input, canonical exact-path policy, prospective auth payload, namespace-restricted
|
|
ESO, dedicated auth ServiceAccount and required read-only mount proposal. Added
|
|
silent attended metadata child with reviewed-digest/status/binding/envelope gates,
|
|
both-object preflight, conflict refusal, missing-only writes and readback. Ten
|
|
focused helper tests, fourteen scaffold regressions and seven window regressions
|
|
pass; actual bundle checks verify path/namespace/TTL/projection/annotation limits
|
|
and proposed-state refusal. Separate INFD-WP-0005-T05 decision checklist maps the
|
|
CCR/lane/receipt contract and remains NOT READY. No live action or issuer change.
|
|
|
|
## Obtain exact owner runtime and binding acceptance
|
|
|
|
```task
|
|
id: RPF-WP-0051-T02
|
|
status: done
|
|
priority: high
|
|
state_hub_task_id: "dfc17e0a-9f63-5a97-b87e-13bd3a8325d6"
|
|
```
|
|
|
|
Review `docs/credential-lane-designs/informed-decision-requester-workload.md`
|
|
against INFD-WP-0005-T05 and its owner dependency contract. Confirm ESO token
|
|
creation authority for the exact ServiceAccount. A draft identity is not an
|
|
owner acceptance. Retain exact immutable runtime/config references and a bounded
|
|
positive/negative/rotation/revocation proof plan before promotion.
|
|
|
|
2026-10-04: Founder authorized the prepared owner coordination requests. Sent
|
|
request `2c1507b2-b361-4ef9-b5d4-3245014c7c52` to informed-decision on preparation
|
|
thread `f84637fa-2355-4971-a2dc-7f1fd01710a8`, reviewing source commit
|
|
`6b91d510395215d178d60ee8884e7fc00930a0cf`. It carries the design approval and
|
|
asks for exact binding/mount/runtime/verification ownership and remaining native
|
|
evidence. Hub creation receipt is retained; owner acceptance is still outstanding.
|
|
|
|
2026-10-04 owner-return review: source binding/mount acceptance and rotating
|
|
RequesterTokenProvider/compose_intake implementation are delivered at
|
|
`eb9614c2677c7f07c9d78eee7543f95f329d2c83`; exact-primary source receipt is
|
|
`f06b7e9c53d3477f1e690ed8259f2eaab3661f91`. Replies 17bcfb39 and d304e328
|
|
and `informed-decision/docs/requester-workload-owner-review.md` retain 37 focused
|
|
owner tests and remaining process/transport/publication gaps. Platform's explicit
|
|
SubjectAccessReview of the actual controller confirms TokenRequest permission
|
|
for the namespace without minting a token. T02 waits only on independent owner
|
|
source readiness, not its entire live task (which needs platform delivery).
|
|
Native custody/delivery acceptance remains T03. Plan moved to blocked after
|
|
completing available local preparation; concrete requirements/reopen conditions
|
|
are in this window's `dependency-requirements.md`.
|
|
|
|
## Apply and accept the scoped workload delivery
|
|
|
|
```task
|
|
id: RPF-WP-0051-T03
|
|
status: done
|
|
priority: high
|
|
depends_on: [RPF-WP-0051-T02]
|
|
needs_human: false
|
|
decision_id: "0d6792b6-59e4-4fa0-887a-c4e51ea8e131"
|
|
state_hub_task_id: "abbe62c9-8520-563a-9f8a-e12b5209af77"
|
|
```
|
|
|
|
The founder approves the exact new reader, then runs the reviewed contained
|
|
metadata child in their terminal. Apply only the new policy/role; do not seed,
|
|
rotate or reapply historical requester custody. Promote ESO/runtime through
|
|
their actual owner deployment paths after diff/server dry-run and resource
|
|
checks. Accept delivery, exact token-policy/identity/TTL, sibling/list denial,
|
|
create-only exchange and cleanup/revocation receipts. Revoke this reader on
|
|
abort without touching the issuer or historical verifier/attended-reader lanes.
|
|
|
|
2026-10-04 founder design decision: Bernd answered "I approve" after review of
|
|
the exact new delivery boundary, namespace-level trust and credential persistence
|
|
beyond reader-token lifetime. Design approval for owner integration is recorded
|
|
in CCR-2026-0032 and the lane contract. Owner binding/runtime acceptance and the
|
|
separate concrete live go remain; no repeated design decision is required unless
|
|
scope materially changes. The broader INFD-WP-0005-T05 decision remains open for
|
|
runtime/listener acceptance and deployment. No credential action occurred.
|
|
|
|
## Exact live delivery approval — 2026-10-04
|
|
|
|
Founder answered "I approve" to the concrete CCR-2026-0032 requester delivery
|
|
following informed-decision c084600 release review. Source/runtime acceptance
|
|
closes T02: private listener, CA-verified TokenReview, requester exchange and
|
|
separate audience tokens are composed; immutable service 2768bd1 and worker
|
|
410fb6b passed recorded tests/scans. Approved CCR retains only the existing path,
|
|
exact ESO identity, audience openbao, 900-second limits and read-only projection.
|
|
The metadata child still requires the founder terminal OIDC/MFA. Native claims,
|
|
delivery, negative proofs and revocation remain unproven under T03. No broader
|
|
cutover or issuer rotation approval is inferred.
|
|
|
|
## Attended child failure and bounded repair — 2026-10-04
|
|
|
|
Founder reported Warden exit 11; the local audit confirms child_failed. This
|
|
does not prove that metadata stayed unchanged or that revocation succeeded.
|
|
The installed bao binary against a synthetic HTTP 404 reproduces a helper bug:
|
|
it emits exact path-specific No value found, not Code: 404. Updated handling
|
|
accepts only the exact read diagnostic with exit 2 and empty stdout; denials,
|
|
wrong paths and other failures refuse. Real installed-CLI tests cover missing
|
|
objects, both writes/readbacks and an idempotent repeat without another write.
|
|
|
|
Each child now retains only fixed phase/exit metadata in
|
|
docs/evidence/requester-metadata/*.json and remains silent. Twelve focused tests
|
|
pass. The approved CCR and permissions are unchanged. A fresh attended attempt
|
|
will compare both objects before any missing-only write and record its phase.
|
|
Native delivery remains pending; do not mark the earlier attempt successful.
|
|
|
|
## Native delivery result and required amendment — 2026-10-04
|
|
|
|
Founder reported exit 0 and helper receipt confirms metadata_verified. Created
|
|
the reviewed dedicated manual ArgoCD application/project and synced three delivery
|
|
objects from 4332c39 after diff/server dry-run. Corrected the draft audience field
|
|
to serviceAccountRef.audiences using the installed ESO schema. Node IP and CPU
|
|
headroom checked (3445m/4000m); no workload rollout or image change occurred.
|
|
|
|
ArgoCD sync succeeded; ClusterSecretStore and ExternalSecret are not Ready.
|
|
Bounded condition inspection confirms 403 on auth/token/lookup-self. Existing
|
|
ESO readers include self lookup/read and revoke/update, omitted by this packet.
|
|
Prepared only that amendment and an exact-predecessor policy migration in the
|
|
silent helper; 14 tests pass. CCR returns to proposed for changed capabilities,
|
|
retaining original approval/application history. T03 stays waiting for amendment
|
|
approval and fresh attended execution. Evidence: 2026-10-04-requester-delivery.json.
|
|
|
|
Founder explicitly approved lookup-self/read and revoke-self/update. Amended
|
|
CCR approved and exact helper source/digest validated offline. Only fresh attended
|
|
execution and native delivery proofs remain for this amendment; no renewed
|
|
permission request is needed within this scope.
|
|
|
|
## Native scoped delivery proven — 2026-10-04
|
|
|
|
Attended amendment exit 0 and metadata_verified receipt retained. After refresh,
|
|
ArgoCD Synced, ClusterSecretStore Valid and ExternalSecret SecretSynced. Safe
|
|
annotation helper confirms no duplicate credential annotation. Temporary native
|
|
workloads proved exact identity/policy and TTL/max bounds; wrong namespace,
|
|
ServiceAccount and audience refused; sibling GET and parent LIST refused.
|
|
Projection is 0440 and equals the exact authorized KV field without emitting it.
|
|
|
|
Native exchange exposed requester client_secret_post incompatibility. Fixed
|
|
informed-decision at 03f18d8 to use KeyCape client_secret_basic with form-encoded
|
|
credential halves; image 804d89fb passes 664 tests/1 skipped, 13 container checks
|
|
and zero HIGH/CRITICAL scan findings. With the service's exact Traefik HTTPS peer,
|
|
native signed create-only exchange and approve/read/consume refusals all pass.
|
|
The test reader self-revoked and post-revoke lookup fails; all eight temporary
|
|
verification objects are removed. CCR is applied; actual review Deployment mount
|
|
and cutover acceptance remain T03. Issuer rotation stays separately governed,
|
|
not inferred from unchanged-file projection or callback unit tests.
|
|
|
|
## Receiving service acceptance — 2026-10-05
|
|
|
|
The approved schema-5 service is live. Its actual receiving pod mounts the
|
|
requester field read-only at 0440 and completes the pinned, signed create-only
|
|
KeyCape exchange. Native intake created approval 22b30fe7-c565-46f2-8193-d8875975ad9e
|
|
and retained its exact binding receipt. Public/private isolation, wrong caller
|
|
and crossed-audience checks pass. No credential value was emitted.
|
|
|
|
Initial workload delivery is complete. Residual RPF-IN-0004 owns the separately
|
|
governed issuer rotation and changed-projection/predecessor-rejection proof;
|
|
this cutover neither performs nor authorizes rotation. Human acceptance of the
|
|
decision product stays with INFD-WP-0007-T07 / STATE-WP-0096-T03.
|