bfe65a5b05
Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a07ff8-19d0-7820-b4d0-1353833cb7fc
110 lines
5.3 KiB
YAML
110 lines
5.3 KiB
YAML
id: CCR-2026-0021
|
|
kind: credential-change-request
|
|
schema_version: 1
|
|
request_type: workload-kv-read
|
|
title: approval-engine load-bearing audit sender custody and delivery
|
|
status: proposed
|
|
created: '2026-09-11'
|
|
updated: '2026-09-11'
|
|
requester:
|
|
agent: codex
|
|
reason: AUDIT-WP-0009-T09 and HFACT-WP-0001-T03 require the existing exact sender declaration. This
|
|
request supplies the missing platform custody and ESO delivery; receiver compatibility and service
|
|
rollout remain explicit gates.
|
|
review:
|
|
required: true
|
|
required_approvers:
|
|
- platform-operator
|
|
- audit-core-owner
|
|
- approval-engine-owner
|
|
comments: []
|
|
target:
|
|
domain: financials
|
|
tenant: platform
|
|
workload: approval-engine
|
|
environment: production
|
|
purpose: Provide only the approval-engine sender with source=approval-engine, tenants=[tenant:platform],
|
|
may_write=true, may_read=false, evidence_kind=load-bearing, secret_policy=redact. Preserve the
|
|
existing receiver registry and every other sender.
|
|
openbao:
|
|
mount: platform
|
|
kv_path: platform/workloads/approval-engine/audit-sender
|
|
fields:
|
|
- AUDIT_TOKEN
|
|
- CUSTODY_REQUEST
|
|
policy_name: workload-kv-read-approval-engine-audit
|
|
policy_file: openbao/policies/workload-kv-read-approval-engine-audit.hcl
|
|
metadata_read: false
|
|
auth:
|
|
method: kubernetes
|
|
mount: kubernetes
|
|
role: external-secrets-approval-engine-audit
|
|
bound_claims:
|
|
service_account_names:
|
|
- external-secrets
|
|
service_account_namespaces:
|
|
- external-secrets
|
|
bound_claims_confirmed: true
|
|
policies:
|
|
- workload-kv-read-approval-engine-audit
|
|
ttl: 15m
|
|
access_frontdoor:
|
|
type: external-secrets
|
|
catalog_id: approval-engine-audit
|
|
readiness: pending-review
|
|
resolvable: false
|
|
delivery:
|
|
surface: external-secrets
|
|
target: 'ClusterSecretStore openbao-approval-engine-audit restricted to namespace approval-engine;
|
|
ExternalSecret and Secret approval-engine/approval-engine-audit, key audit-token. Source: manifests/factory-audit-senders.yaml.
|
|
A missing namespace stays a workload-owner prerequisite; this packet creates none.'
|
|
risk:
|
|
classification: high
|
|
notes:
|
|
- A bearer permits append for its exact sender and tenant, never reading or changing stored evidence.
|
|
- The registry update reads existing sender credentials inside the attended platform process only.
|
|
No registry is delivered to a producer.
|
|
- OpenBao login TTL limits the ESO reader session, not the audit bearer. Revocation must remove
|
|
the sender token from the receiver registry and prove refusal.
|
|
- New paths extend the existing coding-agent deny boundary. No existing high-risk grant is widened.
|
|
verification:
|
|
positive:
|
|
- Independent CAS=0 token creation and exact sender merge with registry-version compare-and-set;
|
|
repeated runs preserve both tokens and other registry fields.
|
|
- ESO delivers only AUDIT_TOKEN into approval-engine/approval-engine-audit:audit-token; source and
|
|
receiver copies agree without displaying values.
|
|
- Compatible deployed receiver accepts and deduplicates a declared synthetic event for the exact
|
|
sender and tenant, retaining load-bearing/redact declarations.
|
|
negative:
|
|
- Sibling sender path, full registry and parent listing are denied to each workload reader. Wrong
|
|
service account/namespace and disallowed store namespace fail.
|
|
- Receiver denies sibling source, wrong tenant, every read route and revoked token. No existing
|
|
sender is removed or re-scoped.
|
|
- Proposed or altered CCR, legacy receiver, malformed/duplicate registry identity, token collision,
|
|
stale registry version or partial/conflicting custody refuses without overwriting.
|
|
activation_conditions:
|
|
- All three named owner reviews are approved before any native credential mutation.
|
|
- A current image supporting evidence_kind is published/admitted by audit-core and deployed with
|
|
its source scope and network policy; current c2fe39a image fails compatibility.
|
|
- Use the Warden attended platform-admin login envelope; preserve independent receipt and revoke
|
|
the session on exit.
|
|
- Apply reviewed policy/auth metadata and ESO projection only after receiver compatibility and namespace
|
|
readiness. An interrupted seed resumes from durable KV values, never blindly rotates or deletes.
|
|
- Record native positive/negative evidence before declaring verified or active. Custody alone does
|
|
not admit UI, human approval or factory execution.
|
|
lifecycle:
|
|
deactivate: Stop the exact producer; remove only its admitted token from the registry using CAS
|
|
and reload/verify receiver refusal. Then detach its reader policy and remove its ExternalSecret/projection,
|
|
retaining KV versions for investigation. Do not delete audit events or other sender entries.
|
|
rotate: 'Reviewed overlap-first rotation: append a replacement to this sender only, deliver it,
|
|
prove acceptance, then remove the predecessor and prove refusal. The first-provision helper refuses
|
|
rotation and unexpected existing values.'
|
|
compromised: Stop affected producer and revoke the exact receiver token first; inspect affected
|
|
source/tenant events, rotate through a separate reviewed action, and preserve the independent
|
|
audit trail.
|
|
state_hub:
|
|
workplan_id: RPF-WP-0035
|
|
task_id: RPF-WP-0035-T08
|
|
related_workplan: AUDIT-WP-0009-T09
|
|
decision_id: 2c9fe9f0-034a-41d7-9d49-b99df488fdc8
|
|
decision_api_url: http://127.0.0.1:8000/decisions/2c9fe9f0-034a-41d7-9d49-b99df488fdc8
|