railiance-platform/credential-change-requests/CCR-2026-0050-flex-auth-envelope-signing.yaml

id: CCR-2026-0050
kind: credential-change-request
schema_version: 1
request_type: workload-kv-read
title: Retained flex-auth lifecycle PDP Ed25519 seed ESO read lane
status: proposed
created: '2026-10-16'
updated: '2026-10-21'
requester:
  agent: railiance-platform
  reason: CUST-WP-0080 / RPF-WP-0035-T12 / FLEX-WP-0024-T06 source proposal. Exact
    new custody/read scope requires founder review; no approval or native binding
    is inferred.
review:
  required: true
  required_approvers:
  - founder
  - railiance-platform-owner
  - access-engine-owner
  - secrets-engine-owner
  - cluster-runtime-storage-owner
  comments:
  - reviewer: railiance-platform-owner (agent railiance-platform, codex)
    decision: approved
    comment: "INTENT Secure Custody/Stable Interfaces/Operable and Observable; RPF-WP-0035-T12. Approved Platform source/plan review only for frozen P4 manifest sha256:9eec861838a8e9138f2c821cff3014998fbe74bb01447642bf50d44e8b3b7cb3 and R2 manifest sha256:5be7a7f438624dcb35b7dbc96e7c9e5a8e2d5d1b1966cb4338aa5aecbe3a8b59; own bounded review artifact docs/evidence/2026-10-16-flex-auth-native-plan-review.json; sanitized supplement sha256:f02a9b595d9246a358d19b37bdad8fde158b7f0c9657a6ff088874732511a32c. Exact read policy/role/ESO proposal and one-use CAS0 writer stay separate. Identified manual Applications and recovery gates are mandatory. No founder decision, native execution, confirmed bindings or completed admission assent; current proposed status unchanged."
  - reviewer: secrets-engine-owner (agent secrets-engine, hub message e73c9ffc-8a6d-4a17-9604-84324c678dc0)
    decision: approved
    comment: "2026-10-21, consumer side only. Consumer has no KV read role and receives no seed; public trust is admitted through a founder ssh-keygen -Y signed trust file (secrets-engine ebd8e49, docs/founder-admission.md, SECRETS-WP-0014-T04, decision e4eee965). Conditions: (1) the public receipt (kid, Ed25519 public key as 43-char unpadded base64url, evaluator/mode/policy_package/policy_version/policy_package_digest) is emitted by the attended writer at creation time or derived from its public output, never from a later read of the KV document; (2) the receipt carries the KV version and source/image provenance hashes. Not founder approval, native execution or a binding."
  - reviewer: railiance-platform-owner (agent railiance-platform, claude)
    decision: approved
    comment: "2026-10-21 runbook review: docs/runbooks/flex-auth-envelope-signing-attended-creation.md prepared. Secrets condition 1 is met for kid/public key/fingerprint/kv_version/source/image hashes by deriving the consumer receipt from the writer receipt (no KV read); the evaluator/mode/policy_package/policy_version/policy_package_digest fields are not in the writer receipt and must come from Access's published pin. Review-scope digest no longer binds expires_at so owner reviews can precede the 120 s window. Pending: access-engine-owner (awaited), cluster-runtime-storage-owner (railiance-cluster, requested f8b4b229), founder. Nothing executed."
target:
  domain: infotech
  tenant: platform
  workload: flex-auth-secrets-engine
  environment: production
  purpose: Deliver the Ed25519 seed only to the retained lifecycle PDP startup file.
    No taskpilot enablement, caller policy changes or private consumer trust discovery.
openbao:
  mount: platform
  kv_path: platform/workloads/flex-auth/envelope-signing
  fields:
  - ED25519_PRIVATE_KEY
  metadata_read: false
  token_self_lifecycle: true
  policy_name: workload-kv-read-flex-auth-envelope-signing
  policy_file: openbao/policies/workload-kv-read-flex-auth-envelope-signing.hcl
  auth:
    method: kubernetes
    mount: kubernetes
    role: external-secrets-flex-auth-envelope-signing
    bound_claims:
      service_account_names:
      - flex-auth-envelope-signing-eso
      service_account_namespaces:
      - flex-auth
    bound_claims_confirmed: false
    policies:
    - workload-kv-read-flex-auth-envelope-signing
    ttl: 15m
    audience: openbao
    token_max_ttl: 15m
    token_explicit_max_ttl: 15m
    token_no_default_policy: true
access_frontdoor:
  type: external-secrets
  catalog_id: flex-auth-decision-envelope-signing-key
  selector: Retained flex-auth/flex-auth-secrets-engine signer only
  readiness: pending-review
  resolvable: false
delivery:
  surface: external-secrets
  target: Namespace flex-auth; dedicated SA flex-auth-envelope-signing-eso; SecretStore
    openbao-flex-auth-envelope-signing; ExternalSecret/Secret flex-auth-secrets-engine-envelope-signing;
    seed property only -> startup file /var/run/secrets/decision-envelope-signing/seed0440,
    readOnly uid/gid/fsGroup65532; no envFrom
  bootstrap_command: Attended writer is a distinct exact-source action proposal in
    docs/credential-lane-designs/flex-auth-envelope-signing-native-plan.json; this
    read CCR authorizes neither seed writes nor any execution by itself.
risk:
  classification: high
  notes:
  - Possession of seed can forge lifecycle PDP envelopes; independent consumer public
    trust admission and fixed policy pins remain required.
  - 'KV read is document-granular: dedicated ESO identity can read all three fields;
    only private field is projected. Signer and Secrets consumer have no KV read role.'
  - No parent/list/metadata/write/delete capability on ESO role. No token/Secret read
    or ExternalSecret mutation granted to signer/consumer.
  - Dedicated role is new scope; founder approval required. Canonical local draft
    rapp-flex-auth-secrets-engine declaration committed d52f811ed5ec0be27c9c367e71d476125b3228be
    (tree d4fbad71bdc8ef870603526ccd1f53195d0322af) resolves locally. Remote publication,
    placement and actual runtime/package join remain open; no missing-declaration waiver.
  - Controlled outage fence stops every signer pod and disables autoscaling before
    creation/rotation. Recreate single writer and retained PVC remain Access-owned
    review gates.
  - fields declares only projected ED25519_PRIVATE_KEY. The same KV document also
    has public key/kid, and OpenBao data-read is not field-filtered; do not claim
    field-level authorization.
verification:
  positive:
  - Exact SA/namespace/audience login; native exact data read; ESO Ready/SecretSynced;
    safe metadata resourceVersion and admitted KV version correspondence.
  - All retained signer replicas restart with admitted kid/source/image and seed/public
    correspondence; signed non-effect lifecycle allow/deny with durable originals
    and independent consumer signature verification.
  negative:
  - Wrong SA/namespace/audience login refused; sibling/list/metadata/write/delete
    denied; signer/consumer TokenRequest and Secret/ExternalSecret mutation denied.
  - Unknown/old kid, wrong policy, tamper, expired/unsigned envelope, wrong caller
    and missing seed refuse; no taskpilot activation.
  - Receipt write failure/lost backend response retained unknown; no blind retry/remint;
    stale CAS cannot overwrite version.
  activation_conditions:
  - All five required approvers independently dispose the exact CCR and native writer/fence
    proposal; founder exact new custody scope approved.
  - Exact proposed candidate source Git revision 84c78e072c8f3daf2bc3b90f8efc8fbeb16c3cf0 and immutable
    OCI reference forgejo.coulomb.social/coulomb/flex-auth@sha256:09a83b273740133518cc7e7915fb211381e06545d347d2dd1974042525ac981f
    published by successful ordinary CI402; source OS-lock/64MiB/startup hardening present.
    Access reviews exact workload/Helm image/mount/outbox source and actual stopped fence;
    Platform reviews existing GitOps Application sync/freeze; cluster reviews runtime,
    headroom and new PVC1Gi/local-path actual PV retention. Local draft package d52
    remains source2b/current05a, not candidate84 adoption; remote placement/runtime join
    and native mounted-runtime acceptance remain open. Enablement only if separately
    proposed ArgoCD installation/controller configuration changes; none granted here.
  - Exact native bound claims verified without printing JWT/Secret; read grant policy
    and role native readback match source.
  - Protected child source pinned, silent attended OIDC context verified, target cluster/backend
    pinned, fence verified and durable receipt custody installed.
  - Consumer independently admits owner-authenticated public receipt and exact policy/image/trust
    pins before protected acceptance.
  evidence: []
lifecycle:
  deactivate: Fence all retained signer processes, stop consumers, disable delivery
    role/ESO and online trust; retain private KV and audit receipts under explicit
    owner retention until reviewed destruction.
  rotate: Pre-admit successor public receipt offline; fence consumers/all signer replicas/no
    HPA; CAS exact version with new in-memory seed; wait exact ESO version, restart
    single writer, verify native allow/deny and old-key refusal before reopening.
  compromised: Immediately remove old online trust and stop all signer processes;
    forward-only CAS recovery with independently approved successor. Never restore
    compromised seed; archive historical public keys for offline audit only.
state_hub:
  workplan_id: RPF-WP-0035
  task_id: RPF-WP-0035-T14
  decision_id: 18731e84-a6ab-4ac5-bf0e-7e7c3a9c4508
  decision_api_url: http://127.0.0.1:8000/decisions/18731e84-a6ab-4ac5-bf0e-7e7c3a9c4508