5d6d8724b4
Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a06ecb-456a-71c2-b41e-0755d336e883
142 lines
6.2 KiB
Markdown
142 lines
6.2 KiB
Markdown
---
|
|
id: RPF-WP-0035
|
|
type: workplan
|
|
title: "Implement reviewed credential lanes with separate owner gates"
|
|
domain: financials
|
|
repo: railiance-platform
|
|
status: blocked
|
|
owner: codex
|
|
created: "2026-09-05"
|
|
updated: "2026-09-05"
|
|
related:
|
|
- RPF-WP-0032
|
|
- RPF-WP-0033
|
|
- RPF-WP-0034
|
|
state_hub_workstream_id: "975db491-5412-5e27-8e34-14a2417bb039"
|
|
---
|
|
|
|
# Credential lane implementation
|
|
|
|
One S3 queue for three designed lanes; each task keeps its own approval,
|
|
execution and closure boundary. This replaces the implementation tasks in the
|
|
three completed design workplans, not the designs themselves. No approval is
|
|
inherited by consolidation. INTENT binding: secure custody, dependable delivery,
|
|
stable consumer interfaces. Incident custody remains in RPF-WP-0027/0029.
|
|
|
|
## Consolidate completed designs and owner dependencies
|
|
|
|
```task
|
|
id: RPF-WP-0035-T01
|
|
status: done
|
|
priority: medium
|
|
state_hub_task_id: "0f3606bb-e95b-5484-8a57-bcdd6e3916fd"
|
|
```
|
|
|
|
Completed 2026-09-05. Preserved the three designs under
|
|
`docs/credential-lane-designs/`, identified native owner responsibilities and
|
|
linked each superseded task below. Owners have not been sent new requests and
|
|
no new external acceptance is claimed. STATE-WP-0085-T09 is already done;
|
|
the signing dependency belongs to the proposed FLEX-WP-0020-T05 cutover.
|
|
|
|
## Accept and provision secrets-engine service JWT login
|
|
|
|
```task
|
|
id: RPF-WP-0035-T02
|
|
status: wait
|
|
priority: high
|
|
state_hub_task_id: "e0c82ea9-05a5-537e-8fbf-67534263572e"
|
|
```
|
|
|
|
Supersedes RPF-WP-0032-T02. Design:
|
|
`docs/credential-lane-designs/secrets-engine-service-jwt.md`.
|
|
|
|
Platform owns the exact JWT mount/role/policy, effective-policy negative tests
|
|
and a metadata-only custody receipt. KeyCape owns issuer/JWKS and service
|
|
registration (KEY-WP-0009); secrets-engine owns service authentication and
|
|
authority consumption (SECRETS-WP-0008-T06, SECRETS-WP-0007-T04).
|
|
|
|
**Unblock:** confirmed HTTPS issuer/JWKS, exact claims and audience, consumer
|
|
readiness, approved source and attended apply authority. A service login does
|
|
not grant lane mutation authority. Do not build another identity provider or
|
|
lifecycle engine here.
|
|
|
|
**Done when:** approved exact role succeeds for the intended service, wrong
|
|
issuer/audience/subject/claims and unrelated secret access fail, bounded TTL
|
|
and revocation are proven, the consumer explicitly opts into the verified
|
|
contract, and rollback/cleanup receipts contain no secret material.
|
|
|
|
## Implement the platform operator-write CCR contract and Fluid lane
|
|
|
|
```task
|
|
id: RPF-WP-0035-T03
|
|
status: wait
|
|
priority: high
|
|
state_hub_task_id: "f47e5bc5-6f3c-54bb-aa35-260ad03892ba"
|
|
```
|
|
|
|
Supersedes RPF-WP-0033-T02. Design:
|
|
`docs/credential-lane-designs/fluid-telegram-operator-kv.md`.
|
|
|
|
Platform owns the per-path capability schema/validator, exact OpenBao policy
|
|
and accepted custody coordinates. MASON-WP-0005 owns construction coordination
|
|
and engine integration; KeyCape/NetKingdom own OIDC/MFA and group membership;
|
|
FT-WP-0002 owns client CAS, prefix correction, output containment and Telegram
|
|
application acceptance. Retain the existing read-only CCR semantics.
|
|
|
|
**Unblock:** accept tenant/path and per-entry field/capability matrix; confirm
|
|
actual group/assurance and callbacks, reviewed construction contract and writer
|
|
authority. Contract review can proceed without a live credential; the final
|
|
schema cannot be treated as accepted solely because a draft exists.
|
|
|
|
**Done when:** validation rejects broad/unsupported grants, the consumer proves
|
|
CAS=0 first-write behavior and no value output, approved identities can perform
|
|
only the exact matrix, negative/expiry/revocation checks pass, custody is seeded
|
|
through the separate writer, and the verified route has a safe handoff receipt.
|
|
The unattended adapter remains a separate demand and gets no operator session.
|
|
|
|
## Accept the needed signing lane and deliver it to the owning runtime
|
|
|
|
```task
|
|
id: RPF-WP-0035-T04
|
|
status: done
|
|
priority: medium
|
|
state_hub_task_id: "35a85846-61d5-54ce-8b18-ede45733d53c"
|
|
```
|
|
|
|
Supersedes RPF-WP-0034-T02. Design:
|
|
`docs/credential-lane-designs/state-hub-preflight-signing.md`.
|
|
|
|
Platform owns signing-key custody, exact read policy/role and scoped delivery
|
|
acceptance. State Hub owns API chart/env wiring, all-replica rotation fencing
|
|
and health. FLEX-WP-0020-T05 owns the rename preflight/cutover dependency;
|
|
STATE-WP-0085-T09's adoption-plan delivery is already complete.
|
|
|
|
**Unblock:** State Hub/repo-manager and the consuming migration owner confirm
|
|
that this transitional State Hub lane is still needed during retirement;
|
|
record the target runtime, namespace/SA/auth audience and an executable
|
|
rotation fence, plus approved writer and deployment window. Do not broaden the
|
|
lane into a general repository-rename authority or provision for a stale demand.
|
|
|
|
**Done when:** protected one-time generation, API-only ESO delivery, negative
|
|
access checks and a non-mutating signed preflight pass; every API replica uses
|
|
the accepted version; rotation/invalidation and recovery are evidenced. No
|
|
repository rename is part of S3 lane acceptance. If demand is withdrawn, record
|
|
the owning decision and cancel this task explicitly rather than provision it.
|
|
|
|
2026-09-05 continuation: verified the live primary cluster identity and healthy
|
|
single API replica; the signing ExternalSecret is still absent. Added a writer
|
|
guard against wrong-cluster kubeconfigs before any OpenBao access. The default
|
|
workstation kubeconfig's local port-forward listener was unavailable. Activation
|
|
still needs the contained attended OIDC/MFA login and the acceptance evidence
|
|
above; source preparation is not live completion. See
|
|
`history/2026-09-05-preflight-signing-activation-readiness.md`.
|
|
|
|
|
|
Completed 2026-09-05: user-led attended activation generated version 1 and
|
|
rotated to version 2 with every API replica stopped. Exact access and negative
|
|
identity checks passed; ESO delivery and API-only exposure passed; the recovered
|
|
single API replica accepts new signed preflight and rejects its predecessor by
|
|
signature, with healthy primary identity and no preflight blockers. State Hub
|
|
chart commit `49e3182`, Helm revision 59. No repository rename executed.
|
|
Evidence: `docs/evidence/RPF-WP-0035-T04-signing-activation-2026-09-05.json`;
|
|
closure: `history/2026-09-05-preflight-signing-activation-complete.md`.
|