3bd3a2e87b
Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a09cbb-87c6-7900-a145-4ce53ba9f1a6
116 lines
4.5 KiB
YAML
116 lines
4.5 KiB
YAML
id: CCR-2026-0028
|
|
kind: credential-change-request
|
|
schema_version: 1
|
|
request_type: attended-host-key-delivery
|
|
title: Railiance Clock authority signing key custody and host delivery
|
|
status: verified
|
|
created: '2026-09-15'
|
|
updated: '2026-09-15'
|
|
requester:
|
|
agent: codex
|
|
reason: User requested production admission of the Railiance Clock authority after
|
|
the host time baseline and disposable native acceptance passed.
|
|
review:
|
|
required: true
|
|
required_approvers:
|
|
- platform-operator
|
|
- railiance-clock-owner
|
|
comments:
|
|
- at: '2026-09-15'
|
|
reviewer: User (platform-operator)
|
|
decision: approved
|
|
comment: User explicitly approved CCR-2026-0028 for the platform-operator role.
|
|
- at: '2026-09-15'
|
|
reviewer: User (railiance-clock-owner)
|
|
decision: approved
|
|
comment: User explicitly approved CCR-2026-0028 for the railiance-clock-owner
|
|
role.
|
|
- at: '2026-09-15'
|
|
reviewer: User (platform-operator and railiance-clock-owner)
|
|
decision: approved_host_delivery
|
|
comment: User accepted the corrected systemd host-file design and instructed then
|
|
lets go; existing two-role approval retained.
|
|
target:
|
|
domain: infotech
|
|
tenant: platform
|
|
workload: railiance-clock
|
|
environment: production
|
|
purpose: Hold one ES256 authority private signing key in OpenBao and deliver it
|
|
only to the private railiance01 Railiance Clock service; no public listener or
|
|
consumer-wide distribution.
|
|
openbao:
|
|
mount: platform
|
|
kv_path: platform/workloads/railiance-clock/authority-signing
|
|
fields:
|
|
- PRIVATE_KEY_PEM
|
|
- KEY_ID
|
|
auth:
|
|
method: attended-oidc
|
|
mount: netkingdom
|
|
role: platform-admin
|
|
runtime_access: false
|
|
initial_cas: 0
|
|
access_frontdoor:
|
|
type: attended-host-file
|
|
catalog_id: openbao-platform-admin-login
|
|
readiness: ready
|
|
resolvable: false
|
|
delivery:
|
|
surface: attended-host-file
|
|
host: 92.205.62.239
|
|
ssh_user: tegwick
|
|
target: /var/lib/railiance-clock/signing.pem
|
|
owner: railiance-clock
|
|
mode: '0600'
|
|
directory_mode: '0700'
|
|
procedure: scripts/railiance_clock_custody.py
|
|
risk:
|
|
classification: high
|
|
notes:
|
|
- Compromise permits forging Railiance Clock samples until the key is revoked and
|
|
every consumer trust file is replaced.
|
|
- The authority remains loopback-only on railiance01; no workstation-wide or public
|
|
endpoint is admitted.
|
|
- Key generation, OpenBao write, host delivery, and rotation require an attended
|
|
platform operator and railiance-clock owner review.
|
|
verification:
|
|
positive:
|
|
- Attended platform-admin identity and OpenBao audit enabled; initial key stored
|
|
with CAS zero.
|
|
- Host account, private directory, exact key ownership and permissions verified;
|
|
public key matches custody.
|
|
- Authority readiness and independent signed sample verification pass.
|
|
negative:
|
|
- Existing key is never overwritten during initial admission; interrupted delivery
|
|
resumes only with the admitted custody version.
|
|
- Wrong key id, authority, environment, epoch, stale health and expired trust are
|
|
refused.
|
|
- No new workload role, policy or token; no public authority listener.
|
|
activation_conditions:
|
|
- Existing two-role approval covers attended host delivery.
|
|
- Ansible prepares the service account and private directory before custody.
|
|
- Reviewed helper runs through warden access openbao-platform-admin-login --exec;
|
|
host key verification is required.
|
|
- Fresh public key, artifact SHA256, readiness and signed sample acceptance are
|
|
recorded.
|
|
evidence:
|
|
- kind: attended_host_custody
|
|
result: passed
|
|
receipt: docs/evidence/2026-09-15-railiance-clock-host-custody.json
|
|
details: OpenBao KV version 1 and matching public-key fingerprint on private host
|
|
file; contained login, child operation and self-revocation succeeded.
|
|
- kind: production_authority_acceptance
|
|
result: passed
|
|
receipt: docs/evidence/2026-09-15-railiance-clock-production.json
|
|
details: Active/enabled private authority; pinned wheel; bounded host health;
|
|
three signed workstation samples cross-checked through SSH, wrong key id refused.
|
|
No standing workload read grant.
|
|
lifecycle:
|
|
deactivate: Stop authority and withdraw consumer trust. Retain custody and host
|
|
key until owner retention decision.
|
|
rotate: Stop authority, perform separately versioned attended CAS rotation and atomic
|
|
host replacement, then admit new public key and epoch for consumers.
|
|
compromised: Stop authority immediately and withdraw all consumer trust; replace
|
|
key forward under attended custody before restarting.
|
|
state_hub:
|
|
workplan_id: RCLK-WP-0005
|