railiance-platform/credential-change-requests/CCR-2026-0032.yaml

id: CCR-2026-0032
kind: credential-change-request
schema_version: 1
request_type: workload-kv-read
title: Informed Decision create-only requester workload read
status: applied
created: '2026-10-04'
updated: '2026-10-04'
requester:
  agent: informed-decision
  reason: INFD-WP-0005-T05 request cd811073; prepare workload delivery of existing
    requester custody
review:
  required: true
  required_approvers:
  - platform-owner
  - informed-decision-owner
  comments:
  - at: '2026-10-04'
    reviewer: Bernd Worsch
    decision: design_boundary_approved
    comment: Founder answered "I approve" to the prepared requester-delivery design
      for owner integration. Approves the exact existing-path reader, dedicated ESO
      identity, informed-decision namespace boundary, 15-minute reader tokens and
      read-only credential projection; namespace writer exposure and persistence beyond
      reader-token lifetime were disclosed. Owner runtime/binding acceptance and separate
      live deployment go remain; status stays proposed until those gates are satisfied.
      This does not resolve the broader intake rollout decision.
  - at: '2026-10-04T21:01:27+00:00'
    reviewer: codex
    decision: binding_confirmed
    comment: Owner source review confirmed exact intended Kubernetes binding informed-decision/informed-decision-eso
      and audience openbao; runtime source accepted in informed-decision c084600,
      immutable service 2768bd1 and dispatcher 410fb6b. Existing namespace and ESO
      controller account verified live; prior explicit SubjectAccessReview permits
      TokenRequest. Dedicated account deployment and native auth positive/negative
      receipts remain pending; this confirms the reviewed binding configuration, not
      a completed native login.
  - at: '2026-10-04T21:01:27+00:00'
    reviewer: Bernd Worsch
    decision: approved
    comment: 'Founder answered I approve to the concrete requester-delivery approval
      request after review of the release packet: dedicated ESO identity, existing
      exact requester path, 15-minute reader tokens and read-only projection into
      informed-decision. This is the separate live delivery go following prior design
      approval. Attended OpenBao OIDC/MFA and native verification remain required;
      broader lifecycle cutover and separate issuer rotation are not approved by this
      record.'
  - at: '2026-10-04T21:21:12.702154+00:00'
    reviewer: codex
    decision: amendment_proposed
    comment: Prior approved metadata was applied and verified by attended helper exit
      0. ArgoCD delivered the three objects, but native ESO validation receives 403
      at auth/token/lookup-self. Propose adding only lookup-self read and revoke-self
      update, as required by existing ESO reader pattern. Exact KV path, bound identity,
      audience, TTL and no-default-policy remain unchanged. This amendment requires
      founder approval and attended administration; prior approval is retained in
      history.
  - at: '2026-10-04T21:24:05+00:00'
    reviewer: Bernd Worsch
    decision: approved
    comment: 'Founder explicitly approved the two self-token permissions in this session:
      auth/token/lookup-self read and auth/token/revoke-self update. Authorizes exact-predecessor
      amendment of the already applied reader policy through fresh attended OpenBao
      login. Exact credential path, bound account/namespace/audience, 900-second limits,
      no-default-policy and create-only requester scopes remain unchanged.'
  - at: '2026-10-04T21:48:43.216200+00:00'
    reviewer: codex
    decision: native_delivery_proven
    comment: Founder attended amendment exited 0 with metadata_verified receipt. ArgoCD
      delivery is Synced; store Valid and ExternalSecret SecretSynced. Candidate image
      804d89fb proved exact reader policy/TTL, wrong SA/namespace/audience and sibling/LIST
      denials, mounted file equality/mode, signed create-only exchange and excess-scope
      denials. Reader revoked and post-revoke lookup denied; temporary proofs removed.
      Verification workload only; production service mount/cutover acceptance remains
      pending. No issuer rotation performed.
target:
  domain: financials
  tenant: platform
  workload: informed-decision
  environment: production
  purpose: Deliver existing create-only requester client to the review pod through
    namespace-restricted ESO
openbao:
  mount: platform
  kv_path: platform/workloads/informed-decision/sitting-requester
  fields:
  - CLIENT_SECRET
  policy_name: workload-kv-read-informed-decision-sitting-requester-eso
  policy_file: openbao/policies/workload-kv-read-informed-decision-sitting-requester-eso.hcl
  metadata_read: false
  auth:
    method: kubernetes
    mount: kubernetes
    role: informed-decision-sitting-requester-eso
    audience: openbao
    ttl: 15m
    token_max_ttl: 15m
    token_explicit_max_ttl: 15m
    token_no_default_policy: true
    policies:
    - workload-kv-read-informed-decision-sitting-requester-eso
    bound_claims:
      service_account_names:
      - informed-decision-eso
      service_account_namespaces:
      - informed-decision
    bound_claims_confirmed: true
  token_self_lifecycle: true
access_frontdoor:
  type: external-secrets
  catalog_id: informed-decision-sitting-requester-eso
  readiness: pending-review
  resolvable: false
risk:
  classification: high
  notes:
  - The whole KV path is readable; the existing CLIENT_SECRET permits approval:create
    for subject informed-decision
  - Any ExternalSecret in the informed-decision namespace can reference this store;
    no other namespace is admitted
  - No approval:approve, approval:consume, sibling read, metadata listing or new client
    is granted
verification:
  positive:
  - Owner-reviewed native exact identity and exact path proof required
  negative:
  - Owner-reviewed wrong identity, sibling GET and parent LIST denials required
  activation_conditions:
  - Exact CCR approval, confirmed identity, attended custody and native receipt acceptance
    required
lifecycle:
  deactivate: Owner-reviewed delivery withdrawal and token revocation; exact rollback
    receipt required
  rotate: Separate version-guarded owner approval and contained value delivery required
  compromised: Owner incident process; no automatic read, reseed or cleanup
scaffold:
  draft_only: true
  consumer_repo: informed-decision
  owner_repo: railiance-platform
  request_sha256: 83181c92b80d708246147d6ee06dafdab880ce88f4203dfc7499970aa52e312f
  catalog_request_sha256: null
delivery:
  surface: external-secrets
  target: informed-decision/informed-decision-sitting-requester key client-secret;
    read-only projection into review pod
  review_bundle: docs/provisioning-windows/2026-10-04-1000/informed-decision
  metadata_child: scripts/informed_decision_requester_metadata.py
state_hub:
  workplan_id: RPF-WP-0051
  task_id: RPF-WP-0051-T03
  related_workplan: INFD-WP-0005
  decision_api_url: http://127.0.0.1:8000/decisions/0d6792b6-59e4-4fa0-887a-c4e51ea8e131