d2dbc19c25
CCR-2026-0026/0027 are proposed source only: new KV path, no apply, and no widening of 0024/0025. Record destroy-after-confirm for the npm duplicate, coordinated 0018 disablement, blocked historical NetKingdom paths, and no Forgejo retention cutover. Assistant: grok Assistant-Session: 01a0a23b-3bf0-7341-b4e5-9dc05f72573a
94 lines
3.8 KiB
YAML
94 lines
3.8 KiB
YAML
id: CCR-2026-0026
|
|
kind: credential-change-request
|
|
schema_version: 1
|
|
request_type: workload-kv-read
|
|
title: Informed Decision sitting-requester KeyCape verifier custody
|
|
status: proposed
|
|
created: '2026-09-15'
|
|
updated: '2026-09-15'
|
|
requester:
|
|
agent: grok
|
|
reason: INFD-WP-0002-T03 requested a create-only sitting presenter whose binding.actor
|
|
is informed-decision. Allocate a new CCR pair. Do not widen CCR-2026-0024, CCR-2026-0025
|
|
or platform/workloads/secrets-engine/approval-requester.
|
|
review:
|
|
required: true
|
|
required_approvers:
|
|
- platform-operator
|
|
- key-cape-owner
|
|
comments:
|
|
- at: '2026-09-15'
|
|
reviewer: operator instruction in Grok session
|
|
decision: allocated
|
|
comment: Operator selected allocation of the sitting-requester CCR pair. Source
|
|
only. No OpenBao apply, no secret seed, no KeyCape registration, and no sitting
|
|
POST from this allocation.
|
|
target:
|
|
domain: financials
|
|
tenant: platform
|
|
workload: informed-decision
|
|
environment: production
|
|
purpose: create-only sitting requester KeyCape verifier custody; approval:create
|
|
only; subject informed-decision; audience approval-engine.
|
|
openbao:
|
|
mount: platform
|
|
kv_path: platform/workloads/informed-decision/sitting-requester
|
|
fields:
|
|
- CLIENT_SECRET
|
|
policy_name: workload-kv-read-keycape-informed-decision-sitting-requester
|
|
policy_file: openbao/policies/workload-kv-read-keycape-informed-decision-sitting-requester.hcl
|
|
auth:
|
|
method: kubernetes
|
|
mount: kubernetes
|
|
role: external-secrets-keycape-informed-decision-sitting-requester
|
|
bound_claims:
|
|
service_account_names:
|
|
- external-secrets
|
|
service_account_namespaces:
|
|
- external-secrets
|
|
bound_claims_confirmed: true
|
|
policies:
|
|
- workload-kv-read-keycape-informed-decision-sitting-requester
|
|
ttl: 15m
|
|
access_frontdoor:
|
|
type: ops-warden
|
|
catalog_id: informed-decision-sitting-requester-login
|
|
selector: Informed Decision create-only sitting requester
|
|
command: warden access informed-decision-sitting-requester-login --exec -- <reviewed-requester-command>
|
|
resolvable: false
|
|
readiness: pending-review
|
|
delivery:
|
|
surface: external-secrets
|
|
target: sso/keycape-informed-decision-sitting-requester-client via ESO; env KEYCAPE_INFORMED_DECISION_SITTING_REQUESTER_CLIENT_SECRET
|
|
risk:
|
|
classification: high
|
|
notes:
|
|
- Credential authenticates only the separate approval:create sitting requester.
|
|
Human disposition remains on the public PKCE client informed-decision-approver.
|
|
- Do not widen CCR-2026-0024/0025 or secrets-engine/approval-requester.
|
|
- No approval, consume, or read scope. No sitting POST until exchange proof exists.
|
|
verification:
|
|
positive:
|
|
- Exact path read of CLIENT_SECRET for the KeyCape verifier ServiceAccount only.
|
|
- Sibling secrets-engine/approval-requester and parent listing denied.
|
|
negative:
|
|
- Approval and consume scopes refused at token exchange; wrong secret refused.
|
|
- Sibling KV paths and parent listing denied.
|
|
activation_conditions:
|
|
- KeyCape row informed-decision-sitting-requester exists and remains unregistered
|
|
until attended CAS=0 custody and exact policy/auth readback.
|
|
- Separate reader verification and no human entry synthesized.
|
|
- No sitting POST until exchange proof exists.
|
|
lifecycle:
|
|
deactivate: Disable the informed-decision-sitting-requester KeyCape registration
|
|
and detach only these two sitting-requester reader roles. Preserve CCR-2026-0024/0025
|
|
and existing consumer/verifier lanes.
|
|
rotate: Rotate through KeyCape and platform using a new version with predecessor
|
|
refusal proof.
|
|
compromised: Disable sitting-requester issuance first; revoke sessions and rotate
|
|
under attended owner authority.
|
|
state_hub:
|
|
workplan_id: RPF-WP-0042
|
|
task_id: RPF-WP-0042-T01
|
|
related_request: CCR-2026-0027
|
|
related_workplan: INFD-WP-0002
|