tegwick
a94d06dbcf
Assistant: codex Assistant-Model: gpt-5.6-luna Assistant-Session: 01a07ff8-19d0-7820-b4d0-1353833cb7fc
86 lines
2.2 KiB
JSON
86 lines
2.2 KiB
JSON
{
|
|
"observed_at": "2026-09-08T20:36:47.042499+00:00",
|
|
"requests": [
|
|
"CCR-2026-0017",
|
|
"CCR-2026-0018"
|
|
],
|
|
"operation": "capabilities-self only",
|
|
"credential_data_read": false,
|
|
"metadata_applied": false,
|
|
"custody_activated": false,
|
|
"upstream_issuer_proven": false,
|
|
"status": "observed",
|
|
"capabilities": {
|
|
"sys/policies/acl/workload-kv-read-keycape-secrets-engine-approval": [
|
|
"create",
|
|
"delete",
|
|
"list",
|
|
"read",
|
|
"sudo",
|
|
"update"
|
|
],
|
|
"sys/policies/acl/workload-kv-read-keycape-approval-engine-operator": [
|
|
"create",
|
|
"delete",
|
|
"list",
|
|
"read",
|
|
"sudo",
|
|
"update"
|
|
],
|
|
"auth/kubernetes/role/external-secrets-keycape-secrets-engine-approval": [
|
|
"create",
|
|
"delete",
|
|
"list",
|
|
"read",
|
|
"sudo",
|
|
"update"
|
|
],
|
|
"auth/kubernetes/role/external-secrets-keycape-approval-engine-operator": [
|
|
"create",
|
|
"delete",
|
|
"list",
|
|
"read",
|
|
"sudo",
|
|
"update"
|
|
],
|
|
"platform/data/workloads/secrets-engine/approval-client": [
|
|
"create",
|
|
"delete",
|
|
"list",
|
|
"read",
|
|
"update"
|
|
],
|
|
"platform/data/workloads/approval-engine/operator-client": [
|
|
"create",
|
|
"delete",
|
|
"list",
|
|
"read",
|
|
"update"
|
|
]
|
|
},
|
|
"required_metadata_capabilities_present": true,
|
|
"paths_verified": 6,
|
|
"login_lane": "openbao-platform-admin-login",
|
|
"launcher": "scripts/openbao-attended-exec.py",
|
|
"command": "scripts/keycape-approval-custody-preflight.py --receipt <new-private-file>",
|
|
"wrapper_exit": 0,
|
|
"session_self_revoked": true,
|
|
"helper_root_removed": true,
|
|
"attempt_notes": [
|
|
{
|
|
"attempt": 1,
|
|
"result": "direct launcher unavailable; no child handoff; revocation unconfirmed",
|
|
"credential_data_read": false
|
|
},
|
|
{
|
|
"attempt": 2,
|
|
"result": "owner wrapper login/self-revocation succeeded; capability command rejected unsupported multiple-path syntax",
|
|
"credential_data_read": false
|
|
},
|
|
{
|
|
"attempt": 3,
|
|
"result": "six single-path capability queries succeeded; session self-revoked and helper removed",
|
|
"credential_data_read": false
|
|
}
|
|
]
|
|
}
|