codex
e4af2a1d10
RAILIANCE-WP is a family name, not a repository (ADR-007, and the prefix registry already lists it retired). Three repositories independently used one number space for unrelated work — RAILIANCE-WP-0012 was openbao extraction here, a cnpg backup in railiance-apps and a deploy-verify in railiance-cluster. This repository also carried two files both numbered 0016. Active workplans move to the successor prefix and are renumbered from 0001 in historical order. Archived workplans keep their historical identifiers. Projection UUIDs are re-derived from the new canonical ids. Records already registered under the old identifiers leave orphaned hub rows behind; that debt is recorded in CUST-WP-0068 and clears when ADR-012's reset-from-forge lands. Refs CUST-WP-0068-T03 Assistant: claude-code Assistant-Model: opus Assistant-Process: 2583210@bnt-lap001 Assistant-Session: f2bff2d5-e9b2-4338-92ca-10282a927006
110 lines
5.2 KiB
Markdown
110 lines
5.2 KiB
Markdown
---
|
|
id: RPF-WP-0017
|
|
type: workplan
|
|
title: "Contain attended OpenBao login output before authentication"
|
|
domain: financials
|
|
repo: railiance-platform
|
|
status: finished
|
|
owner: codex
|
|
topic_slug: railiance
|
|
created: "2026-08-23"
|
|
updated: "2026-08-23"
|
|
related:
|
|
- RAILIANCE-WP-0024
|
|
- WARDEN-WP-0027
|
|
- WARDEN-WP-0027-T02-DRILL-20260822-01
|
|
origin: routed
|
|
origin_ref: "State Hub message b3f34c2d-941f-4ddd-b15d-e28075446021"
|
|
state_hub_workstream_id: "b27975a7-e1bf-595e-8412-de03e167c9ed"
|
|
---
|
|
|
|
# RPF-WP-0017 — attended OpenBao login output containment
|
|
|
|
## Goal
|
|
|
|
Make the governed `openbao-platform-admin-login` path fail before OIDC unless
|
|
it can guarantee isolated private token-helper storage and contain every byte
|
|
emitted by the underlying client. A persistence or output-contract failure must
|
|
revoke any issued credential without placing its value, accessor, fingerprint,
|
|
or derived material in agent-visible output, Git, State Hub, evidence, or logs.
|
|
|
|
This workplan records the direct fix interface requested by `railiance-infra`.
|
|
It does not authorize OIDC authentication, minting, OpenBao administration, a
|
|
seal/unseal ceremony, or reuse of the terminal drill scenario.
|
|
|
|
## Ownership and fixed boundaries
|
|
|
|
- `railiance-platform` owns the login lane, acceptance contract, and any future
|
|
production rehearsal.
|
|
- `ops-warden` owns the current proxy implementation in `src/warden/cli.py`,
|
|
`src/warden/proxy.py`, and its focused tests.
|
|
- key-cape remains the OIDC/MFA identity provider; this task does not weaken or
|
|
replace MFA, change the OpenBao role, or introduce root/workload fallback.
|
|
- `railiance-infra` is the requesting reviewer and independent abort owner.
|
|
- Risk Nexus owns grading of State Hub filing request
|
|
`5a344f53-14e9-4230-8874-2f01b0a85700`.
|
|
- State Hub GO decision `449a697a-5303-4582-aa9e-b0bc8b35ab2d` was consumed by
|
|
NO-GO decision `85724c0c-e70f-4e2f-a8c6-a9cb1ea6331b`. Neither decision nor
|
|
scenario `WARDEN-WP-0027-T02-DRILL-20260822-01` may be reused.
|
|
|
|
## T01 — Harden the attended-login adapter and prove failure containment
|
|
|
|
```task
|
|
id: RPF-WP-0017-T01
|
|
status: done
|
|
priority: high
|
|
state_hub_task_id: "e2448d67-8585-5d99-9c00-20c06f1186dd"
|
|
```
|
|
|
|
Implement the fix in `ops-warden` and return one value-safe owner receipt to
|
|
`railiance-platform` and `railiance-infra` naming the source revision, focused
|
|
test command/result, and the five acceptance outcomes below. The receipt must
|
|
contain no credential, accessor, fingerprint, output excerpt, callback code,
|
|
or token-helper contents.
|
|
|
|
Acceptance is all of the following:
|
|
|
|
1. An isolated writable token-helper location is created before authentication,
|
|
has mode `0600` (with private parent directories), and is removed or revoked
|
|
through a deterministic cleanup path.
|
|
2. A read-only or otherwise unusable default home fails before OIDC begins; the
|
|
adapter never discovers persistence failure only after credential issuance.
|
|
3. Adapter-owned stdout and stderr containment guarantees that no credential
|
|
reaches agent-visible output even if the underlying CLI violates
|
|
`-no-print`. Inherited agent-visible stdio is not permitted for this lane.
|
|
4. Unexpected credential-bearing or otherwise non-allowlisted output fails
|
|
closed and, whenever issuance may have occurred, triggers immediate
|
|
self-revocation through the contained process without logging, returning,
|
|
hashing, or fingerprinting the value.
|
|
5. Focused tests cover successful attended-login handoff, unwritable/default
|
|
home refusal before authentication, helper persistence failure, unexpected
|
|
stdout, unexpected stderr, immediate revocation, cleanup, and value absence
|
|
from captured test and audit output.
|
|
|
|
The implementation must also update the `openbao-platform-admin-login` worker
|
|
playbook and catalog comment so they no longer claim safety from `-no-print`
|
|
alone. A non-production test double must prove the complete failure path before
|
|
any new live OIDC rehearsal is proposed.
|
|
|
|
Done when the implementation is committed and pushed in `ops-warden`, the
|
|
focused suite passes, the value-safe owner receipt is delivered directly to
|
|
both reviewers, and `railiance-platform` accepts the exact revision. Completion
|
|
of this task still does not authorize a live drill; that requires fresh owner
|
|
receipts, current preflight, and a new human decision under a new scenario id.
|
|
|
|
Completed 2026-08-23. Railiance Platform accepts ops-warden revision
|
|
`0fae0904ce8d8694338dd53a8a79abec5fec788d`. The committed owner receipt at
|
|
ops-warden revision `bc1966da825fbeaa4d83947a4f942b5d5f085408` has SHA-256
|
|
`d2ba444ed16989590325697e69d25283dc75a9432c29a72e627e80bf9fd987e4`,
|
|
reports 42 focused tests and 390 repository tests passing, and records all
|
|
seven containment outcomes without sensitive material. Independent
|
|
railiance-infra review at revision `186b030` approves the same implementation.
|
|
This is source acceptance only and authorizes no live OIDC or drill.
|
|
|
|
## Acceptance
|
|
|
|
- [x] The adapter refuses unsafe storage before OIDC.
|
|
- [x] No underlying login output can reach the agent transcript.
|
|
- [x] Any issued credential is contained and revoked on failure.
|
|
- [x] Focused success and failure-path tests pass without credential material.
|
|
- [x] Both direct reviewers receive and accept the value-safe fix receipt.
|