e8e71191d8
Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a02b90-83bf-75c2-81c8-aa705414e4d4
110 lines
5.2 KiB
Markdown
110 lines
5.2 KiB
Markdown
---
|
|
id: RAILIANCE-WP-0026
|
|
type: workplan
|
|
title: "Contain attended OpenBao login output before authentication"
|
|
domain: financials
|
|
repo: railiance-platform
|
|
status: finished
|
|
owner: codex
|
|
topic_slug: railiance
|
|
created: "2026-08-23"
|
|
updated: "2026-08-23"
|
|
related:
|
|
- RAILIANCE-WP-0024
|
|
- WARDEN-WP-0027
|
|
- WARDEN-WP-0027-T02-DRILL-20260822-01
|
|
origin: routed
|
|
origin_ref: "State Hub message b3f34c2d-941f-4ddd-b15d-e28075446021"
|
|
state_hub_workstream_id: "73878f8d-d8bb-5845-8a5c-91cdd83c1066"
|
|
---
|
|
|
|
# RAILIANCE-WP-0026 — attended OpenBao login output containment
|
|
|
|
## Goal
|
|
|
|
Make the governed `openbao-platform-admin-login` path fail before OIDC unless
|
|
it can guarantee isolated private token-helper storage and contain every byte
|
|
emitted by the underlying client. A persistence or output-contract failure must
|
|
revoke any issued credential without placing its value, accessor, fingerprint,
|
|
or derived material in agent-visible output, Git, State Hub, evidence, or logs.
|
|
|
|
This workplan records the direct fix interface requested by `railiance-infra`.
|
|
It does not authorize OIDC authentication, minting, OpenBao administration, a
|
|
seal/unseal ceremony, or reuse of the terminal drill scenario.
|
|
|
|
## Ownership and fixed boundaries
|
|
|
|
- `railiance-platform` owns the login lane, acceptance contract, and any future
|
|
production rehearsal.
|
|
- `ops-warden` owns the current proxy implementation in `src/warden/cli.py`,
|
|
`src/warden/proxy.py`, and its focused tests.
|
|
- key-cape remains the OIDC/MFA identity provider; this task does not weaken or
|
|
replace MFA, change the OpenBao role, or introduce root/workload fallback.
|
|
- `railiance-infra` is the requesting reviewer and independent abort owner.
|
|
- Risk Nexus owns grading of State Hub filing request
|
|
`5a344f53-14e9-4230-8874-2f01b0a85700`.
|
|
- State Hub GO decision `449a697a-5303-4582-aa9e-b0bc8b35ab2d` was consumed by
|
|
NO-GO decision `85724c0c-e70f-4e2f-a8c6-a9cb1ea6331b`. Neither decision nor
|
|
scenario `WARDEN-WP-0027-T02-DRILL-20260822-01` may be reused.
|
|
|
|
## T01 — Harden the attended-login adapter and prove failure containment
|
|
|
|
```task
|
|
id: RAILIANCE-WP-0026-T01
|
|
status: done
|
|
priority: high
|
|
state_hub_task_id: "3c302542-f637-5130-9cd1-5c55fbf109eb"
|
|
```
|
|
|
|
Implement the fix in `ops-warden` and return one value-safe owner receipt to
|
|
`railiance-platform` and `railiance-infra` naming the source revision, focused
|
|
test command/result, and the five acceptance outcomes below. The receipt must
|
|
contain no credential, accessor, fingerprint, output excerpt, callback code,
|
|
or token-helper contents.
|
|
|
|
Acceptance is all of the following:
|
|
|
|
1. An isolated writable token-helper location is created before authentication,
|
|
has mode `0600` (with private parent directories), and is removed or revoked
|
|
through a deterministic cleanup path.
|
|
2. A read-only or otherwise unusable default home fails before OIDC begins; the
|
|
adapter never discovers persistence failure only after credential issuance.
|
|
3. Adapter-owned stdout and stderr containment guarantees that no credential
|
|
reaches agent-visible output even if the underlying CLI violates
|
|
`-no-print`. Inherited agent-visible stdio is not permitted for this lane.
|
|
4. Unexpected credential-bearing or otherwise non-allowlisted output fails
|
|
closed and, whenever issuance may have occurred, triggers immediate
|
|
self-revocation through the contained process without logging, returning,
|
|
hashing, or fingerprinting the value.
|
|
5. Focused tests cover successful attended-login handoff, unwritable/default
|
|
home refusal before authentication, helper persistence failure, unexpected
|
|
stdout, unexpected stderr, immediate revocation, cleanup, and value absence
|
|
from captured test and audit output.
|
|
|
|
The implementation must also update the `openbao-platform-admin-login` worker
|
|
playbook and catalog comment so they no longer claim safety from `-no-print`
|
|
alone. A non-production test double must prove the complete failure path before
|
|
any new live OIDC rehearsal is proposed.
|
|
|
|
Done when the implementation is committed and pushed in `ops-warden`, the
|
|
focused suite passes, the value-safe owner receipt is delivered directly to
|
|
both reviewers, and `railiance-platform` accepts the exact revision. Completion
|
|
of this task still does not authorize a live drill; that requires fresh owner
|
|
receipts, current preflight, and a new human decision under a new scenario id.
|
|
|
|
Completed 2026-08-23. Railiance Platform accepts ops-warden revision
|
|
`0fae0904ce8d8694338dd53a8a79abec5fec788d`. The committed owner receipt at
|
|
ops-warden revision `bc1966da825fbeaa4d83947a4f942b5d5f085408` has SHA-256
|
|
`d2ba444ed16989590325697e69d25283dc75a9432c29a72e627e80bf9fd987e4`,
|
|
reports 42 focused tests and 390 repository tests passing, and records all
|
|
seven containment outcomes without sensitive material. Independent
|
|
railiance-infra review at revision `186b030` approves the same implementation.
|
|
This is source acceptance only and authorizes no live OIDC or drill.
|
|
|
|
## Acceptance
|
|
|
|
- [x] The adapter refuses unsafe storage before OIDC.
|
|
- [x] No underlying login output can reach the agent transcript.
|
|
- [x] Any issued credential is contained and revoked on failure.
|
|
- [x] Focused success and failure-path tests pass without credential material.
|
|
- [x] Both direct reviewers receive and accept the value-safe fix receipt.
|