codex
ea2e9ec97d
These workplans exist only in the retired local hub. Their random pre-ADR-007 identifiers are refused by C-06 as stale references, so they cannot be registered. Deriving from the canonical record id takes no identity from anything: central does not hold them and the old ids die with the cache. Records central already holds were deliberately left untouched. Refs CUST-WP-0068-T06 Assistant: claude-code Assistant-Model: opus Assistant-Process: 2583210@bnt-lap001 Assistant-Session: f2bff2d5-e9b2-4338-92ca-10282a927006
165 lines
6.3 KiB
Markdown
165 lines
6.3 KiB
Markdown
---
|
|
id: RAILIANCE-WP-0022
|
|
type: workplan
|
|
title: "Close agent high-risk OpenBao boundary coverage"
|
|
domain: financials
|
|
repo: railiance-platform
|
|
status: finished
|
|
owner: codex
|
|
topic_slug: railiance
|
|
created: "2026-08-21"
|
|
updated: "2026-08-22"
|
|
related:
|
|
- WARDEN-WP-0032
|
|
- RISK-F-0009
|
|
origin: routed
|
|
origin_ref: "State Hub message 828e4903-30fe-4903-acfd-cd2ecdda437d"
|
|
state_hub_workstream_id: "a7977cbf-ab43-56b7-b7a9-ceb52382b341"
|
|
---
|
|
|
|
# RAILIANCE-WP-0022 — Agent high-risk boundary coverage
|
|
|
|
## Goal
|
|
|
|
Make the OpenBao `agent-high-risk-boundary` deny every concrete high-risk KV
|
|
data path in the ops-warden routing catalog, verify the deployed policy, and
|
|
establish whether any agent identity actually carries the boundary.
|
|
|
|
## Boundaries
|
|
|
|
- Read policy documents, token-role metadata and capabilities only; never read
|
|
a Secret value.
|
|
- A deny is added only for a concrete catalog path graded `risk: high`.
|
|
- Pattern-only and non-KV lanes are reported but do not produce invented paths.
|
|
- Operator identities do not receive this boundary; it is for coding-agent
|
|
identities where deny must override any coincident workload read policy.
|
|
|
|
## T01 — Reconcile catalog coverage
|
|
|
|
```task
|
|
id: RAILIANCE-WP-0022-T01
|
|
status: done
|
|
priority: high
|
|
state_hub_task_id: "15cc7f31-4385-500c-9cf9-b356674d8c89"
|
|
```
|
|
|
|
Run the capabilities-only ops-warden audit against the policy. The initial
|
|
2026-08-21 reconciliation found 17 high-risk lanes: six covered, six concrete
|
|
uncovered, and five without a concrete KV address. The final generated input
|
|
contains 19 high-risk lanes, 14 concrete entries, and five without an address.
|
|
No credential value was read.
|
|
|
|
## T02 — Close the concrete deny gaps
|
|
|
|
```task
|
|
id: RAILIANCE-WP-0022-T02
|
|
status: done
|
|
priority: high
|
|
state_hub_task_id: "08041e2d-c65e-5977-a4db-82c85ab17d02"
|
|
```
|
|
|
|
Add deny-data/read-metadata pairs for the six catalog paths: whynot-design npm,
|
|
rapp-qonto Keycape client, agent-harness Forgejo deploy key, audit-core senders,
|
|
email-connect transactional, and Scaleway bootstrap. Add regression coverage
|
|
for every concrete path currently emitted by the catalog audit.
|
|
|
|
Completed 2026-08-22. After ops-warden corrected two multi-field grades, the
|
|
source policy covers all 13 unique concrete catalog paths plus the additional
|
|
reviewed Core Hub path. The generated-input check reports all 14 concrete
|
|
catalog entries covered with none uncovered.
|
|
|
|
## T03 — Apply and verify live
|
|
|
|
```task
|
|
id: RAILIANCE-WP-0022-T03
|
|
status: done
|
|
priority: high
|
|
state_hub_task_id: "021b5c1a-a3fe-510a-93d9-89cd0adb632e"
|
|
```
|
|
|
|
Under attended platform authority, upload the reviewed policy, read it back,
|
|
and rerun the catalog audit with `policy_source: server`. Inspect policy/token
|
|
role metadata to determine whether an agent identity carries the boundary and
|
|
whether any role combines it with a workload-read policy. Do not mint a token.
|
|
|
|
Completed initially on 2026-08-21 and reconciled again on 2026-08-22 under
|
|
attended `platform-admin` OIDC. OpenBao accepted the policy; normalized
|
|
readback matched source, and the final server-backed audit reported 19
|
|
high-risk lanes, 14 covered entries, zero uncovered, and five pattern/non-KV
|
|
lanes without a concrete address. No Secret value was read.
|
|
|
|
## T04 — Route the result
|
|
|
|
```task
|
|
id: RAILIANCE-WP-0022-T04
|
|
status: done
|
|
priority: medium
|
|
state_hub_task_id: "96952dd8-0aa7-5498-82a9-b35d47d94694"
|
|
```
|
|
|
|
Reply to ops-warden with the deployment evidence and remaining attachment
|
|
finding. Request a generated, versioned concrete-deny artifact so future policy
|
|
updates consume catalog output rather than relying on a hand-maintained list.
|
|
|
|
Completed 2026-08-21 via State Hub message
|
|
`fe727451-163a-4e14-8ce3-187fea8ce5b3`, including live audit counts, the zero-
|
|
attachment finding, the distinct-agent-identity blocker, and the requested
|
|
versioned generated artifact shape.
|
|
|
|
Ops-warden delivered revision `55f0f47a021375b8b25c924953d1b49a24e002c5`
|
|
on 2026-08-21. The platform now vendors it as a checked policy input and has a
|
|
repeatable upstream-equality plus policy-coverage command.
|
|
|
|
## T05 — Establish a distinct coding-agent identity
|
|
|
|
```task
|
|
id: RAILIANCE-WP-0022-T05
|
|
status: done
|
|
priority: high
|
|
state_hub_task_id: "6f034ee3-bbf0-5cbb-bbd2-bb5e9eea6d5d"
|
|
```
|
|
|
|
The policy is live but no role attaches it. Do not add the boundary to
|
|
`platform-admin`: that is an attended human/operator role whose legitimate
|
|
recovery work may require the protected values. The identity owner must define
|
|
a distinct coding-agent issuance path, attach this boundary there, and prove
|
|
deny-wins behavior when combined with an otherwise readable workload policy.
|
|
Completed 2026-08-22. State Hub decision
|
|
`f0955252-7b20-4c80-86e9-f8080ec60793` establishes the platform-owned AppRole
|
|
`coding-agent-railiance-platform` as the operational machine identity. Its
|
|
single-use SecretIDs expire after five minutes; its tokens last at most 15
|
|
minutes, have eight uses, omit the default policy, and attach both
|
|
`agent-high-risk-boundary` and the otherwise-readable issue-core workload
|
|
policy. A live ephemeral login proved data capabilities resolve to `deny` and
|
|
metadata to `read`; the token was revoked without reading the KV value.
|
|
|
|
The exact-bound KeyCape JWT role is also live as the issuer-backed migration
|
|
target. KeyCape principal registration remains an identity hardening follow-up,
|
|
not a blocker to the active AppRole boundary.
|
|
|
|
## T06 — Consume the generated catalog artifact
|
|
|
|
```task
|
|
id: RAILIANCE-WP-0022-T06
|
|
status: done
|
|
priority: high
|
|
state_hub_task_id: "3e7bf3f0-10b9-55f8-8393-54158b88542f"
|
|
```
|
|
|
|
|
|
Consume ops-warden's versioned `high-risk-data-paths.yaml` as a policy-check
|
|
input, add the two newly regraded issue-core and reuse-surface paths, and rerun
|
|
source plus live coverage. The input remains ops-warden's risk statement, not
|
|
the policy authority; railiance-platform continues to own every deny decision.
|
|
|
|
Completed 2026-08-22. The vendored input matches the clean upstream artifact,
|
|
the repository check covers all 14 entries, and the server-backed audit reports
|
|
zero uncovered. Evidence: `docs/evidence/agent-high-risk-boundary-2026-08-21.md`.
|
|
|
|
## Acceptance
|
|
|
|
- [x] Every concrete high-risk catalog path is denied in the source policy.
|
|
- [x] The live policy matches source and the server-backed audit passes.
|
|
- [x] A distinct AppRole attachment is established from live metadata.
|
|
- [x] Result and generated-artifact follow-up are routed to ops-warden.
|
|
- [x] A distinct coding-agent identity actually attaches the boundary.
|