diff --git a/SCOPE.md b/SCOPE.md index f48726e..2f91f38 100644 --- a/SCOPE.md +++ b/SCOPE.md @@ -177,10 +177,17 @@ do not replace exact-action authorization or OpenBao audit logs. The CLI now has a named `service-jwt` provider that logs in through that scaffold when the platform JWT mount/role contract is present, then self-revokes the issued OpenBao token. Signature verification and token -issuance remain with the platform-owned exact-bound OpenBao JWT role, whose -mount/role contract is still outstanding. Until it is published, `--auth auto` -keeps named bootstrap/env providers and never treats them as a fallback from -service-jwt failure. +issuance stay with the platform-owned, exact-bound OpenBao JWT role +`keycape-services`/`secrets-engine-openbao` (CCR-2026-0038). Its consumer +contract is published as railiance-platform +`docs/contracts/secrets-engine-openbao-jwt-login.yaml`. The founder-run login +proof passed on 2026-10-10 (`docs/evidence/2026-10-10-keycape-openbao-probe.json`). +The role is login-only: its policy grants lookup-self, capabilities-self and +revoke-self, with no KV read and no policy/auth write. So service-jwt cannot yet +carry engine actions. `--auth auto` selects service-jwt only when +`SECRETS_ENGINE_OPENBAO_JWT_LOGIN` is set. Otherwise it keeps the named +bootstrap/env providers, and it never uses them as a fallback when service-jwt +fails. The CCR negative checks remain open under RPF-WP-0035-T02. Treat their output as operational guidance, not complete attestation for high-risk lanes. @@ -245,8 +252,8 @@ metadata. `secrets-engine wrap` implements response-wrapped operator handoff. ## Not Implemented - A service API, daemon, UI, queue, scheduler, or remote multi-user service. -- Platform JWT mount/role materialization for the implemented KeyCape - service-auth / `service-jwt` provider. +- Engine-action authority for the `service-jwt` identity. The platform JWT + role is login-only, and its CCR negative checks (RPF-WP-0035-T02) are open. - Provider-side / workload consumer rotation. Overlay lane state is local and non-secret only; it is not an OpenBao-side state machine. - Protocol step 1 in production: approval-engine does not yet serve the @@ -341,7 +348,7 @@ Working companion: `net-kingdom/SECURITY-COMPANION.md`. | Evidence bound | `evidence-classification.yaml`; load-bearing local outbox; heartbeat command | Drain to `audit-core` once that sender is admitted | | SSH-CA surface | Contract at `docs/ssh-ca-signing-contract.md`; not shipped | Engine API after ops-warden assent | | Secret-use evidence | Contract at `docs/secret-use-evidence-contract.md`; not shipped | Engine surface after kings-guard assent | -| Agent credential | Bootstrap token file still accepted; KeyCape scaffold unwired to OpenBao | Per-task, time-bounded service identity; no standing engine credential | +| Agent credential | Bootstrap token file still accepted; service-JWT OpenBao login proven (login-only role, 2026-10-10) | Per-task, time-bounded service identity; no standing engine credential | ## Where Current Work Lives diff --git a/WORK-RECORDS.md b/WORK-RECORDS.md index 41ff5e5..0ed981a 100644 --- a/WORK-RECORDS.md +++ b/WORK-RECORDS.md @@ -20,7 +20,7 @@ | workplan | SECRETS-WP-0009 | blocked | — | workplans/SECRETS-WP-0009-glas-claude-native-delivery.md | | workplan | SECRETS-WP-0010 | finished | — | workplans/SECRETS-WP-0010-openrouter-native-access.md | | workplan | SECRETS-WP-0011 | finished | — | workplans/SECRETS-WP-0011-multi-lane-exec-owner-delivery.md | -| workplan | SECRETS-WP-0012 | blocked | — | workplans/SECRETS-WP-0012-keycape-openbao-consumer-custody.md | +| workplan | SECRETS-WP-0012 | finished | — | workplans/SECRETS-WP-0012-keycape-openbao-consumer-custody.md | | task | SECRETS-WP-ADHOC-2026-08-21-T01 | done | — | workplans/ADHOC-2026-08-21.md | | task | SECRETS-WP-ADHOC-2026-08-23-T01 | done | — | workplans/ADHOC-2026-08-23.md | | task | SECRETS-WP-0001-T01 | done | — | workplans/SECRETS-WP-0001-statehub-bootstrap.md | @@ -80,7 +80,7 @@ | task | SECRETS-WP-0011-T05 | done | — | workplans/SECRETS-WP-0011-multi-lane-exec-owner-delivery.md | | task | SECRETS-WP-0012-T01 | done | — | workplans/SECRETS-WP-0012-keycape-openbao-consumer-custody.md | | task | SECRETS-WP-0012-T02 | cancel | — | workplans/SECRETS-WP-0012-keycape-openbao-consumer-custody.md | -| task | SECRETS-WP-0012-T03 | wait | — | workplans/SECRETS-WP-0012-keycape-openbao-consumer-custody.md | +| task | SECRETS-WP-0012-T03 | done | — | workplans/SECRETS-WP-0012-keycape-openbao-consumer-custody.md | | task | SECRETS-WP-0012-T04 | done | — | workplans/SECRETS-WP-0012-keycape-openbao-consumer-custody.md | | intake | SECRETS-IN-0001 | closed | — | intakes/intakes.md | | intake | SECRETS-IN-0002 | closed | — | intakes/intakes.md | diff --git a/docs/keycape-openbao-consumer-custody.md b/docs/keycape-openbao-consumer-custody.md index 74d4d94..2452ff6 100644 --- a/docs/keycape-openbao-consumer-custody.md +++ b/docs/keycape-openbao-consumer-custody.md @@ -84,8 +84,11 @@ YAML ) ``` -This file is the probe's input, not the platform's publication. railiance-platform -replaces or confirms it after the proof passes. +The proof passed on 2026-10-10 +(`docs/evidence/2026-10-10-keycape-openbao-probe.json`). railiance-platform then +published the consumer contract as `docs/contracts/secrets-engine-openbao-jwt-login.yaml` +(21b8af3). That contract is identical to this probe input, so the local file +stays as it is. ```bash cd /home/worsch/secrets-engine && \ diff --git a/layer.yaml b/layer.yaml index 2ba81d3..6912e18 100644 --- a/layer.yaml +++ b/layer.yaml @@ -164,8 +164,9 @@ non_tooling_clients: key-cape is catalogued Tooling. The consumer exchanges a service JWT and logs in only when SECRETS_ENGINE_OPENBAO_JWT_LOGIN names a published mount/role contract. Failure never falls back to bootstrap or BAO_TOKEN. - The platform-owned role remains unpublished, so auto still uses the - named bootstrap/env providers. + The platform role is applied and its contract is published (CCR-2026-0038, + railiance-platform 21b8af3). Login was proven on 2026-10-10, but the role + is login-only, so engine actions still use the named bootstrap/env providers. - id: audit-core-outbox-drain target: audit-core