docs(recovery): deliver isolated original consumer custody plan
Assistant: codex Assistant-Model: gpt-6.1-sol Assistant-Session: 01a1468b-63fa-7710-85dc-8f2e16b3ebfa
This commit is contained in:
parent
c59bbf568c
commit
691dc74236
2 changed files with 130 additions and 15 deletions
99
docs/keycape-isolated-consumer-continuity-plan.md
Normal file
99
docs/keycape-isolated-consumer-continuity-plan.md
Normal file
|
|
@ -0,0 +1,99 @@
|
|||
# Original KeyCape isolated consumer continuity plan
|
||||
|
||||
Owner: secrets-engine. Source outcome: SECRETS-WP-0015-T03, 2026-10-17.
|
||||
This is a reviewed source plan, not native assent, a custody grant or an
|
||||
executed recovery. T04 remains a human wait on the complete NK49T33 attempt.
|
||||
|
||||
The [frozen owner packet](../../the-custodian/docs/changes/netkingdom-target-2026-10-17/consumer-outage-r1/OWNER-PLAN.md)
|
||||
contains the exact custody/command/negative/equality/timeout/abort plan and source
|
||||
references. Its owner-plan SHA-256 is
|
||||
`sha256:d358aaeedc18c42c591d3301ec34f493e63bf579bf5a17b6ccc7e32ec88ea8ed`.
|
||||
The packet remains immutable; this source note does not revise its authority.
|
||||
|
||||
## Exact original selector and source
|
||||
|
||||
Use the existing [public selector](keycape-recovery-selector.json): issuer
|
||||
`https://kc.coulomb.social`, client/audience `secrets-engine-openbao`, env name
|
||||
`KEYCAPE_SECRETS_ENGINE_OPENBAO_CLIENT_SECRET`, subject
|
||||
`service:secrets-engine`, tenant `tenant:platform`, exactly role
|
||||
`secrets-engine`, scope `openbao:login`, denied scope `openbao:admin`.
|
||||
The current consumer `service_auth.py` source SHA-256 is
|
||||
`sha256:c0ade429edf452ad17f05d690b7ebef091db7f1a42b5ac350f1e40955c8586c0`.
|
||||
Its existing AST-only selector preflight passes at that exact hash. Historical
|
||||
issuer/consumer successes predate the archive and retain their historical scope.
|
||||
|
||||
The packet's [one-shot observer candidate](../../the-custodian/docs/changes/netkingdom-target-2026-10-17/consumer-outage-r1/consumer_contract_observer.py)
|
||||
is `sha256:23467730be61625d53b34c09e62f737a35e3def10d22a3a64664835961d3f4bd`.
|
||||
Its frozen four-file consumer-source manifest is
|
||||
`sha256:5b0409d7141514295e7d0f636ff6fa5dbe9d1f0d4d23b2f9ebce84a174d69499`.
|
||||
The observer remains a source candidate: it was tested with synthetic unsigned
|
||||
tokens only and is not installed, invoked on real material, or wired into either
|
||||
NK49 recovery or ordinary consumer authentication. Five synthetic tests pass;
|
||||
seven parser-negative variants and source/input refusal checks are within those
|
||||
tests, not extra native successes.
|
||||
|
||||
## Claims and custody boundaries
|
||||
|
||||
1. **Original issuer:** the existing frozen NK49 native checker binds the
|
||||
original archived registration/env, original TLS/trust/JWKS, wrong-secret and
|
||||
excess-scope refusal, and exact original config/registry/policy/receipt
|
||||
equality. Its receipt keeps downstream consumer reconnect false.
|
||||
2. **Consumer claim compatibility:** after a newly reviewed NK49 source/admission
|
||||
closure, the existing issuer `service-token` command may mint a short-lived
|
||||
original-identity token in the issuer's private tmpfs. A reviewed same-session
|
||||
wrapper would hand only that bounded token object over private stdin to the
|
||||
exact Secrets claim observer, then prove transient-token/resource cleanup.
|
||||
The original client secret stays in the restored issuer environment. Native
|
||||
issuer/JWKS verification precedes consumer parsing; the observer verifies no
|
||||
signature or native provenance. This proposed callback is not implemented.
|
||||
3. **Full original OpenBao consumer continuity:** requires Platform/rapp-openbao's
|
||||
independently recovered original backend/custody, original KV registration,
|
||||
narrow OIDC source role and actual operator authentication/MFA dependencies,
|
||||
plus exact isolated routing/trust. NK49's identity archive does not supply
|
||||
OpenBao Raft recovery. A fresh backend, production login or injected secret
|
||||
cannot substitute for this return. Then use the unchanged ordinary attended
|
||||
OpenBao in-memory secret source, KeyCape exchange, actual OpenBao JWT login
|
||||
and definite operator/engine session revocation.
|
||||
|
||||
The current no-file/no-fallback direction remains. Do not inject the recovered
|
||||
issuer secret into ordinary `login_service_jwt`, create a persistent consumer
|
||||
copy, use ambient/bootstrap credentials, or redirect production. An exceptional
|
||||
source would need a separate explicit owner/founder custody decision; none is
|
||||
proposed or implemented here. Service identity/login-only policy is not protected
|
||||
backend execution authority. SECRETS-WP-0008-T06/0013 retain those scopes;
|
||||
finished SECRETS-WP-0012 remains finished.
|
||||
|
||||
## Actual acceptance and next owner action
|
||||
|
||||
The next action is to assemble NK49T33's exact owner-held original TLS/archive/
|
||||
private-admission packet and surviving offline founder authorization before any
|
||||
key prompt. Matching hashes, possession of an archive key, this workplan and
|
||||
historical CCRs are not that authorization. Bind exact source/image/executor,
|
||||
original issuer/case/target, deadline and permitted isolated effects in the
|
||||
existing supervised recovery process. No new auth or approval service is needed.
|
||||
|
||||
Keep original ciphertext/transfer/source/binary/trust and manifest-binding-mode
|
||||
interfaces. Private manifests and equality hashes stay inside custody. Freeze any
|
||||
new observer callback/dependency closure, native command count and phase-specific
|
||||
negative parsing; its source/synthetic lifecycle review must precede real input.
|
||||
Use the existing bounded NK49 execution, exact pidfd/session quiescence and
|
||||
registered tmpfs/container cleanup. Abort on unknown provenance, changed original
|
||||
bytes, ambiguous daemon action or incomplete cleanup; preserve failed receipts
|
||||
and uncertainty rather than retrying or reinitializing state.
|
||||
|
||||
Require an actual positive original-issuer token and exact consumer claims,
|
||||
including no extra roles. Native wrong-expected-audience/required-role refusals
|
||||
are verifier checks, not OpenBao authorization. The observer's seven deliberately
|
||||
modified payloads prove parser refusal only; unsigned mutations prove no signed
|
||||
claim denial. Full backend acceptance separately requires real resource-server
|
||||
wrong-audience/scope/role refusal, restored policy/role/KV equality and session
|
||||
revocation through the existing owner path. Missing original signed negative
|
||||
cases stay missing; do not create grants or claim signature failure isolates a
|
||||
particular claim. A fresh attempt token is not a preserved pre-outage token.
|
||||
|
||||
T04 remains wait/needs_human, depends on T03 and NK-WP-0049-T33, and retains
|
||||
actual native acceptance. T18 owns actual selected-consumer recovery; T19 owns
|
||||
retained-factor MFA. Return separate closed issuer/consumer-contract/backend
|
||||
receipts tied to one attempt. Export source/public signing/TLS hashes, allowed
|
||||
identifiers, booleans and cleanup facts only; never secret/token/private manifest
|
||||
or raw provider output. A human wait is not an automatic worker wakeup.
|
||||
|
|
@ -4,7 +4,7 @@ type: workplan
|
|||
title: "Prepare original KeyCape service selector and isolated consumer continuity"
|
||||
domain: infotech
|
||||
repo: secrets-engine
|
||||
status: ready
|
||||
status: active
|
||||
owner: codex
|
||||
topic_slug: custodian
|
||||
created: "2026-10-17"
|
||||
|
|
@ -17,8 +17,9 @@ state_hub_workstream_id: "68a0642e-4908-5260-89c9-3adce60e6a4d"
|
|||
|
||||
Needed source-owner work for NK-WP-0049-T36/T18. Reviewed against current
|
||||
Lifecycle INTENT, explicit consumer constants/custody source and dated historical
|
||||
proof. Ready means work can proceed, not native assent. Finished0012 remains
|
||||
finished; functional adoption/backend entitlement stay0008T06/0013. No new grant,
|
||||
proof. Active records the delivered source plan and remaining native owner wait;
|
||||
it is not native assent. Finished0012 remains finished; functional adoption/backend
|
||||
entitlement stay0008T06/0013. No new grant,
|
||||
secret fetch, provider login, production redirect or external message occurred.
|
||||
|
||||
## Establish exact current intended source selector
|
||||
|
|
@ -61,22 +62,37 @@ is source correspondence, not native acceptance or a new secret source.
|
|||
|
||||
```task
|
||||
id: SECRETS-WP-0015-T03
|
||||
status: todo
|
||||
status: done
|
||||
priority: high
|
||||
assignee: codex
|
||||
state_hub_task_id: "6262a915-7655-50be-b9f7-481f816d7335"
|
||||
```
|
||||
|
||||
Next: map the exact original archive-delivered registration and producer-native
|
||||
checker result to the intended consumer, then prepare a source-reviewed isolated
|
||||
proof/custody plan. Current consumer source requires attended OpenBao memory read
|
||||
and refuses files; ordinary OpenBao/KeyCape outage is therefore a real dependency.
|
||||
Do not add a fallback, persistent consumer copy or unreviewed injection source.
|
||||
Clarify which continuity claim can be proved offline and which requires an exact
|
||||
accepted owner custody/provider path. Bind current original selectors, image/
|
||||
source/TLS metadata, negative cases, timeout/abort and cleanup; retain protected
|
||||
backend operation entitlement in existing0008/0013. Done when that exact plan and
|
||||
remaining owner dependencies are reviewable, without retrieving any value.
|
||||
Completed 2026-10-17 as source-plan preparation only. The reviewed owner plan
|
||||
is [keycape-isolated-consumer-continuity-plan.md](../docs/keycape-isolated-consumer-continuity-plan.md),
|
||||
bound to the frozen Custodian `consumer-outage-r1` packet. It distinguishes the
|
||||
restored original issuer check, exact Secrets consumer claim compatibility and
|
||||
actual original OpenBao consumer continuity, preserving the no-file/no-fallback
|
||||
client-secret source contract. Offline founder authority, original TLS/private
|
||||
admission, exact source/runtime/receipt interfaces, positive/negative/equality
|
||||
oracles, timeout, abort and cleanup requirements are reviewable. The plan's done
|
||||
criterion is met; no native or private custody dependency is represented as done.
|
||||
|
||||
The packet includes an unexecuted-on-real-input one-shot claim observer candidate;
|
||||
it is not wired into recovery or ordinary service authentication. Five synthetic
|
||||
tests pass, including seven explicitly noncryptographic claim-parser negatives
|
||||
and source/input refusal checks. The existing exact-source selector preflight
|
||||
passes. These source checks establish neither token signature/native provenance
|
||||
nor client-secret acquisition, OpenBao login, backend entitlement or downstream
|
||||
reconnect. No private archive, original token/key, OpenBao endpoint or native
|
||||
approval was accessed. Source integration/publication/projection are separate
|
||||
coordinator follow-through; the immutable packet retains source hashes and limits.
|
||||
|
||||
Remaining actual owner dependencies are explicit in the plan and T04: NK49T33
|
||||
complete original TLS/archive/private admission; an independently recovered
|
||||
original OpenBao and its custody/OIDC/MFA graph for full consumer continuity;
|
||||
exact native action approval and resource-server negative/revocation receipts.
|
||||
Protected backend operation entitlement stays in existing0008T06/0013.
|
||||
|
||||
## Verify the separately admitted actual isolated consumer result
|
||||
|
||||
|
|
@ -87,7 +103,7 @@ priority: high
|
|||
assignee: codex
|
||||
needs_human: true
|
||||
depends_on: [SECRETS-WP-0015-T03, NK-WP-0049-T33]
|
||||
blocking_reason: "Await exact consumer proof/custody plan plus original TLS/private admission readiness; actual attended owner path/authority remains required."
|
||||
blocking_reason: "Source plan delivered in T03. Await NK-WP-0049-T33 original TLS/archive/private admission, exact native owner authority, and original OpenBao/custody recovery for actual consumer continuity."
|
||||
state_hub_task_id: "aeec6eb0-39e2-5f7c-8f5d-778133edfc73"
|
||||
```
|
||||
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue