coulomb/secrets-engine
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

evidence(service-jwt): attended CCR-2026-0038 boundary check passed
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 2s
Details

Browse source 
Founder-authorized attended run of tools/verify_service_jwt_boundary.py
--execute: exact self policy, capabilities-self deny on all five paths, service
and operator revocation succeeded. Claim negatives, expiry/use and adoption
remain open in SECRETS-WP-0008-T06.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 17890@bnt-lap001
Assistant-Session: 7d96d43c-0154-4a22-af71-71c349ac6dc3
This commit is contained in:
tegwick 2026-10-21 20:54:32 +02:00
parent 0d4f4b5cc2
commit 745ad146b5
2 changed files with 58 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

49
docs/evidence/2026-10-21-service-jwt-boundary.json Normal file
View file

@ -0,0 +1,49 @@
{
"status": "passed",
"phase": "attended_boundary_verification",
"task": "SECRETS-WP-0008-T06",
"serves": "RPF-WP-0035-T02 (CCR-2026-0038 effective policy and capabilities-self denials)",
"observed_at": "2026-10-21",
"operator": "founder (attended, KeyCape OIDC login with MFA)",
"authorization": "founder authorized the attended boundary run in session on 2026-10-21",
"command": "tools/verify_service_jwt_boundary.py --ccr <railiance-platform>/credential-change-requests/CCR-2026-0038-secrets-engine-service-jwt-login.yaml --execute",
"tool_commit": "4378ec1",
"bao_addr": "http://127.0.0.1:18200",
"result": {
"auth_provider": "service-jwt",
"capability_denials": {
"auth/*/role/*": true,
"auth/token/create": true,
"platform/data/workloads/keycape/secrets-engine-openbao": true,
"platform/metadata/workloads/keycape/secrets-engine-openbao": true,
"sys/policies/acl/*": true
},
"ccr_sha256": "65b2cfb772623da59c351033ab4eb2ec7adfbd109778e787c7fe1b0e185a3bc0",
"claim_negatives_proved": false,
"contract_sha256": "a98663c316611c4b2773f197c734befb8446e8efe20f563da018c358c3b11d77",
"denied_paths": [
"platform/data/workloads/keycape/secrets-engine-openbao",
"platform/metadata/workloads/keycape/secrets-engine-openbao",
"sys/policies/acl/*",
"auth/*/role/*",
"auth/token/create"
],
"established": true,
"exact_self_policy": true,
"expected_policy": "secrets-engine-login-self",
"native_verified": true,
"operator_revocation_attempted": true,
"operator_revocation_succeeded": true,
"operator_session_handle": "30835a05b52b",
"protected_operation_adoption_proved": false,
"revocation_attempted": true,
"revocation_succeeded": true,
"secret_source": "openbao-oidc-in-memory",
"session_handle": "d8a4b397fa4d"
},
"notes": [
"Two service-token metadata requests (lookup-self, one batched capabilities-self), then unconditional service and operator revocation.",
"Output is restricted to hashes, booleans and 12-hex session fingerprints; no response bodies, tokens or values were recorded.",
"Not proved here: native KeyCape claim negatives (KEY-WP-0039-T02), token expiry/use exhaustion, and protected-operation adoption."
]
}

10
workplans/SECRETS-WP-0008-layer-model-lifecycle-conformance.md
View file

@ -332,11 +332,19 @@ Acceptance:
id: SECRETS-WP-0008-T06
status: wait
depends_on: [RPF-WP-0035-T02]
blocking_reason: "Published JWT contract and positive login/revocation are delivered. Native KEY-WP-0039-T02 claim negatives, CCR-2026-0038 effective-policy/capability/expiry/use checks and MASON-WP-0009-T05 remain. Login-self-only grants no protected-operation authority: agree and implement separately reviewed task-scoped backend execution entitlement, then prove functional steady-state service-identity adoption without bootstrap/env fallback."
blocking_reason: "Published JWT contract and positive login/revocation are delivered. Native KEY-WP-0039-T02 claim negatives, CCR-2026-0038 expiry/use checks (effective-policy/capability passed 2026-10-21) and MASON-WP-0009-T05 remain. Login-self-only grants no protected-operation authority: agree and implement separately reviewed task-scoped backend execution entitlement, then prove functional steady-state service-identity adoption without bootstrap/env fallback."
priority: medium
state_hub_task_id: "d7bc8bdc-a0f8-5058-a640-374ef9859148"
```
Progress 2026-10-21. The founder authorized the CCR-2026-0038 boundary check, and it
passed attended (`docs/evidence/2026-10-21-service-jwt-boundary.json`). The self policy
is exactly `secrets-engine-login-self` with no identity policies. capabilities-self
denies both client-secret guard paths, `sys/policies/acl/*`, `auth/*/role/*` and
`auth/token/create`. Service and operator revocation both succeeded. The receipt went
to railiance-platform for RPF-WP-0035-T02. Still open: KEY-WP-0039-T02 claim negatives,
expiry/use exhaustion, MASON-WP-0009-T05, and task-scoped execution entitlement.
Progress 2026-10-10. The CCR-2026-0038 no-fallback check, which is
secrets-engine's to prove, passed. Fixing it exposed a gap: the anonymous JWT
login inherited `BAO_TOKEN`/`VAULT_TOKEN` and the CLI token helper, so it sent an