coulomb/secrets-engine
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

evidence(service-jwt): attended CCR-2026-0038 boundary check passed
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 2s
Details

Browse source 
Founder-authorized attended run of tools/verify_service_jwt_boundary.py
--execute: exact self policy, capabilities-self deny on all five paths, service
and operator revocation succeeded. Claim negatives, expiry/use and adoption
remain open in SECRETS-WP-0008-T06.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 17890@bnt-lap001
Assistant-Session: 7d96d43c-0154-4a22-af71-71c349ac6dc3
This commit is contained in:
tegwick 2026-10-21 20:54:32 +02:00
parent 0d4f4b5cc2
commit 745ad146b5
2 changed files with 58 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

10
workplans/SECRETS-WP-0008-layer-model-lifecycle-conformance.md
View file

@ -332,11 +332,19 @@ Acceptance:
id: SECRETS-WP-0008-T06
status: wait
depends_on: [RPF-WP-0035-T02]
blocking_reason: "Published JWT contract and positive login/revocation are delivered. Native KEY-WP-0039-T02 claim negatives, CCR-2026-0038 effective-policy/capability/expiry/use checks and MASON-WP-0009-T05 remain. Login-self-only grants no protected-operation authority: agree and implement separately reviewed task-scoped backend execution entitlement, then prove functional steady-state service-identity adoption without bootstrap/env fallback."
blocking_reason: "Published JWT contract and positive login/revocation are delivered. Native KEY-WP-0039-T02 claim negatives, CCR-2026-0038 expiry/use checks (effective-policy/capability passed 2026-10-21) and MASON-WP-0009-T05 remain. Login-self-only grants no protected-operation authority: agree and implement separately reviewed task-scoped backend execution entitlement, then prove functional steady-state service-identity adoption without bootstrap/env fallback."
priority: medium
state_hub_task_id: "d7bc8bdc-a0f8-5058-a640-374ef9859148"
```
Progress 2026-10-21. The founder authorized the CCR-2026-0038 boundary check, and it
passed attended (`docs/evidence/2026-10-21-service-jwt-boundary.json`). The self policy
is exactly `secrets-engine-login-self` with no identity policies. capabilities-self
denies both client-secret guard paths, `sys/policies/acl/*`, `auth/*/role/*` and
`auth/token/create`. Service and operator revocation both succeeded. The receipt went
to railiance-platform for RPF-WP-0035-T02. Still open: KEY-WP-0039-T02 claim negatives,
expiry/use exhaustion, MASON-WP-0009-T05, and task-scoped execution entitlement.
Progress 2026-10-10. The CCR-2026-0038 no-fallback check, which is
secrets-engine's to prove, passed. Fixing it exposed a gap: the anonymous JWT
login inherited `BAO_TOKEN`/`VAULT_TOKEN` and the CLI token helper, so it sent an