coulomb/secrets-engine
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

NK-WP-0056-T02 owner answer: bounded executor credential lanes; SECRETS-WP-0017 proposed
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 2s
Details

Browse source 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 994874@bnt-lap001
Assistant-Session: 6017c416-d619-47eb-bd1a-f670a02d7d87
This commit is contained in:
tegwick 2026-10-31 14:19:34 +01:00
parent 65a3dbe103
commit 8ec5aff1a6
3 changed files with 195 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

68
workplans/SECRETS-WP-0017-bounded-executor-lanes.md Normal file
View file

@ -0,0 +1,68 @@
---
id: SECRETS-WP-0017
type: workplan
title: "Catalog and guard bounded-executor CAS rotation lanes (NK-WP-0056 pilot)"
domain: infotech
repo: secrets-engine
status: proposed
flavor: implementation
owner: secrets-engine
topic_slug: netkingdom
created: "2026-10-31"
updated: "2026-10-31"
depends_on: []
related: [SECRETS-WP-0013]
---
Owner answer to NK-WP-0056-T02 (hub message 16adf344). Design and proposed lane
shapes: `docs/bounded-executor-credential-lanes.md`. The engine catalogs and
statically guards the executor lane. railiance-platform applies the Kubernetes
auth role and policy through its own CCR, and the executor holds only its own
15-minute token. Nothing here is a grant or a live change.
## Model an existing-auth CAS rotation lane in the catalog
```task
id: SECRETS-WP-0017-T01
status: wait
needs_human: true
blocked_on: founder approval of the Q1 lane shape (docs/bounded-executor-credential-lanes.md)
priority: high
```
Add an explicit lane access mode, for example `access: rotate-cas`, for `kv`
lanes with `delivery_auth.management: existing`. It renders `["read",
"update"]` on the exact data path and no `create`, metadata, delete, destroy or
undelete paths. It requires the `cas_required` declaration, a 15m maximum TTL,
risk `high`, and rotation and deactivation owners. Kubernetes auth is recorded
as existing-auth metadata only. Keep the default read-only `lane_policy_paths`
unchanged. Add tests for the rendered policy and for refusal of wildcard, extra
capability and metadata variants.
## Check a platform policy file against the catalog-rendered policy
```task
id: SECRETS-WP-0017-T02
status: todo
priority: medium
```
Add a static, offline comparison of a railiance-platform policy HCL with the
engine-rendered policy for a lane, reported as non-secret pass/fail. Platform
can run it on the CCR policy file before an attended apply. No OpenBao call.
## Add catalog entries for the pilot executor
```task
id: SECRETS-WP-0017-T03
status: wait
needs_human: true
blocked_on: platform CCR for the executor role/policy, and founder choice of LLDAP credential shape
priority: medium
```
Add `nk-bind-executor-svc-authelia` (rotate-cas) and the syn-journey check read
as non-secret entries that reference the platform CCR and NK-WP-0056. If the
founder chooses the fallback LLDAP account, also add
`nk-bind-executor-lldap-credential` (high risk). Use `route` for readiness
pointers only.