diff --git a/docs/approval-service-auth.md b/docs/approval-service-auth.md index 073dcb4..afeb25f 100644 --- a/docs/approval-service-auth.md +++ b/docs/approval-service-auth.md @@ -78,8 +78,60 @@ The admission must name the actual consumer/placement, bounded reader, protected temporary delivery and cleanup, refusal/revocation checks and lifecycle owner. Do not use the verifier's `sso` Secret or reseed version-1 custody. -Approval Engine's operator is a separate identity and read lane. Audit receiver -and sender custody remains AUDIT-WP-0009-T09 / APPROVAL-WP-0002-T01. The live +### CCR-2026-0019 workstation procedure — consumer return, 2026-09-10 + +This source review answers Platform's procedure request +`fbf434cf-3f68-4d11-ae98-bb3798e2c5a5`. The current consumer accepts the following +attended file lifetime. It does not confirm an operator group or admit a reader: +CCR-2026-0019 remains in flight, its front door unresolvable, and no value was read. + +1. After the exact group, role and reader admission are accepted, use an + operator-owned runtime directory outside every Git worktree, with canonical + non-symlink parents and mode 0700. Prefer the workstation's private runtime + tmpfs; stop if it is unavailable rather than silently choosing a shared or + backed-up location. Set `umask 077`. Create a unique session subdirectory and + a new regular `client-secret` file owned by that operator, mode 0600. Check + ownership/mode/location without displaying file contents. +2. Install the session wrapper's EXIT cleanup before delivery. Its INT and TERM + handlers must exit through that cleanup. The admitted delivery owner fills + only this file from `platform/workloads/secrets-engine/approval-client`, field + `CLIENT_SECRET`, existing version 1. Use the reviewed front door after it is + resolvable; do not replace its pending admission with a direct raw vault read, + the verifier's Kubernetes Secret, a sibling identity or an interactive paste. +3. Supply only the absolute file path as + `SECRETS_ENGINE_APPROVAL_CLIENT_SECRET_FILE` to the intended Secrets Engine + CLI. Keep the file for both claim and consume exchanges in that one attended + operation. Unset `SECRETS_ENGINE_APPROVAL_TOKEN_FILE`; configure the existing + issuer/token endpoint and the admitted Approval Engine endpoint or its + owner-bound tunnel. Disable shell tracing and credential-bearing HTTP debug + logs. The file value belongs in neither argv nor an environment variable. +4. On success, refusal, exception or interruption, cleanup unsets the path, + removes that exact file, then removes the now-empty session directory and + verifies both are absent. Record only cleanup status and non-secret request + IDs. Do not recursively remove a shared directory. SIGKILL, host failure or a + failed trap requires attended residual-file inspection/removal before reuse; + automatic cleanup is not provided by the current consumer. Unlink is not a + claim of secure erasure or token revocation. Tmpfs avoids a persistent copy + but does not replace host custody controls. + +The implemented `read_strict_token_file` rejects group/other-accessible files, +files inside Git worktrees and empty inputs. It does not establish parent-path +ownership, create or delete this file, or prove session cleanup. Those are the +explicit delivery/operator responsibilities above, retained in the CCR's risk +section. `KeyCapeServiceAuthProvider.exchange` rereads the file before each +request and holds the resulting token in memory. Removing it prevents a later +exchange; already-issued tokens retain their bounded lifetime. Compromise uses +KeyCape registration disablement and the CCR's coordinated lifecycle procedure. + +Required live evidence remains: exact authorized identity and mode/location +checks, one scoped exchange/claim/consume result, wrong-group and sibling-path +denials, and cleanup after both success and refusal. Existing synthetic component +evidence verifies the consumer behavior; it is not that live reader receipt. + +Real human approval follows INFD-WP-0001-T07/T08's reviewed PKCE client; a future +service requester needs its own narrow registration. The unpresented operator +reader CCR-2026-0020 was cancelled on owner withdrawal and is not a dependency. +Audit receiver and sender custody remains AUDIT-WP-0009-T09 / APPROVAL-WP-0002-T01. The live Approval Engine deployment and native OpenBao delivery remain open. Synthetic acceptance grants no production access, action approval or model spending. diff --git a/workplans/SECRETS-WP-0009-glas-claude-native-delivery.md b/workplans/SECRETS-WP-0009-glas-claude-native-delivery.md index a54a9ce..18b854e 100644 --- a/workplans/SECRETS-WP-0009-glas-claude-native-delivery.md +++ b/workplans/SECRETS-WP-0009-glas-claude-native-delivery.md @@ -226,3 +226,15 @@ CCR-2026-0019 operator-group/file-delivery return, INFD-WP-0001-T07/T08 real hum approval, audit custody and deployed services/PDP/native delivery. CCR-2026-0020 was cancelled on owner withdrawal; do not wait for or recreate its presenter. No runtime artifact rebuild is needed for this credential-engine change. + +### 2026-09-10 workstation procedure return + +`docs/approval-service-auth.md` now gives the concrete CCR-2026-0019 consumer +procedure requested by Platform: an operator-owned 0700 runtime session directory +outside Git, a new 0600 file, path-only CLI configuration, claim/consume lifetime, +EXIT/INT/TERM cleanup and explicit residual-file handling after hard interruption. +The source review distinguishes implemented permission/location/empty-file checks +from operator-owned creation, parent custody and cleanup. No automatic cleanup +or live reader proof is claimed. The exact group remains NetKingdom/KeyCape's +return, followed by reviewed attended admission and positive/negative evidence. +T03 stays wait; no identity, role, secret, runtime or route readiness changed.