From a963a77bc7d90aa7110d7a3eef219565d9594208 Mon Sep 17 00:00:00 2001 From: tegwick Date: Sat, 10 Oct 2026 10:19:19 +0200 Subject: [PATCH] Close SECRETS-WP-0012-T03: service-JWT OpenBao login probe passed Record the founder-run probe-openbao result as non-secret evidence, finish SECRETS-WP-0012 and point SECRETS-WP-0008-T06 at the remaining platform negative checks. Co-Authored-By: Claude Opus 5.5 Assistant: claude-code Assistant-Model: opus Assistant-Process: 544698@bnt-lap001 Assistant-Session: 279b8520-335f-4041-ba2a-9491335473db --- .../2026-10-10-keycape-openbao-probe.json | 36 +++++++++++++++++++ ...-0008-layer-model-lifecycle-conformance.md | 2 +- ...P-0012-keycape-openbao-consumer-custody.md | 16 +++++---- 3 files changed, 47 insertions(+), 7 deletions(-) create mode 100644 docs/evidence/2026-10-10-keycape-openbao-probe.json diff --git a/docs/evidence/2026-10-10-keycape-openbao-probe.json b/docs/evidence/2026-10-10-keycape-openbao-probe.json new file mode 100644 index 0000000..3e33510 --- /dev/null +++ b/docs/evidence/2026-10-10-keycape-openbao-probe.json @@ -0,0 +1,36 @@ +{ + "status": "passed", + "phase": "first_live_attended_use", + "task": "SECRETS-WP-0012-T03", + "observed_at": "2026-10-10", + "operator": "founder (attended, KeyCape OIDC login with MFA)", + "command": "secrets-engine service-auth probe-openbao --json", + "bao_addr": "http://127.0.0.1:18200", + "login_contract": { + "file": "~/.secrets-engine/keycape/openbao-jwt-login.yaml", + "mount": "keycape-services", + "role": "secrets-engine-openbao", + "bound_issuer": "https://kc.coulomb.social", + "authority": "probe input per CCR-2026-0038 as amended (railiance-platform 93a4bc2)" + }, + "result": { + "auth_provider": "service-jwt", + "established": true, + "ok": true, + "operator_revocation_attempted": true, + "operator_revocation_succeeded": true, + "operator_session_handle": "4e9c487b6206", + "revocation_attempted": true, + "revocation_succeeded": true, + "secret_source": "openbao-oidc-in-memory", + "session_handle": "0204e60340d2" + }, + "notes": [ + "Session handles are 12-hex-character SHA-256 fingerprints of accessors, not tokens or full accessors.", + "The client secret was read in memory from OpenBao through the operator OIDC session; no consumer file was used.", + "The bao CLI note that the token was not stored in the token helper is expected: the operator token stays in memory and was self-revoked.", + "This is the positive login proof only. The negative checks listed in CCR-2026-0038 remain with railiance-platform under RPF-WP-0035-T02." + ], + "closes": ["SECRETS-WP-0012-T03"], + "evidence_for": ["KEY-WP-0037-T04", "RPF-WP-0035-T02", "ops-mason plan verification item 6", "SECRETS-WP-0008-T06"] +} diff --git a/workplans/SECRETS-WP-0008-layer-model-lifecycle-conformance.md b/workplans/SECRETS-WP-0008-layer-model-lifecycle-conformance.md index dfcd963..b0df15e 100644 --- a/workplans/SECRETS-WP-0008-layer-model-lifecycle-conformance.md +++ b/workplans/SECRETS-WP-0008-layer-model-lifecycle-conformance.md @@ -332,7 +332,7 @@ Acceptance: id: SECRETS-WP-0008-T06 status: wait depends_on: [RPF-WP-0035-T02] -blocking_reason: "RPF-WP-0035-T02 awaits coordinated platform-tenant live registration, credential custody and scoped attended JWT role provisioning with native login/negative/revocation proof. The historical env-auth acceptance is not service-JWT adoption." +blocking_reason: "Positive service-JWT login proof passed 2026-10-10 (SECRETS-WP-0012-T03, docs/evidence/2026-10-10-keycape-openbao-probe.json). Waits on railiance-platform closing RPF-WP-0035-T02 with the CCR-2026-0038 negative checks, then on routing live engine actions through service-jwt instead of bootstrap/env." priority: medium state_hub_task_id: "d7bc8bdc-a0f8-5058-a640-374ef9859148" ``` diff --git a/workplans/SECRETS-WP-0012-keycape-openbao-consumer-custody.md b/workplans/SECRETS-WP-0012-keycape-openbao-consumer-custody.md index 875fbdd..154dcfd 100644 --- a/workplans/SECRETS-WP-0012-keycape-openbao-consumer-custody.md +++ b/workplans/SECRETS-WP-0012-keycape-openbao-consumer-custody.md @@ -4,12 +4,12 @@ type: workplan title: "KeyCape secrets-engine-openbao consumer custody acceptance" domain: infotech repo: secrets-engine -status: blocked +status: finished flavor: implementation owner: claude-code topic_slug: custodian created: "2026-10-06" -updated: "2026-10-09" +updated: "2026-10-10" related_workplans: - SECRETS-WP-0008 state_hub_workstream_id: "143de42b-b568-5070-add0-d5e71eabd436" @@ -89,11 +89,8 @@ Docs: `docs/keycape-openbao-consumer-custody.md` (rewritten), ```task id: SECRETS-WP-0012-T03 -status: wait -needs_human: true +status: done priority: high -blocked_on: founder -blocking_reason: "All upstream objects are live: CCR-2026-0033 applied, KeyCape registration live (KEY-WP-0037), CCR-2026-0038 JWT mount keycape-services / role secrets-engine-openbao applied 2026-10-08 (railiance-platform 1b36e14). Probe input ~/.secrets-engine/keycape/openbao-jwt-login.yaml written 2026-10-09 with founder approval (mode 0600, parsed by the engine loader; allowed by CCR-2026-0038 as amended in railiance-platform 93a4bc2). Founder runs the attended probe-openbao command in docs/keycape-openbao-consumer-custody.md." state_hub_task_id: "1c3afd34-4aa3-5484-a9c7-2db577225269" ``` @@ -103,3 +100,10 @@ fingerprints and both revoke-self results true, recorded without any value, token or full accessor. This is the evidence for KEY-WP-0037-T04, RPF-WP-0035-T02 and plan verification item 6; OpenBao login proof also closes into SECRETS-WP-0008-T06. + +Result 2026-10-10: the founder ran the attended probe and it passed with +`ok: true`, `secret_source: openbao-oidc-in-memory`, both revoke-self results +true, and session handles `0204e60340d2` (service) and `4e9c487b6206` +(operator). Evidence: `docs/evidence/2026-10-10-keycape-openbao-probe.json`. +The CCR-2026-0038 negative checks remain with railiance-platform under +RPF-WP-0035-T02.