tegwick
691dc74236
Assistant: codex Assistant-Model: gpt-6.1-sol Assistant-Session: 01a1468b-63fa-7710-85dc-8f2e16b3ebfa
99 lines
6.3 KiB
Markdown
99 lines
6.3 KiB
Markdown
# Original KeyCape isolated consumer continuity plan
|
|
|
|
Owner: secrets-engine. Source outcome: SECRETS-WP-0015-T03, 2026-10-17.
|
|
This is a reviewed source plan, not native assent, a custody grant or an
|
|
executed recovery. T04 remains a human wait on the complete NK49T33 attempt.
|
|
|
|
The [frozen owner packet](../../the-custodian/docs/changes/netkingdom-target-2026-10-17/consumer-outage-r1/OWNER-PLAN.md)
|
|
contains the exact custody/command/negative/equality/timeout/abort plan and source
|
|
references. Its owner-plan SHA-256 is
|
|
`sha256:d358aaeedc18c42c591d3301ec34f493e63bf579bf5a17b6ccc7e32ec88ea8ed`.
|
|
The packet remains immutable; this source note does not revise its authority.
|
|
|
|
## Exact original selector and source
|
|
|
|
Use the existing [public selector](keycape-recovery-selector.json): issuer
|
|
`https://kc.coulomb.social`, client/audience `secrets-engine-openbao`, env name
|
|
`KEYCAPE_SECRETS_ENGINE_OPENBAO_CLIENT_SECRET`, subject
|
|
`service:secrets-engine`, tenant `tenant:platform`, exactly role
|
|
`secrets-engine`, scope `openbao:login`, denied scope `openbao:admin`.
|
|
The current consumer `service_auth.py` source SHA-256 is
|
|
`sha256:c0ade429edf452ad17f05d690b7ebef091db7f1a42b5ac350f1e40955c8586c0`.
|
|
Its existing AST-only selector preflight passes at that exact hash. Historical
|
|
issuer/consumer successes predate the archive and retain their historical scope.
|
|
|
|
The packet's [one-shot observer candidate](../../the-custodian/docs/changes/netkingdom-target-2026-10-17/consumer-outage-r1/consumer_contract_observer.py)
|
|
is `sha256:23467730be61625d53b34c09e62f737a35e3def10d22a3a64664835961d3f4bd`.
|
|
Its frozen four-file consumer-source manifest is
|
|
`sha256:5b0409d7141514295e7d0f636ff6fa5dbe9d1f0d4d23b2f9ebce84a174d69499`.
|
|
The observer remains a source candidate: it was tested with synthetic unsigned
|
|
tokens only and is not installed, invoked on real material, or wired into either
|
|
NK49 recovery or ordinary consumer authentication. Five synthetic tests pass;
|
|
seven parser-negative variants and source/input refusal checks are within those
|
|
tests, not extra native successes.
|
|
|
|
## Claims and custody boundaries
|
|
|
|
1. **Original issuer:** the existing frozen NK49 native checker binds the
|
|
original archived registration/env, original TLS/trust/JWKS, wrong-secret and
|
|
excess-scope refusal, and exact original config/registry/policy/receipt
|
|
equality. Its receipt keeps downstream consumer reconnect false.
|
|
2. **Consumer claim compatibility:** after a newly reviewed NK49 source/admission
|
|
closure, the existing issuer `service-token` command may mint a short-lived
|
|
original-identity token in the issuer's private tmpfs. A reviewed same-session
|
|
wrapper would hand only that bounded token object over private stdin to the
|
|
exact Secrets claim observer, then prove transient-token/resource cleanup.
|
|
The original client secret stays in the restored issuer environment. Native
|
|
issuer/JWKS verification precedes consumer parsing; the observer verifies no
|
|
signature or native provenance. This proposed callback is not implemented.
|
|
3. **Full original OpenBao consumer continuity:** requires Platform/rapp-openbao's
|
|
independently recovered original backend/custody, original KV registration,
|
|
narrow OIDC source role and actual operator authentication/MFA dependencies,
|
|
plus exact isolated routing/trust. NK49's identity archive does not supply
|
|
OpenBao Raft recovery. A fresh backend, production login or injected secret
|
|
cannot substitute for this return. Then use the unchanged ordinary attended
|
|
OpenBao in-memory secret source, KeyCape exchange, actual OpenBao JWT login
|
|
and definite operator/engine session revocation.
|
|
|
|
The current no-file/no-fallback direction remains. Do not inject the recovered
|
|
issuer secret into ordinary `login_service_jwt`, create a persistent consumer
|
|
copy, use ambient/bootstrap credentials, or redirect production. An exceptional
|
|
source would need a separate explicit owner/founder custody decision; none is
|
|
proposed or implemented here. Service identity/login-only policy is not protected
|
|
backend execution authority. SECRETS-WP-0008-T06/0013 retain those scopes;
|
|
finished SECRETS-WP-0012 remains finished.
|
|
|
|
## Actual acceptance and next owner action
|
|
|
|
The next action is to assemble NK49T33's exact owner-held original TLS/archive/
|
|
private-admission packet and surviving offline founder authorization before any
|
|
key prompt. Matching hashes, possession of an archive key, this workplan and
|
|
historical CCRs are not that authorization. Bind exact source/image/executor,
|
|
original issuer/case/target, deadline and permitted isolated effects in the
|
|
existing supervised recovery process. No new auth or approval service is needed.
|
|
|
|
Keep original ciphertext/transfer/source/binary/trust and manifest-binding-mode
|
|
interfaces. Private manifests and equality hashes stay inside custody. Freeze any
|
|
new observer callback/dependency closure, native command count and phase-specific
|
|
negative parsing; its source/synthetic lifecycle review must precede real input.
|
|
Use the existing bounded NK49 execution, exact pidfd/session quiescence and
|
|
registered tmpfs/container cleanup. Abort on unknown provenance, changed original
|
|
bytes, ambiguous daemon action or incomplete cleanup; preserve failed receipts
|
|
and uncertainty rather than retrying or reinitializing state.
|
|
|
|
Require an actual positive original-issuer token and exact consumer claims,
|
|
including no extra roles. Native wrong-expected-audience/required-role refusals
|
|
are verifier checks, not OpenBao authorization. The observer's seven deliberately
|
|
modified payloads prove parser refusal only; unsigned mutations prove no signed
|
|
claim denial. Full backend acceptance separately requires real resource-server
|
|
wrong-audience/scope/role refusal, restored policy/role/KV equality and session
|
|
revocation through the existing owner path. Missing original signed negative
|
|
cases stay missing; do not create grants or claim signature failure isolates a
|
|
particular claim. A fresh attempt token is not a preserved pre-outage token.
|
|
|
|
T04 remains wait/needs_human, depends on T03 and NK-WP-0049-T33, and retains
|
|
actual native acceptance. T18 owns actual selected-consumer recovery; T19 owns
|
|
retained-factor MFA. Return separate closed issuer/consumer-contract/backend
|
|
receipts tied to one attempt. Export source/public signing/TLS hashes, allowed
|
|
identifiers, booleans and cleanup facts only; never secret/token/private manifest
|
|
or raw provider output. A human wait is not an automatic worker wakeup.
|