tegwick
a963a77bc7
Record the founder-run probe-openbao result as non-secret evidence, finish SECRETS-WP-0012 and point SECRETS-WP-0008-T06 at the remaining platform negative checks. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 544698@bnt-lap001 Assistant-Session: 279b8520-335f-4041-ba2a-9491335473db
109 lines
4.3 KiB
Markdown
109 lines
4.3 KiB
Markdown
---
|
|
id: SECRETS-WP-0012
|
|
type: workplan
|
|
title: "KeyCape secrets-engine-openbao consumer custody acceptance"
|
|
domain: infotech
|
|
repo: secrets-engine
|
|
status: finished
|
|
flavor: implementation
|
|
owner: claude-code
|
|
topic_slug: custodian
|
|
created: "2026-10-06"
|
|
updated: "2026-10-10"
|
|
related_workplans:
|
|
- SECRETS-WP-0008
|
|
state_hub_workstream_id: "143de42b-b568-5070-add0-d5e71eabd436"
|
|
---
|
|
|
|
# SECRETS-WP-0012 - KeyCape secrets-engine-openbao consumer custody acceptance
|
|
|
|
Demand: KEY-WP-0037-T02 and RPF-WP-0035-T02 (proposed CCR-2026-0033) need
|
|
secrets-engine's source acceptance of the consumer copy of the
|
|
`secrets-engine-openbao` client secret: host, owner, path, mode, delivery,
|
|
rotation/revocation ownership and a bounded validation interface. The founder
|
|
approved the two-copy custody boundary (decision
|
|
`632a8893-0d6a-4591-a50b-40bbdb798f32`), not generation, fetch, delivery,
|
|
registration or deployment. Live service-JWT adoption stays SECRETS-WP-0008-T06.
|
|
|
|
Redirected 2026-10-06: founder direction keeps the secret only in OpenBao, and
|
|
the ops-mason plan `keycape-secrets-engine-openbao-client-custody` (658cdbc)
|
|
replaces the consumer file with a per-command in-memory read (T02 cancelled,
|
|
T04 implements it, T03 is the first live use). T01's file checks remain for
|
|
the approval client only.
|
|
|
|
Packet: [docs/keycape-openbao-consumer-custody.md](../docs/keycape-openbao-consumer-custody.md).
|
|
|
|
## Consumer packet and strict file acceptance
|
|
|
|
```task
|
|
id: SECRETS-WP-0012-T01
|
|
status: done
|
|
priority: high
|
|
state_hub_task_id: "d7978a83-0760-5763-a42f-77721fdeff1d"
|
|
```
|
|
|
|
Done 2026-10-06. The packet names the coordinates and marks D1-D4 as founder
|
|
decisions with recommendations. `service_auth.read_client_secret_file`
|
|
now refuses symlinked, foreign-owned, non-regular, shared-parent and
|
|
multi-token files in addition to the earlier mode, worktree and empty checks.
|
|
`secrets-engine service-auth check-secret-file` is the value-free validation
|
|
interface. Synthetic tests are in `tests/test_consumer_secret_file.py`. Full
|
|
suite: 510 passed, 1 skipped (root-only owner test).
|
|
|
|
## Founder decisions D1-D4
|
|
|
|
```task
|
|
id: SECRETS-WP-0012-T02
|
|
status: cancel
|
|
priority: high
|
|
state_hub_task_id: "b95da704-ce13-5bf5-be3b-126e894a669d"
|
|
```
|
|
|
|
Cancelled 2026-10-06: superseded by founder direction 2026-10-06 (the client
|
|
secret lives only in OpenBao, no workstation copy) and the ops-mason plan
|
|
`keycape-secrets-engine-openbao-client-custody` (658cdbc, MASON-WP-0009).
|
|
D1-D4 (host, OS user, persistent file, rotation cadence) no longer apply.
|
|
|
|
## In-memory OpenBao secret source
|
|
|
|
```task
|
|
id: SECRETS-WP-0012-T04
|
|
status: done
|
|
priority: high
|
|
state_hub_task_id: "be26828b-1faf-53a1-bc49-77c4cc80f1ca"
|
|
```
|
|
|
|
Done 2026-10-06. `service_auth.OpenBaoOidcClientSecretSource`: attended
|
|
`bao login -method=oidc -path=netkingdom -no-store -format=json` on role
|
|
`keycape-secrets-engine-openbao-operator-workload-kv-read`, token from a
|
|
stdout pipe, ambient `BAO_TOKEN`/`VAULT_TOKEN` stripped, header-only GET of
|
|
`platform/data/workloads/keycape/secrets-engine-openbao` field
|
|
`CLIENT_SECRET`, unconditional `revoke-self`, then the KeyCape exchange and
|
|
OpenBao JWT login. The file source is refused for this profile (kept for the
|
|
approval client). `secrets-engine service-auth probe-openbao` prints
|
|
value-free evidence. Synthetic tests: `tests/test_openbao_secret_source.py`.
|
|
Docs: `docs/keycape-openbao-consumer-custody.md` (rewritten),
|
|
`docs/service-auth.md`, `docs/cli.md`.
|
|
|
|
## First live attended use
|
|
|
|
```task
|
|
id: SECRETS-WP-0012-T03
|
|
status: done
|
|
priority: high
|
|
state_hub_task_id: "1c3afd34-4aa3-5484-a9c7-2db577225269"
|
|
```
|
|
|
|
Acceptance: the one-line JSON from `service-auth probe-openbao --json` with
|
|
`ok: true`, `secret_source: openbao-oidc-in-memory`, both accessor
|
|
fingerprints and both revoke-self results true, recorded without any value,
|
|
token or full accessor. This is the evidence for KEY-WP-0037-T04,
|
|
RPF-WP-0035-T02 and plan verification item 6; OpenBao login proof also
|
|
closes into SECRETS-WP-0008-T06.
|
|
|
|
Result 2026-10-10: the founder ran the attended probe and it passed with
|
|
`ok: true`, `secret_source: openbao-oidc-in-memory`, both revoke-self results
|
|
true, and session handles `0204e60340d2` (service) and `4e9c487b6206`
|
|
(operator). Evidence: `docs/evidence/2026-10-10-keycape-openbao-probe.json`.
|
|
The CCR-2026-0038 negative checks remain with railiance-platform under
|
|
RPF-WP-0035-T02.
|