tegwick
3cd9955ac9
Load pep-stance.yaml as the live unreachable-engine gate and record named stance fields on privileged evidence. Classify evidence, queue load-bearing records in a local outbox, and add heartbeat/drain commands that never sit on a mutation path. Publish proposed SSH-CA and secret-use evidence contracts without adding an OpenBao SSH-CA write. T02 (access-engine decision records) and T06 (no standing credential) stay wait on external endpoints. Assistant: grok Assistant-Session: 01a04cea-cb33-7c63-bad7-c1b0f9f0076b
3.3 KiB
Secret-use evidence engine contract (proposed)
Status: proposed. layer.yaml owner_status remains proposed until this
surface ships. kings-guard must assent or contest before it is treated as an
observation input.
Standard: NetKingdom Security Layer Model v0.7 §9.6. Companion:
net-kingdom/SECURITY-COMPANION.md §6.
What this is
A read-only Lifecycle engine surface of non-secret lease, revocation, mount, rotation, and delivery-session metadata, so kings-guard can evaluate secret-abuse posture without a vault client.
secrets-engine route and secrets-engine audit are operator summaries over
local JSONL. They are not this surface.
Bound (normative)
The archive proves the records it holds were not altered or truncated after arrival. It does not prove a record was sent. Absence of a record is not evidence of non-occurrence. Completeness is not claimed.
This surface cannot close adversarial omission at a compromised source. Cadence
for load-bearing classes is a heartbeat (secrets-engine evidence heartbeat),
not rate monitoring.
Fields (non-secret)
| Field | Meaning | Freshness |
|---|---|---|
as_of |
UTC timestamp of the snapshot | Snapshot time |
catalog_id |
Lane id | Catalog load |
stage |
build | test | prod |
Catalog load |
kind |
kv | auth-capability |
Catalog load |
mount |
OpenBao mount name | Catalog load |
path |
KV path or allowlisted auth path, never a value | Catalog load |
field_names |
Declared field names, never values | Catalog load |
ready |
All declared fields present (boolean) | Last route/verify |
session_handle |
Accessor fingerprint only | Last exec/verify |
revocation_attempted |
Boolean | Last session |
revocation_succeeded |
Boolean | Last session |
lifecycle_operation |
suspend | deactivate | destroy | revoke if one ran |
Last lifecycle |
decision_id |
Present only where a decision was rendered | Last privileged action |
stance_stage / stance_failure_mode |
Named PEP residue | Last privileged action |
evidence_kind |
load-bearing | attributive | heartbeat |
Per record |
Forbidden in this surface: secret values, tokens, passwords, AppRole
secret_id, raw accessors, certificate private keys, subprocess argv, and
exception prose.
Freshness
Every row carries as_of. There is no cached authorization verdict. A consumer
must not treat a stale snapshot as a standing allow. Recommended maximum age
for posture evaluation is the heartbeat interval declared in
evidence-classification.yaml (1d) until a tighter contract is assented.
Destination
Intended owner of custody is audit-core. Today the engine queues load-bearing
records in evidence_dir/outbox/ and writes attributive records to local
JSONL. Drain to audit-core is best-effort and is never on the mutation path.
kings-guard reads this engine surface, not OpenBao.
Non-responsibilities
This surface does not decide whether an action is permitted, does not expose an approval-validity query, does not prove omission at source, and does not observe production events kings-guard has not received. Companion §10 still holds: nothing is observed in production until kings-guard reports otherwise.
Assent
A coordination message to kings-guard records this contract. Assent or contest belongs in kings-guard's own voice.