tegwick
a963a77bc7
Record the founder-run probe-openbao result as non-secret evidence, finish SECRETS-WP-0012 and point SECRETS-WP-0008-T06 at the remaining platform negative checks. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 544698@bnt-lap001 Assistant-Session: 279b8520-335f-4041-ba2a-9491335473db
36 lines
1.6 KiB
JSON
36 lines
1.6 KiB
JSON
{
|
|
"status": "passed",
|
|
"phase": "first_live_attended_use",
|
|
"task": "SECRETS-WP-0012-T03",
|
|
"observed_at": "2026-10-10",
|
|
"operator": "founder (attended, KeyCape OIDC login with MFA)",
|
|
"command": "secrets-engine service-auth probe-openbao --json",
|
|
"bao_addr": "http://127.0.0.1:18200",
|
|
"login_contract": {
|
|
"file": "~/.secrets-engine/keycape/openbao-jwt-login.yaml",
|
|
"mount": "keycape-services",
|
|
"role": "secrets-engine-openbao",
|
|
"bound_issuer": "https://kc.coulomb.social",
|
|
"authority": "probe input per CCR-2026-0038 as amended (railiance-platform 93a4bc2)"
|
|
},
|
|
"result": {
|
|
"auth_provider": "service-jwt",
|
|
"established": true,
|
|
"ok": true,
|
|
"operator_revocation_attempted": true,
|
|
"operator_revocation_succeeded": true,
|
|
"operator_session_handle": "4e9c487b6206",
|
|
"revocation_attempted": true,
|
|
"revocation_succeeded": true,
|
|
"secret_source": "openbao-oidc-in-memory",
|
|
"session_handle": "0204e60340d2"
|
|
},
|
|
"notes": [
|
|
"Session handles are 12-hex-character SHA-256 fingerprints of accessors, not tokens or full accessors.",
|
|
"The client secret was read in memory from OpenBao through the operator OIDC session; no consumer file was used.",
|
|
"The bao CLI note that the token was not stored in the token helper is expected: the operator token stays in memory and was self-revoked.",
|
|
"This is the positive login proof only. The negative checks listed in CCR-2026-0038 remain with railiance-platform under RPF-WP-0035-T02."
|
|
],
|
|
"closes": ["SECRETS-WP-0012-T03"],
|
|
"evidence_for": ["KEY-WP-0037-T04", "RPF-WP-0035-T02", "ops-mason plan verification item 6", "SECRETS-WP-0008-T06"]
|
|
}
|