tegwick
3b355de300
Re-render admitted-lane plans as kv-mount-check plus exact-path AppRole. Name openrouter-llm-connect as the first candidate. Document apply, verify, and rollback without authorizing live mutation. T05 stays wait on T04 serving and attended authority. Assistant: grok Assistant-Session: 01a05f07-ae72-7781-9fcb-19efd61add00
68 lines
2.6 KiB
Markdown
68 lines
2.6 KiB
Markdown
# Native lane cutover (SECRETS-WP-0006-T05 / T06)
|
|
|
|
Status: procedure only. Live apply is still fail-closed until
|
|
`SECRETS-WP-0007-T04` serves an exact-action approval and railiance-platform
|
|
grants scoped attended authority. CCR references below are workload-lane
|
|
provenance, not executable authorization for the native AppRole.
|
|
|
|
This document does not authorize production mutation.
|
|
|
|
## Scope
|
|
|
|
Five admitted KV lanes on the existing `platform` mount. Workload delivery
|
|
(ESO/OIDC) stays with current owners. Native apply adds only an exact-path
|
|
read policy and bounded AppRole.
|
|
|
|
Do not batch-retire ops-warden interim proxies. T06 is per lane, after native
|
|
evidence.
|
|
|
|
## Cutover order
|
|
|
|
Chosen for increasing blast radius, not CCR age.
|
|
|
|
| Order | Lane | Why this position |
|
|
| --- | --- | --- |
|
|
| 1 | `openrouter-llm-connect` | One field, one ESO consumer besides operator exec |
|
|
| 2 | `email-connect-transactional` | Three fields; ingest bearer shared with user-engine |
|
|
| 3 | `issue-core-ingestion-api-key` | Two fields, two ESO consumers |
|
|
| 4 | `reuse-surface-hub-write-token` | Hub write + webhook HMAC, two coordinated consumers |
|
|
| 5 | `forgejo-admin-api-token` | Site-admin PAT; last on purpose |
|
|
|
|
## What live apply would mutate (once approved)
|
|
|
|
Re-rendered 2026-09-02 against current `build_plan`. Every lane:
|
|
|
|
- `[kv-mount-check] platform` — no mount create
|
|
- `[policy]` exact `platform/data/<path>` read + metadata read
|
|
- `[approle]` 15m TTL, 30m max, 15m single-use secret_id, 8 token uses
|
|
|
|
No KV put/patch, no ESO change, no provider rotation.
|
|
|
|
## First-lane packet: `openrouter-llm-connect`
|
|
|
|
Provenance CCR: `CCR-2026-0003` (existing workload lane only).
|
|
|
|
Required before OpenBao:
|
|
|
|
1. Canonical ActionAuthorization for `action=apply`, resource
|
|
`catalog:openrouter-llm-connect`, stage `prod`, exact policy/auth targets
|
|
`se-prod-openrouter-llm-connect`.
|
|
2. Successful approval-engine CAS consume of that request digest
|
|
(`GH-DEC-2026-003`).
|
|
3. Scoped attended production authority from railiance-platform (not a
|
|
standing bootstrap token).
|
|
4. llm-connect owner ready to confirm ESO/application health after apply.
|
|
|
|
Apply: `secrets-engine apply openrouter-llm-connect --stage prod`
|
|
then metadata-safe verify of field presence and unrelated-identity denial.
|
|
No value in evidence. Delivery session must self-revoke.
|
|
|
|
Rollback (native only): delete AppRole and policy
|
|
`se-prod-openrouter-llm-connect`. Leave KV and ESO untouched. Keep the
|
|
ops-warden proxy until T06.
|
|
|
|
## Explicit non-goals for T05
|
|
|
|
- Provision or rotate the live OpenRouter key.
|
|
- Retire all five proxies in one batch.
|
|
- Treat CCR status or a local fixture as apply authorization.
|