tegwick
745ad146b5
Founder-authorized attended run of tools/verify_service_jwt_boundary.py --execute: exact self policy, capabilities-self deny on all five paths, service and operator revocation succeeded. Claim negatives, expiry/use and adoption remain open in SECRETS-WP-0008-T06. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 17890@bnt-lap001 Assistant-Session: 7d96d43c-0154-4a22-af71-71c349ac6dc3
49 lines
2.2 KiB
JSON
49 lines
2.2 KiB
JSON
{
|
|
"status": "passed",
|
|
"phase": "attended_boundary_verification",
|
|
"task": "SECRETS-WP-0008-T06",
|
|
"serves": "RPF-WP-0035-T02 (CCR-2026-0038 effective policy and capabilities-self denials)",
|
|
"observed_at": "2026-10-21",
|
|
"operator": "founder (attended, KeyCape OIDC login with MFA)",
|
|
"authorization": "founder authorized the attended boundary run in session on 2026-10-21",
|
|
"command": "tools/verify_service_jwt_boundary.py --ccr <railiance-platform>/credential-change-requests/CCR-2026-0038-secrets-engine-service-jwt-login.yaml --execute",
|
|
"tool_commit": "4378ec1",
|
|
"bao_addr": "http://127.0.0.1:18200",
|
|
"result": {
|
|
"auth_provider": "service-jwt",
|
|
"capability_denials": {
|
|
"auth/*/role/*": true,
|
|
"auth/token/create": true,
|
|
"platform/data/workloads/keycape/secrets-engine-openbao": true,
|
|
"platform/metadata/workloads/keycape/secrets-engine-openbao": true,
|
|
"sys/policies/acl/*": true
|
|
},
|
|
"ccr_sha256": "65b2cfb772623da59c351033ab4eb2ec7adfbd109778e787c7fe1b0e185a3bc0",
|
|
"claim_negatives_proved": false,
|
|
"contract_sha256": "a98663c316611c4b2773f197c734befb8446e8efe20f563da018c358c3b11d77",
|
|
"denied_paths": [
|
|
"platform/data/workloads/keycape/secrets-engine-openbao",
|
|
"platform/metadata/workloads/keycape/secrets-engine-openbao",
|
|
"sys/policies/acl/*",
|
|
"auth/*/role/*",
|
|
"auth/token/create"
|
|
],
|
|
"established": true,
|
|
"exact_self_policy": true,
|
|
"expected_policy": "secrets-engine-login-self",
|
|
"native_verified": true,
|
|
"operator_revocation_attempted": true,
|
|
"operator_revocation_succeeded": true,
|
|
"operator_session_handle": "30835a05b52b",
|
|
"protected_operation_adoption_proved": false,
|
|
"revocation_attempted": true,
|
|
"revocation_succeeded": true,
|
|
"secret_source": "openbao-oidc-in-memory",
|
|
"session_handle": "d8a4b397fa4d"
|
|
},
|
|
"notes": [
|
|
"Two service-token metadata requests (lookup-self, one batched capabilities-self), then unconditional service and operator revocation.",
|
|
"Output is restricted to hashes, booleans and 12-hex session fingerprints; no response bodies, tokens or values were recorded.",
|
|
"Not proved here: native KeyCape claim negatives (KEY-WP-0039-T02), token expiry/use exhaustion, and protected-operation adoption."
|
|
]
|
|
}
|