14 lines
2.2 KiB
Markdown
14 lines
2.2 KiB
Markdown
|
# Security close-down checklist
|
||
|
|
|
||
|
|
**Owner:** the-custodian, on behalf of the founder. **Started:** 2026-10-03.
|
||
|
|
**Purpose:** while the estate is in build mode (orientation §0), agents may fix, simplify or relax parts of the security layer. Every such relaxation, and every control known to be unarmed, is listed here. At the production close-down the founder works this list, arms each item, and hands over the keys. After that, changes to the security system need elevated clearance.
|
||
|
|
|
||
|
|
Add a row whenever you loosen, shortcut or leave unarmed a control. Remove nothing; mark items armed with date and evidence.
|
||
|
|
|
||
|
|
| # | Control | Current state (build mode) | Re-arm at close-down | Owner | Added |
|
||
|
|
|---|---------|---------------------------|----------------------|-------|-------|
|
||
|
|
| 1 | Warden secret-fetch policy check (`check_fetch_policy`) | Misrouted to the ops-warden SSH signing pin; every non-ops-warden owner gets 403 (`wrong_system`). Bug reports: ops-warden `faf11061`, access-engine `b792c5d0`. Fix in progress. | Fetch checks go to an evaluator with an explicit secret-read policy per owner system, deny by default, caller auth enforced; positive and negative evidence recorded. | ops-warden, access-engine | 2026-10-03 |
|
||
|
|
| 2 | informed-decision posing path | Each memo needs an attended requester login, a hand-edited exact-record admission package and a manual store load. The redesign to agent-posed memos is wanted but not started (blocked by the harness). | Attribute-based admission and workload-identity intake, with humans-only binding, MFA freshness, one question per memo and audit evidence verified. | informed-decision, access-engine, approval-engine | 2026-10-03 |
|
||
|
|
| 3 | State Hub qualifier sync (C-41) | `statehub fix-consistency` reports PASS without pushing wait qualifiers; the direct checker run works. Reported: state-hub `70d08f35`. | CLI path fixed and covered by a regression test; hub decision and gate data trusted again. | state-hub | 2026-10-03 |
|
||
|
|
| 4 | Provenance of `platform/workloads/tenant-engine/audit-core-sender` v1 | Value is correct (`already_identical`), but nothing records who first seeded it. | Audit-trail entry reconstructed or the secret rotated under a recorded lane. | railiance-platform, ops-mason | 2026-10-03 |
|