From 6cdf1d4ad8d6d23dae2eaae7393485939440b217 Mon Sep 17 00:00:00 2001 From: codex Date: Mon, 12 Oct 2026 12:55:41 +0200 Subject: [PATCH] docs(security): record rotation output repair and adoption gap --- .../rotation-output.json | 102 ++++++++++++++++++ .../sec-dsm-requirement-ledger.json | 30 ++++-- docs/netkingdom-security-gaps.md | 18 +++- ...gdom-security-blueprint-and-gap-closure.md | 11 ++ 4 files changed, 148 insertions(+), 13 deletions(-) create mode 100644 docs/evidence/2026-10-12-netkingdom-security/rotation-output.json diff --git a/docs/evidence/2026-10-12-netkingdom-security/rotation-output.json b/docs/evidence/2026-10-12-netkingdom-security/rotation-output.json new file mode 100644 index 00000000..3806ea67 --- /dev/null +++ b/docs/evidence/2026-10-12-netkingdom-security/rotation-output.json @@ -0,0 +1,102 @@ +{ + "date": "2026-10-12", + "gap_refs": [ + "G08", + "G09" + ], + "owner_task": "NK-WP-0049-T02", + "manifest": { + "repo": "net-kingdom", + "base_head": "681c5b0ea17cb3e945ecf0763da8785439703fd4", + "files": [ + { + "path": "Makefile", + "before": "10af0bd3e1039577e0d78ea14ac92171864029a5d6d0d8c9757144ff1e0991bc", + "after": "2baa5e60248782a76617db4b851eccbe545d0ec462470e0fedbcfe1c5d5c0e36" + }, + { + "path": "sso-mfa/bootstrap/creds-rotate.sh", + "before": "58f3046de59bfe97b4bf26a83d9a7ac1a4f7293d5f01c6920df9ca711fda8216", + "after": "7b4189bc9bb9999d9047d1d05373a4e717cdd4654c2fd4d6d710b626a9e30eb6" + }, + { + "path": "sso-mfa/bootstrap/rotation-env.py", + "before": null, + "after": "bab079a51b8e7ad0199676e76e473a13e70f46e0495d8c942502c952236ec893" + }, + { + "path": "tests/test_rotation_output.py", + "before": null, + "after": "4739c078e6024f22efea4ef913e8341e01b68dfec14a19f8d4f888b82d3bc733" + }, + { + "path": "docs/security-bootstrap-age-custody.md", + "before": "ff443e924b44aa39d395b40761d6587e7ebe2cc375861f58bffc53e26e11e92c", + "after": "0110b1e2f184e0ae700e7278b6f1d9b9136cb07872ec72f74c3c580131f5a1ec" + }, + { + "path": "workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md", + "before": "7ec8f342b96b96608aa8aa83d7cc623c9140fb1a76c46006230c848832538833", + "after": "d2f56748a25111a096cefab330d5aa51a248e0864c3f91d35c1ebc7ab34d7c64" + } + ] + }, + "source_commit": "6ae4708ea061048f84fe59dcee3f482c69e291f9", + "source_pushed": true, + "verification": { + "original_regressions": { + "failed": 20, + "passed": 0 + }, + "final_focused": { + "passed": 25, + "failed": 0 + }, + "actual_checkout_full_suite": { + "passed": 252, + "failed": 0, + "skipped": 0, + "seconds": 33.99, + "command": "PATH=/tmp/netkingdom-sops-tools:$PATH PYTHONDONTWRITEBYTECODE=1 python3 -m pytest -p no:cacheprovider tests tools -q --tb=short" + }, + "syntax": "bash -n passed", + "whitespace": "git diff --check passed" + }, + "controls": [ + "Secret values and delegated diagnostics excluded from rotation stdout/stderr; xtrace disabled before input handling", + "Owned private regular single-link service file and private directories; symlink and duplicate/missing assignment refusals before cluster work", + "Atomic 0600 file replacement, candidate delivered on helper stdin rather than argv", + "Missing/ambiguous database discovery stops before mutation; SQL travels on stdin with ON_ERROR_STOP", + "Unattended LDAP manual-server step refuses instead of falsely completing", + "Break-glass uses private file input and server-side apply without forced field ownership", + "Make selector passed as environment data", + "Failures and declined rotation do not write last-rotated timestamps" + ], + "proof_limits": [ + "Synthetic credentials, fake cluster/service commands, no production credential or live rotation", + "Full suite uses disposable official SOPS 3.13.3 from prior receipt; no additional production tooling installed", + "Local candidate persists for approved custody/reconciliation; partial remote updates are possible, no transactional rollback guarantee", + "Timestamp proves successful script steps only; native adoption/old-value refusal remain unverified", + "Server-side apply does not remove any historical last-applied annotation; field conflicts fail closed", + "Delegated helper argv/annotation surfaces, admin-bootstrap mismatch/output and RSA rollback remain open", + "No hostile same-UID or OS/runtime isolation proof", + "CUST-WP-0073-T05 exposure rotation remains founder-deferred; source fixes do not revoke previously disclosed values" + ], + "source_implementation_decision_id": "9327e22b-40a2-48b1-abde-144a07987622", + "statehub_sync": { + "owner": { + "fail": 0, + "automation_error": 0, + "warn": 32, + "info": 5 + }, + "custodian": { + "fail": 0, + "automation_error": 0, + "warn": 7, + "info": 4 + }, + "custodian_note": "DB reconciliation succeeded; sandbox prevented the automatic working-memory Git commit. Scoped evidence committed separately." + }, + "progress_id": "c2abbf83-0e06-412f-920f-eca0ef89ec13" +} diff --git a/docs/evidence/2026-10-12-netkingdom-security/sec-dsm-requirement-ledger.json b/docs/evidence/2026-10-12-netkingdom-security/sec-dsm-requirement-ledger.json index cf631de2..303f243e 100644 --- a/docs/evidence/2026-10-12-netkingdom-security/sec-dsm-requirement-ledger.json +++ b/docs/evidence/2026-10-12-netkingdom-security/sec-dsm-requirement-ledger.json @@ -2,7 +2,7 @@ "assessed_at": "2026-10-12", "source": "security-canon/infospace/standards/devops-secrets-management/SecurityCanonDevOpsSecretsManagementStandard.md", "source_sha256": "f79a6dfe1067028810677426cb7e8c5be16735074121437f3cc97849d08fb72b", - "coverage": "All 116 numbered DSM headings: 20 anti-pattern references, six requirements assessed incomplete with scoped source evidence, 90 otherwise unverified. Unnumbered obligations in sections 29, 37, 38 and 39 remain in the gap analysis. No requirement is marked conformant.", + "coverage": "All 116 numbered DSM headings: 20 anti-pattern references, seven requirements assessed incomplete with scoped source evidence, 89 otherwise unverified. Unnumbered obligations in sections 29, 37, 38 and 39 remain in the gap analysis. No requirement is marked conformant.", "requirements": [ { "id": "DSM-TRANS-001", @@ -620,13 +620,14 @@ "closure_evidence": [], "assessment": { "scope": "NetKingdom bootstrap/custody source; broader requirement remains open", - "observed": "Custody input is removed on command return; decrypt failures remove staging. Make recovery publishes only a new private output and suppresses raw tool output.", - "remaining": "Successful recovery output requires operator cleanup; SIGKILL, child copy retention, other callers and native lifetime enforcement remain unverified.", + "observed": "Custody input is removed on command return; decrypt failures remove staging. Make recovery publishes only a new private output and suppresses raw tool output. Rotation file updates and database SQL use stdin, and break-glass uses private file input rather than plaintext argv literals.", + "remaining": "Successful recovery output requires operator cleanup; SIGKILL, child copy retention, other callers and native lifetime enforcement remain unverified. Rotation candidates deliberately remain in private files for custody/reconciliation; delegated child argv and partial native states are not closed.", "owner_task": "NK-WP-0049-T02/T03", "verification_evidence": [ "bootstrap-handoff.json", "custody-entrypoints.json", - "sops-make-entrypoints.json" + "sops-make-entrypoints.json", + "rotation-output.json" ], "assessed_at": "2026-10-12" } @@ -712,12 +713,22 @@ "normative_terms": [ "MUST NOT" ], - "status": "unverified", + "status": "incomplete", "gap_refs": [ "G04", "G09" ], - "closure_evidence": [] + "closure_evidence": [], + "assessment": { + "scope": "NetKingdom creds-rotate source and existing founder-deferred rotation; estate-wide adoption remains open", + "observed": "Reproduced missing database/unimplemented unattended LDAP steps falsely reaching completion. Source now refuses those cases and distinguishes successful script timestamps from native adoption. Synthetic apply/SQL failure tests prevent completion stamps.", + "remaining": "No native new-consumer acceptance, old-credential refusal or full copy/partial-state reconciliation. RSA rollback, admin-bootstrap mismatch and multi-consumer lifecycle remain unverified. CUST-WP-0073-T05 remains founder-deferred.", + "owner_task": "NK-WP-0049-T02/T03; CUST-WP-0073-T05", + "verification_evidence": [ + "rotation-output.json" + ], + "assessed_at": "2026-10-12" + } }, { "id": "DSM-ROT-004", @@ -1035,13 +1046,14 @@ "closure_evidence": [], "assessment": { "scope": "NetKingdom bootstrap/custody source; broader requirement remains open", - "observed": "Emergency/generation/custody tracing leaks repaired; Make decrypt now routes plaintext into a private file rather than the terminal.", - "remaining": "Legacy credential rotation and privacyIDEA admin-bootstrap output still expose values; direct editor/rotate and delegated helper review/native verification remain open.", + "observed": "Emergency/generation/custody tracing leaks repaired; Make decrypt now routes plaintext into a private file rather than the terminal. Rotation values/tracing/child diagnostics now remain off stdout/stderr in synthetic success and failure tests.", + "remaining": "privacyIDEA admin-bootstrap output and credential mismatch remain; direct editor/rotate and delegated helper review/native verification are open.", "owner_task": "NK-WP-0049-T02/T03", "verification_evidence": [ "bootstrap-handoff.json", "custody-entrypoints.json", - "sops-make-entrypoints.json" + "sops-make-entrypoints.json", + "rotation-output.json" ], "assessed_at": "2026-10-12" } diff --git a/docs/netkingdom-security-gaps.md b/docs/netkingdom-security-gaps.md index dfd70b88..2e0d8ddb 100644 --- a/docs/netkingdom-security-gaps.md +++ b/docs/netkingdom-security-gaps.md @@ -54,8 +54,8 @@ age helpers. Eight regressions failed before repair; all 206 repository tests no pass. Encryption refuses private-key files; decrypt requires explicit custody and publishes only complete private output. Hidden-input tracing, ambiguous modes, competing inline/key-command credentials and signal success-status bugs are -covered. Legacy rotation/admin output and direct editor/rotate/delegated callers remain -specific T02 findings; the Make setup/decrypt paths are repaired below. [Scoped receipt](evidence/2026-10-12-netkingdom-security/custody-entrypoints.json). +covered. At that revision, rotation/admin output and direct editor/rotate/delegated callers +remained T02 findings; subsequent Make and rotation repairs are recorded below. [Scoped receipt](evidence/2026-10-12-netkingdom-security/custody-entrypoints.json). G08 Make repair: NetKingdom `681c5b0` replaces permanent-key setup with public recipient validation and replaces stdout decrypt with explicit matching-key, @@ -66,6 +66,16 @@ output are removed from this path. All 227 tests pass with the actual disposable SOPS test binary; no production inputs were used. Existing root copies and the other caller findings remain open. [Receipt](evidence/2026-10-12-netkingdom-security/sops-make-entrypoints.json). +G08/G09 rotation repair: NetKingdom `6ae4708` suppresses generated values and raw +child diagnostics, validates private owned service files, writes candidates +atomically and passes database SQL on stdin. Missing/ambiguous database discovery +and unattended manual LDAP updates now stop instead of falsely completing. +Break-glass uses file input/server-side apply; Make treats the selector as data. +Twenty regressions failed before repair; all 252 repository tests pass afterward. +No live credential was rotated. Native adoption/revocation, partial-state recovery, +RSA rollback and the admin-bootstrap mismatch/output remain open. The requirement +ledger now separately assesses DSM-ROT-003 as incomplete. [Receipt](evidence/2026-10-12-netkingdom-security/rotation-output.json). + ## SEC DSM requirement coverage Each numbered requirement in these families is in scope for assessment. The @@ -136,8 +146,8 @@ reviews remain in the existing plans. Completion means verified closure of these findings and all applicable requirements, not merely publication of this plan. Individual requirement ledger: [116 numbered entries](evidence/2026-10-12-netkingdom-security/sec-dsm-requirement-ledger.json), -including 20 anti-pattern references, six requirements assessed incomplete with -scoped source evidence, and 90 otherwise unverified entries. The ledger records +including 20 anti-pattern references, seven requirements assessed incomplete with +scoped source evidence, and 89 otherwise unverified entries. The ledger records what each repair proves and what is missing; no requirement is marked conformant. [Source inventory](evidence/2026-10-12-netkingdom-security/source-inventory.json) records 21 repository revisions and their open workplans at initial inspection. The [scanner configuration inventory](evidence/2026-10-12-netkingdom-security/scanner-wiring-inventory.json) diff --git a/workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md b/workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md index adefc115..55280e66 100644 --- a/workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md +++ b/workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md @@ -117,6 +117,17 @@ proof. This neither executes deferred rotation nor admits a production SOPS version; the disposable binary's official checksum verification is scoped in the receipt. NK-WP-0049-T02/T03 and G08 remain open. +2026-10-12 G08/G09 rotation output repair: NetKingdom `6ae4708` pushed. +20 regressions failed against the old +NetKingdom source; 25 focused regressions and all 252 repository tests pass after +repair. Private file validation/atomic handoff, sanitized diagnostics, SQL stdin, +fail-closed database discovery and unattended LDAP refusal remove reproduced +source defects without executing founder-deferred rotations. DSM-ROT-003 now has +an explicit incomplete assessment (seven incomplete, 89 unverified, 20 anti-pattern +references). Native adoption/old-value refusal and admin-bootstrap/RSA/delegated +source gaps remain in NK-WP-0049. Receipt: `rotation-output.json`. + + ## Verify native closure against every requirement ```task