From b14cbf2a8badce9d11b6de76e028cbeeef7d5b03 Mon Sep 17 00:00:00 2001 From: codex Date: Wed, 9 Sep 2026 02:30:11 +0200 Subject: [PATCH] docs: record completed factory verifier identity milestone --- ...6-09-09-helixforge-verifier-admission.json | 137 ++++++++++++++++++ ...026-09-09-helixforge-verifier-admission.md | 52 +++++++ 2 files changed, 189 insertions(+) create mode 100644 docs/assessments/2026-09-09-helixforge-verifier-admission.json create mode 100644 docs/assessments/2026-09-09-helixforge-verifier-admission.md diff --git a/docs/assessments/2026-09-09-helixforge-verifier-admission.json b/docs/assessments/2026-09-09-helixforge-verifier-admission.json new file mode 100644 index 0000000..80080eb --- /dev/null +++ b/docs/assessments/2026-09-09-helixforge-verifier-admission.json @@ -0,0 +1,137 @@ +{ + "owner_repositories": [ + { + "repo": "railiance-platform", + "commit": "c6dc4286e2c51f1f243f8231f7f508fba7d12916", + "remote_matches": true, + "worktree_clean": true + }, + { + "repo": "net-kingdom", + "commit": "303a584bd0d46b8efe34458e51f84380e7fee46e", + "remote_matches": true, + "worktree_clean": true + }, + { + "repo": "key-cape", + "commit": "0f5535eed95f1223c83a28f5a0bd6fa594cecae8", + "remote_matches": true, + "worktree_clean": true + }, + { + "repo": "prj-helixforge-factory", + "commit": "f5e80db53faf4bfc6169496b7a129acc6d60d644", + "remote_matches": true, + "worktree_clean": true + } + ], + "source_hub_parity": { + "tasks": [ + { + "task": "KEY-WP-0013-T02", + "status": "done", + "needs_human": false, + "source_fields_match": true, + "supported_patch_fields": [ + "description" + ] + }, + { + "task": "RPF-WP-0035-T05", + "status": "progress", + "needs_human": false, + "source_fields_match": true, + "supported_patch_fields": [] + }, + { + "task": "HFACT-WP-0001-T01", + "status": "wait", + "needs_human": false, + "source_fields_match": true, + "supported_patch_fields": [] + }, + { + "task": "HFACT-WP-0001-T02", + "status": "progress", + "needs_human": false, + "source_fields_match": true, + "supported_patch_fields": [] + }, + { + "task": "HFACT-WP-0001-T03", + "status": "wait", + "needs_human": false, + "source_fields_match": true, + "supported_patch_fields": [] + }, + { + "task": "HFACT-WP-0001-T04", + "status": "wait", + "needs_human": false, + "source_fields_match": true, + "supported_patch_fields": [] + }, + { + "task": "HFACT-WP-0001-T05", + "status": "wait", + "needs_human": false, + "source_fields_match": true, + "supported_patch_fields": [] + }, + { + "task": "HFACT-WP-0001-T06", + "status": "wait", + "needs_human": false, + "source_fields_match": true, + "supported_patch_fields": [] + }, + { + "task": "HFACT-WP-0001-T07", + "status": "wait", + "needs_human": false, + "source_fields_match": true, + "supported_patch_fields": [] + }, + { + "task": "HFACT-WP-0001-T08", + "status": "wait", + "needs_human": false, + "source_fields_match": true, + "supported_patch_fields": [] + } + ] + }, + "milestone": { + "ccrs_verified": 2, + "keycape_service_registration_task": "done", + "factory_identity_integration_task": "wait", + "automated_tests": 71, + "fresh_human_login": "passed", + "custody_versions": [ + 1, + 1 + ] + }, + "live_readback": { + "deployment_generation": 38, + "ready_replicas": 1 + }, + "progress_events": [ + { + "workplan_id": "6e815d88-b0e3-5ce0-be5d-13ab15917f7f", + "task_id": "607897c5-bad9-55e5-86df-7802f592d6e8", + "progress_id": "5a464f19-4c38-4b10-96d0-2c6a3924315b" + }, + { + "workplan_id": "975db491-5412-5e27-8e34-14a2417bb039", + "task_id": "e15d62c9-e5da-5721-a135-87c050f7851c", + "progress_id": "0ff5f488-d404-4d1d-8517-cd843c035ae7" + }, + { + "workplan_id": "ed4fe524-036f-5221-8deb-00e24e944de1", + "task_id": "67c80db1-01ba-54f1-80ff-76398f9e7823", + "progress_id": "3174a97f-42ae-446c-a931-3dd0291dff12" + } + ], + "live_evidence": "net-kingdom:docs/evidence/2026-09-09-keycape-verifier-admission.json" +} diff --git a/docs/assessments/2026-09-09-helixforge-verifier-admission.md b/docs/assessments/2026-09-09-helixforge-verifier-admission.md new file mode 100644 index 0000000..7fa0fbe --- /dev/null +++ b/docs/assessments/2026-09-09-helixforge-verifier-admission.md @@ -0,0 +1,52 @@ +# HelixForge: verifier identity milestone accepted + +The approved CCR-2026-0017/0018 rollout is complete. Both credential requests +are verified, and KEY-WP-0013-T02 is done. The factory programme remains active; +this closes its verifier identity prerequisite. + +Two independent version-1 credentials now reach KeyCape through their approved +OpenBao policies, Kubernetes roles and ESO stores. Both stores are Valid and +both ExternalSecrets are SecretSynced. The pinned KeyCape image has one ready +replica. Both service clients passed live signature, exact claim and 900-second +lifetime checks, wrong-secret rejection and excess-scope denial. Existing human +OpenBao login passed before and after replacement. Attended sessions self-revoked. + +Native custody checks proved sibling-path and parent-listing denial, wrong +service-account and namespace rejection, outside-namespace store refusal, +reader revocation and coding-agent deny precedence. The signing key and unrelated +configuration bytes were preserved. No credential value entered Git or Hub records. + +The work removes recurring manual steps: named reviews are recorded once; +provisioning, verification and recovery are executable; a failed rollout can +resume without regenerating credentials. Failed attempts exercised compatible +configuration/image rollback and exposed three verification assumptions that +are now corrected: containerd manifest identity, verifier execution location, +and small clock differences. The workstation also needs its explicit Railiance +kubeconfig. These are observed improvements to the procedure, not measured +staff-hour savings or evidence of sustained factory throughput. + +Validation comprises 71 automated tests, a disposable pinned-image HTTPS exercise +running the exact native verifier, live custody/client checks and a fresh human +login. Future issued-at timestamps use KeyCape's existing 30-second bound; +expiry and not-before remain strict. Initial provisioning did not exercise +natural JWT expiry or actual predecessor rotation. + +The next critical-path records are: + +1. RPF-WP-0035-T05: separate client-side credential admission and delivery. +2. AUDIT-WP-0009-T09 and APPROVAL-WP-0002: audit custody, deployed approval + startup and real claim/consume acceptance. +3. SECRETS-WP-0009-T03: native credential delivery with expiry/revocation proof. +4. HFACT-WP-0001-T01/T04/T05: exact factory actor/profile/grants and spend contract, + Railiance placement, then natural worker lifecycle and recovery proof. + +KEY-WP-0013-T05 retains the separate approval UI callback/MFA requirement. +HFACT-WP-0001-T02 retains the known projection-field and idempotency defects; +successful synchronization here does not fix those systemic issues. No paid +factory execution or fourteen-day observation has started. Reuse-surface remains +the first internal capability, Railiance Fabric the subsequent integration option, +and vergabe-teilnahme the primary customer product repository. + +Authoritative evidence: [accepted verifier receipt](/home/worsch/net-kingdom/docs/evidence/2026-09-09-keycape-verifier-admission.json), +[owner rollout and recovery](/home/worsch/net-kingdom/docs/keycape-approval-clients-rollout.md), +and [current factory admission sequence](/home/worsch/prj-helixforge-factory/operations/identity-admission.md).