From be589184c721e3e5a923d43d94e49bbb5dc7d8e2 Mon Sep 17 00:00:00 2001 From: codex Date: Tue, 20 Oct 2026 23:26:28 +0200 Subject: [PATCH] CUST-WP-0073: attended cutover steps 1-7 done; record evidence and remaining step 8/9 Co-Authored-By: Claude Opus 5.5 --- ...026-10-20-railiance01-cutover-steps-2-4.md | 25 +++++++++++++++++++ ...UST-WP-0073-agent-credential-separation.md | 25 ++++++++++++++++++- 2 files changed, 49 insertions(+), 1 deletion(-) diff --git a/docs/evidence/2026-10-20-railiance01-cutover-steps-2-4.md b/docs/evidence/2026-10-20-railiance01-cutover-steps-2-4.md index d214386..982ccc9 100644 --- a/docs/evidence/2026-10-20-railiance01-cutover-steps-2-4.md +++ b/docs/evidence/2026-10-20-railiance01-cutover-steps-2-4.md @@ -29,3 +29,28 @@ no system:masters; **597/597 checks denied, granted [], undetermined []**. Recei `2026-10-20-custodian-agent-kube-denials-receipt.json`. A first run reported 500+ failures that were transient request errors through the tunnel (spot checks all answered "no"); the verifier now retries errors and reports `granted` separately from `undetermined`, so an error can never read as a pass or a grant. + +## Steps 1, 7 (SSH) and host-side proof + +- **flex-auth**: `warden sign agt-custodian` was first denied `unknown_actor_resource` (registry baked into + the image). access-engine FLEX-WP-0037 (`9132f9b`, `b429dcb`) added the actor; founder-approved + `helm upgrade flex-auth-ops-warden` → revision 3, image `sha256:f7c04991…`, 1/1 ready (rollback: revision 2). + After upgrade both an existing actor and agt-custodian pass the gate (stop at the Vault token stage). +- **warden config**: `vault.addr` pointed at `https://bao.coulomb.social`, now an internal-only page (HTTP 404); + founder's `~/.config/warden/warden.yaml` switched to the bridge tunnel `http://127.0.0.1:18200` (backup kept). +- **Stale warden install**: `uv tool install --force` had reused a cached wheel without WARDEN-WP-0045's + extension code, so the first certificate (founder-issued via `credential.py exec --grant ops-warden/warden-sign`, + valid 2026-10-20T23:16Z–2026-10-21T11:16Z, principal agt-custodian) carried **no extensions** — safe but no pty. + Reinstalled editable from the checkout; reissue pending. +- **Host proof as custodian-agt** (from the custodian-agents distro, certificate login): + uid 1001 own group only; `sudo -n` → password required; `/etc/rancher/k3s/{k3s,registries,config}.yaml` + unreadable; `/home/tegwick` not searchable; containerd socket not writable; the agent certificate is + refused for `tegwick` (Permission denied (publickey)); local forward to 6443 → "administratively prohibited"; + `ssh -A` gives no SSH_AUTH_SOCK; pty refused (no extension). +- **Step 1 root cause**: `openbao-apply-ssh-engine.sh` never wrote roles (passed `bao` twice → exit 127, + "failed to write role adm-role"); fixed in railiance-platform `4b2b72a`. Founder read the live roles first: + adm/agt/atm matched the spec exactly except unset `allowed_extensions`; `default_extensions` empty on all. + Founder re-ran the apply; `agt-role` `allowed_extensions` = `permit-pty`. +- **Reissued certificate** (founder, operator account, warden from checkout): valid 2026-10-20T23:24Z– + 2026-10-21T11:25Z, principal `agt-custodian`, extensions `permit-pty` only. From the distro: pty session + as custodian-agt works; local forward still "administratively prohibited". diff --git a/workplans/CUST-WP-0073-agent-credential-separation.md b/workplans/CUST-WP-0073-agent-credential-separation.md index 92d91dc..a015f55 100644 --- a/workplans/CUST-WP-0073-agent-credential-separation.md +++ b/workplans/CUST-WP-0073-agent-credential-separation.md @@ -87,7 +87,7 @@ id: CUST-WP-0073-T02 status: progress priority: high depends_on: [] -blocking_reason: "Owner source delivered and pushed 2026-10-20 (RPF-WP-0062, RCLUSTER-WP-0019, RAIL-HO-WP-0014, WARDEN-WP-0045, GEXEC-WP-0001). Remaining: attended cutover per docs/changes/CUST-WP-0073/ATTENDED-CUTOVER.md and actual-account proof." +blocking_reason: "Attended cutover steps 1-7 and the Kubernetes/host denial proofs are done (2026-10-20). Remaining: gated-executor install and approved/changed-action proof (step 8/9), then T04 documentation." state_hub_task_id: "4b88b0b7-dc7e-5612-aa5d-1a08f0530c35" ``` @@ -493,3 +493,26 @@ closed-egress design. The ordered attended sequence, proofs and re-arm list are in `docs/changes/CUST-WP-0073/ATTENDED-CUTOVER.md`. Nothing live was changed; T02 acceptance still requires that cutover and the actual-account proof. + +## Attended cutover — 2026-10-20 (evening) + +With the founder present, following `docs/changes/CUST-WP-0073/ATTENDED-CUTOVER.md`: + +- Workstation: dedicated WSL2 distro `custodian-agents`, account `custodian-agt` (no sudo, no + Windows drives; `interop=false` enforced on the Windows side, verified by probe). Codex, Claude + Code and Grok Build installed and logged in by the founder; Codex desktop connects over loopback SSH. +- railiance01: admin kubeconfig mode 0600 (RCLUSTER-WP-0019); restricted host account and + `agt-custodian` principal (RAIL-HO-WP-0014). The posture check also found `registries.yaml` + world-readable with a registry login since 2026-05-02; it is now 0600 and kept so by the playbook. +- Credentials: 24h ServiceAccount token and 12h `permit-pty`-only certificate, both issued by the + founder from the operator account via `workstation-agents-r4/issue-agent-credentials.sh`. + Getting there required a flex-auth image rollout (access-engine FLEX-WP-0037), the warden Vault + address moved to the bridge tunnel, an editable warden install, and a fix to the OpenBao role writer + (railiance-platform `4b2b72a`), which had never written roles. +- Proof from the agent account: Kubernetes identity `custodian-agents:custodian-agent`, no + `system:masters`, 597/597 denials over 48 namespaces (receipt in `docs/evidence/`). On the host: no + sudo, k3s files unreadable, `tegwick` refused, forwarding prohibited, no agent socket. + +Still open in T02: install `gated-executor` and prove an approved action executes while a changed or +unapproved one is refused. T04 then documents this verified path. T05 is unchanged. +