17 KiB
17 KiB
Security close-down checklist
Owner: the-custodian, on behalf of the founder. Started: 2026-10-03. Purpose: while the estate is in build mode (orientation §0), agents may fix, simplify or relax parts of the security layer. Every such relaxation, and every control known to be unarmed, is listed here. At the production close-down the founder works this list, arms each item, and hands over the keys. After that, changes to the security system need elevated clearance.
Add a row whenever you loosen, shortcut or leave unarmed a control. Remove nothing; mark items armed with date and evidence.
| # | Control | Current state (build mode) | Re-arm at close-down | Owner | Added |
|---|---|---|---|---|---|
| 1 | Warden secret-fetch policy check (check_fetch_policy) |
Misrouted to the ops-warden SSH signing pin; caller auth there binds only ops-warden, so every other owner gets 403. Bug reports: ops-warden faf11061, access-engine b792c5d0. access-engine built a separate pin flex-auth-ops-warden-fetch (package ops-warden.secret.read v1, allowed set generated from the routing catalog, deny by default, caller auth enforced; access-engine 02b15a7). Deployed 2026-10-03 (access-engine 424f1e5, release flex-auth-ops-warden-fetch, ClusterIP 10.43.151.3, tunnel :19091). Probes: allow ×2; deny unknown_need, wrong_system, wrong_resource_type; unbound system 403; no token 401. ops-warden routes fetch checks there (7d4381e, live fetch_flex_auth_url set). The gate is armed with a correct policy; its residuals are rows 5 and 6. |
Fetch checks go to an evaluator with an explicit secret-read policy per owner system, deny by default, caller auth enforced; positive and negative evidence recorded. | ops-warden, access-engine | 2026-10-03 |
| 2 | informed-decision posing path | Each memo needs an attended requester login, a hand-edited exact-record admission package and a manual store load. Redesign specified in informed-decision docs/specs/FrictionlessDecisionIntake.md, workplan INFD-WP-0005 (a973d36; intake validation and hub write-back built and tested, nothing deployed). Its build-mode relaxations are rows 7–14; mark each live as it lands. |
Attribute-based admission and workload-identity intake, with humans-only binding, MFA freshness, one question per memo and audit evidence verified. | informed-decision, access-engine, approval-engine | 2026-10-03 |
| 3 | State Hub qualifier sync (C-41) | statehub fix-consistency reports PASS without pushing wait qualifiers; the direct checker run works. Reported: state-hub 70d08f35. |
CLI path fixed and covered by a regression test; hub decision and gate data trusted again. | state-hub | 2026-10-03 |
| 4 | Provenance of platform/workloads/tenant-engine/audit-core-sender v1 |
Value is correct (already_identical), but nothing records who first seeded it. |
Audit-trail entry reconstructed or the secret rotated under a recorded lane. | railiance-platform, ops-mason | 2026-10-03 |
| 5 | Fetch-pin subject identity | subject.id is asserted by warden (its subject env, or operator). The caller binding proves ops-warden asked, not which human operator did. |
Bind the subject to an attended human identity (KeyCape/NetKingdom claim) on fetch checks. | access-engine, ops-warden | 2026-10-03 |
| 6 | Fetch-pin lane set baked into the image | Any change to a secret lane in the catalog needs a regeneration (tools/gen_ops_warden_fetch.py) and an image rebuild. A new owner system also needs a binding redeploy. secrets-engine owns no lane and has no binding yet. |
Lane changes flow through a reviewed regeneration pipeline, or the policy data is loaded at runtime with integrity checks. | access-engine | 2026-10-03 |
| 7 | informed-decision intake submitters (R1) | Posing is no longer operator-gated: any listed intake submitter can put a memo in front of the founder. Not yet live (INFD-WP-0005). | Submitter and memo-class lists are reviewed data with a signed regeneration path. | informed-decision, access-engine | 2026-10-03 |
| 8 | Posing via State Hub (R2) | Workstation agents pose through State Hub, whose API is unauthenticated on the loopback tunnel; drafted_by is asserted. Not yet live. |
The hub authenticates its writers before forwarding; the forwarded submitter carries that identity. | state-hub | 2026-10-03 |
| 9 | Admission on carried context (R3) | The decision point decides on context the review service carries (approval requester, human_control, digest, submitter, class). Not yet live. | access-engine verifies a signed approval-engine claim and a signed intake receipt itself. | access-engine, approval-engine, informed-decision | 2026-10-03 |
| 10 | Requester client credential custody (R4) | The informed-decision-sitting-requester client credential moves from attended custody into workload custody (ESO into the review pod). Not yet live. |
Rotation schedule, ESO read audit, sibling-path denial proof. | railiance-platform | 2026-10-03 |
| 11 | Admission data baked into the image (R5) | Admitted classes and submitters are baked into the access-engine image. Not yet live. | Runtime-loaded policy data with integrity checks, or a reviewed regeneration pipeline (as row 6). | access-engine | 2026-10-03 |
| 12 | Hub decision write-back (R6) | Answered memos resolve hub decisions through the unauthenticated hub API. Not yet live. | The hub requires the informed-decision workload identity on resolve and records it. | state-hub | 2026-10-03 |
| 13 | Approval create idempotency (R7) | No idempotency key on approval create; a crash can leave orphan draft approvals. Not yet live. | Idempotent approval create. | approval-engine | 2026-10-03 |
| 14 | Founder notification channel (R8) | The founder is notified only through the hub inbox. Not yet live. gate-house F3: any hub writer could send a fake memo notice. | An authenticated notification channel carrying only id and question. | informed-decision | 2026-10-03 |
| 15 | Posing volume (gate-house F2) | With posing ungated, a submitter can flood the founder with memos; habituation would turn the human control into theatre. A per-submitter volume cap is a SHOULD in build mode. | Per-submitter volume budget enforced (MUST). | informed-decision | 2026-10-03 |
| 16 | Intake doctrine conditions (gate-house C1–C6) | Draft ruling GH-DEC-2026-023 (gate-house aac350d, status proposed, awaiting the founder). C1–C6 apply now; R3 (row 9) is the main relaxation (F1), R2 (row 8) also covers C6, R5 (row 11) also covers C5. |
Remove the compact-sitting exact-record branch once its memos are terminal; re-arm R3 with an access-engine approval-claim check and a signed intake receipt. |
gate-house, informed-decision, access-engine | 2026-10-03 |
| 17 | Owner reviews and approval recording (canon delegated-owner-review_v0.1) |
Owner reviews required by CCRs and similar records are written by each owner repo's worker agent from its INTENT.md, not by a human owner. The requesting agent records the founder's resolved hub decision (status, binding confirmations, admission markers) and commits. The founder still decides; decided_by is unauthenticated (rows 8, 12). |
Reviews and recordings signed by authenticated agent workload identities; recording tooling verifies an authenticated human resolver; human owner review restored for red-lane records if wanted. | the-custodian | 2026-10-07 |
| 18 | Ordinary authenticated operator/PDP admission for User Engine application.register | Executed one-use exception USER-CATALOGUE-INFDEC-20261011-R1 under confirmed founder approval b859698b-5d08-4da5-9599-4760c6a799f1 (02:07:09Z). Exact executor b0dbbb97 and transport3e594e0e; packet307c4fc5, grant SHA 72ee846034809f4ae6848eac3a43f2b7390f1df7a67ede50eff7435d1b43f839. Two exact informed-decision catalogue records committed; genuine denial retained, three truthful audits, one consumed ledger and unsent/unclaimed registered event verified. Private grant removed. Ordinary management admission remains unmet; no IAM/human claim/future registration/targeted replay authority. Execution deadline2026-10-12T23:59:59Z does not erase facts. Outcome. | Before customer production, supported authenticated operator management with genuine ordinary allow/deny/attribution and unavailable refusal; retire bootstrap use, preserve/reconcile ledger/audits/events. Broader USER-WP-0026-T03/USER-WP-0028-T02 remain live; no human journey completion inferred. | user-engine, access-engine; Custodian tracks | 2026-10-11 |
| 19 | Fresh informed-decision readback during a failed T05 rollout | Exact new trial INFD-WP-0009-T05/zlib85091-r1 approved under founder acceptance b5ce337c-5d7d-44fa-864d-706b54039f7c at2026-10-11T10:40:55Z. Image f558/source312ab97 verified Ready and actual canonical lifecycle HTTP200 at11:20:25Z, with latest database preserved. Proposed bounded30minute manual outage recovery was expressly accepted but never invoked; trial completed. Original proposed packet and pre-execution refusals remain immutable. Outcome. | Completed2026-10-11. Ordinary fresh-authority gate retained; no standing cached authority, autonomy promotion, other-trial or customer-production reuse. Any future standing recovery mechanism needs independently obtainable authority and separate review. | informed-decision, railiance-platform; Custodian tracks | 2026-10-11 |
| 20 | Unattended origin publication for assembly-economics checkpoints | rein-aharness approach assembly-checkpoint pushes to coulomb/assembly-economics origin without an attended session, limited to checkpoints/, fast-forward only, rebase-once, never force (mirrors the FI brief grant). Founder-approved 2026-10-12: assembly-economics docs/decisions/2026-10-12-checkpoint-origin-publication.md. Runs on legacy profile-absent routing until 2026-12-31. |
Publication through rein-aharness's governed publish lane with a per-repo, path-scoped grant and a governed execution profile; legacy route removed. | rein-aharness / assembly-economics | 2026-10-12 |
| 21 | Independent repository secret detection and response (CUST-WP-0080 G07) | Scanner active on 22 workstation checkouts and 166 of 167 Forgejo repositories. Exact expansion of 143 targets passed native SSH scanner verdicts and final cleanup audit; one repository with four external submodules remains builtin-only. Expansion evidence. Template inheritance deployed October 13; its first rollout broke scanner custody permissions and is retained as failed. Recovery adds a pinned startup guard; two Kubernetes replacements (generations 13/14) pass 0755 custody and native clean/secret/quarantine/recovery checks. Thirty isolated configuration/lifecycle/rollback checks pass; authenticated production API/SSO/frontend acceptance remains open. Import/mirror fetch, historical/LFS/log/artifact coverage and private finding response remain open. Recovery evidence. | Complete FORGE-WP-0006 and RMGR-WP-0021: admit the full repository denominator, persist/reconcile hooks across creation and lifecycle, verify deployed write paths and unsupported input handling, and prove private detection-to-response with existing custody owners. Rejection alone does not revoke prior exposure; CUST-WP-0073-T05 remains founder-deferred. | railiance-forge, repo-manager; Custodian coordinates | 2026-10-13 |
| 22 | CI runner authority boundary (CUST-WP-0080 G12) | Reproduced unauthenticated cross-pod Docker access is closed: same-image generation 4 listens on loopback only, local ping and heartbeat pass, peer pod denied. Evidence. Host-mode jobs still share the privileged runner; no full isolation or job-scoped credential claim. | Complete native workflow authority, required detection checks, job identity/expiry and privileged runner trust boundaries under FORGE-WP-0006 / RMGR-WP-0021. Preserve loopback-only listener across deployments. | railiance-forge, railiance-enablement, railiance-platform; source railiance-apps | 2026-10-13 |
| 23 | Traefik HTTPS upload read budget | Activated 2026-10-13 under the founder-approved publication fix: shared websecure readTimeout raised from 60s to bounded 600s. Traefik generation 2 Ready; five previously failing Forgejo OCI blobs completed in 85–183s, exact tested image digest published. Evidence: railiance-cluster RCLUSTER-WP-0016 and rapp-playwright/docs/evidence/2026-10-13-publication.md. TLS and registry authentication stay enforced. | At production close-down review the 600s body-read budget and slow-upload exposure; retain a measured artifact-upload budget or isolate the registry entry point. Do not disable timeouts. | railiance-cluster / railiance-forge | 2026-10-13 |
| 24 | Metered spend settlement (rein-aharness spend envelopes) | Opt-in per envelope since 2026-10-14 (rein-aharness c7dceee, c04d1c6; owner decision a93619a9): settlement: observed-usage charges a completed provider request its gateway-metered cost (provider-reported tokens at admitted rates) instead of its full hold, and a run max(metered requests, reported/attested cost). Unfinished requests keep full hold; overrun still freezes the envelope; full-hold stays the default. First use: memo infd-20261014-b01 (3 attempts, EUR 10). Provider-reported usage is trusted until billing is compared. |
Compare each observed-usage envelope's charges with provider billing before renewal; decide whether observed-usage stays allowed or envelopes return to full-hold. | rein-aharness, owner | 2026-10-14 |
| 25 | WP-80 functional delivery before full security acceptance | Founder decision 9663d4ca-3793-4ad7-9dc1-954001d43596 prioritizes working development flows and permits later hardening. Actual Playwright human/agent commands pass through the existing authenticated workstation port-forward; this is a supervised build profile, without independent per-caller identity acceptance. No credentials distributed, new target enabled or installed control disabled. Nineteen full checkpoints and six remaining acceptance scopes transfer to live CUST-WP-0082; ledger statuses and the full target stay unchanged. Scope and evidence. |
Promote/revalidate relevant hardening before customer production, target expansion or broader unattended authority. Verify the full current-identity, per-caller transport/isolation, lifecycle, recovery and audit criteria in CUST-WP-0082; close all 16 target gates and reconcile all 116 ledger entries. No automatic production approval or blanket formal requirement exception. | Custodian coordinates; existing KeyCape / Platform / NetKingdom / Forge / Apps / custody and audit owners implement | 2026-10-18 |
| 26 | Proposed temporary Forgejo public-PKCE build profile | Not activated. Proposal CUST80-FORGEJO-PUBLIC-BUILD-20261018 r2, SHA fcea2cd32b8ee2634d2ebeb9ef4b659b6b85f8a4878413ed96e5d06cb09892c3, awaits actual founder decision ad88edeb-7c7c-486f-a695-1a7abae5b20c and independent NetKingdom/Apps/KeyCape reviews. Candidate uses the unchanged Forgejo release, exact callback, S256 and required MFA, preserving local sign-in and existing account permissions. It intentionally defers the accepted confidential-client secret/delivery/full case lifecycle; no value is generated or distributed and no current control is disabled by preparation. Packet. |
If activated, complete the confidential-client registration and issuer/consumer custody path plus original full security acceptance under CUST-WP-0082-T20 and existing owners when promoted; revalidate before customer production or broader unattended authority. Record actual approval/execution and preserve rollback/unknown outcomes. | Custodian coordinates; NetKingdom, railiance-apps, key-cape; Platform owns later confidential custody | 2026-10-18 |
| 27 | Owner-review digest of the flex-auth signer native admission (railiance-platform RPF-WP-0035-T14, CCR-2026-0050) | scripts/flex_auth_signer_native.py owner reviews now bind the admission scope without expires_at. Before, all five reviews had to bind an exact expiry at most 120 s ahead, which made asynchronous reviews impossible to collect. The 5–120 s freshness check at invocation is unchanged, and every other scope field (kid, image, CCR, source bundle, bindings, routing, operation id, founder entity) stays bound. Reviewers no longer approve the exact execution second; the founder still runs the single attended window. Source only, nothing executed. |
Decide whether reviews should bind a reviewed scheduled window (start/end) again, e.g. a reviewed window_not_before/window_not_after pair bound in the digest with expires_at inside it. |
railiance-platform | 2026-10-21 |