5.8 KiB
5.8 KiB
Security close-down checklist
Owner: the-custodian, on behalf of the founder. Started: 2026-10-03. Purpose: while the estate is in build mode (orientation §0), agents may fix, simplify or relax parts of the security layer. Every such relaxation, and every control known to be unarmed, is listed here. At the production close-down the founder works this list, arms each item, and hands over the keys. After that, changes to the security system need elevated clearance.
Add a row whenever you loosen, shortcut or leave unarmed a control. Remove nothing; mark items armed with date and evidence.
| # | Control | Current state (build mode) | Re-arm at close-down | Owner | Added |
|---|---|---|---|---|---|
| 1 | Warden secret-fetch policy check (check_fetch_policy) |
Misrouted to the ops-warden SSH signing pin; caller auth there binds only ops-warden, so every other owner gets 403. Bug reports: ops-warden faf11061, access-engine b792c5d0. access-engine built a separate pin flex-auth-ops-warden-fetch (package ops-warden.secret.read v1, allowed set generated from the routing catalog, deny by default, caller auth enforced; access-engine 02b15a7). Deployed 2026-10-03 (access-engine 424f1e5, release flex-auth-ops-warden-fetch, ClusterIP 10.43.151.3, tunnel :19091). Probes: allow ×2; deny unknown_need, wrong_system, wrong_resource_type; unbound system 403; no token 401. ops-warden routes fetch checks there (7d4381e, live fetch_flex_auth_url set). The gate is armed with a correct policy; its residuals are rows 5 and 6. |
Fetch checks go to an evaluator with an explicit secret-read policy per owner system, deny by default, caller auth enforced; positive and negative evidence recorded. | ops-warden, access-engine | 2026-10-03 |
| 2 | informed-decision posing path | Each memo needs an attended requester login, a hand-edited exact-record admission package and a manual store load. Redesign specified in informed-decision docs/specs/FrictionlessDecisionIntake.md, workplan INFD-WP-0005 (a973d36; intake validation and hub write-back built and tested, nothing deployed). Its build-mode relaxations are rows 7–14; mark each live as it lands. |
Attribute-based admission and workload-identity intake, with humans-only binding, MFA freshness, one question per memo and audit evidence verified. | informed-decision, access-engine, approval-engine | 2026-10-03 |
| 3 | State Hub qualifier sync (C-41) | statehub fix-consistency reports PASS without pushing wait qualifiers; the direct checker run works. Reported: state-hub 70d08f35. |
CLI path fixed and covered by a regression test; hub decision and gate data trusted again. | state-hub | 2026-10-03 |
| 4 | Provenance of platform/workloads/tenant-engine/audit-core-sender v1 |
Value is correct (already_identical), but nothing records who first seeded it. |
Audit-trail entry reconstructed or the secret rotated under a recorded lane. | railiance-platform, ops-mason | 2026-10-03 |
| 5 | Fetch-pin subject identity | subject.id is asserted by warden (its subject env, or operator). The caller binding proves ops-warden asked, not which human operator did. |
Bind the subject to an attended human identity (KeyCape/NetKingdom claim) on fetch checks. | access-engine, ops-warden | 2026-10-03 |
| 6 | Fetch-pin lane set baked into the image | Any change to a secret lane in the catalog needs a regeneration (tools/gen_ops_warden_fetch.py) and an image rebuild. A new owner system also needs a binding redeploy. secrets-engine owns no lane and has no binding yet. |
Lane changes flow through a reviewed regeneration pipeline, or the policy data is loaded at runtime with integrity checks. | access-engine | 2026-10-03 |
| 7 | informed-decision intake submitters (R1) | Posing is no longer operator-gated: any listed intake submitter can put a memo in front of the founder. Not yet live (INFD-WP-0005). | Submitter and memo-class lists are reviewed data with a signed regeneration path. | informed-decision, access-engine | 2026-10-03 |
| 8 | Posing via State Hub (R2) | Workstation agents pose through State Hub, whose API is unauthenticated on the loopback tunnel; drafted_by is asserted. Not yet live. |
The hub authenticates its writers before forwarding; the forwarded submitter carries that identity. | state-hub | 2026-10-03 |
| 9 | Admission on carried context (R3) | The decision point decides on context the review service carries (approval requester, human_control, digest, submitter, class). Not yet live. | access-engine verifies a signed approval-engine claim and a signed intake receipt itself. | access-engine, approval-engine, informed-decision | 2026-10-03 |
| 10 | Requester client credential custody (R4) | The informed-decision-sitting-requester client credential moves from attended custody into workload custody (ESO into the review pod). Not yet live. |
Rotation schedule, ESO read audit, sibling-path denial proof. | railiance-platform | 2026-10-03 |
| 11 | Admission data baked into the image (R5) | Admitted classes and submitters are baked into the access-engine image. Not yet live. | Runtime-loaded policy data with integrity checks, or a reviewed regeneration pipeline (as row 6). | access-engine | 2026-10-03 |
| 12 | Hub decision write-back (R6) | Answered memos resolve hub decisions through the unauthenticated hub API. Not yet live. | The hub requires the informed-decision workload identity on resolve and records it. | state-hub | 2026-10-03 |
| 13 | Approval create idempotency (R7) | No idempotency key on approval create; a crash can leave orphan draft approvals. Not yet live. | Idempotent approval create. | approval-engine | 2026-10-03 |
| 14 | Founder notification channel (R8) | The founder is notified only through the hub inbox. Not yet live. | An authenticated notification channel carrying only id and question. | informed-decision | 2026-10-03 |