254 lines
16 KiB
JSON
254 lines
16 KiB
JSON
{
|
|
"id": "CUST81-PRIVATE-READER-PROVISIONING-PREPARATION-R1",
|
|
"revision": 1,
|
|
"prepared_at": "2026-10-14T22:35:18.623823+00:00",
|
|
"status": "prepared; owner review and exact credential/live-change authorization pending; not executable",
|
|
"scope": "Enable native reuse-surface hosted acquisition of exactly the seven consented private repository capability indexes, without changing repository visibility.",
|
|
"authorization": {
|
|
"metadata_consent": "docs/assessments/netkingdom-2026-10-14/private-source-owner-consent-r1.json",
|
|
"metadata_consent_sha256": "4a4602ad926e3af855d6ddba4731430d33e4a7432c507ba0a5193b9f43056b52",
|
|
"disclosure_packet": "docs/assessments/netkingdom-2026-10-14/private-source-disclosure-proposal-r1.json",
|
|
"disclosure_packet_sha256": "46ac4fe49a08054cc215aade2fbaf3b36ee334520997857ed84f530b52da9d35",
|
|
"credential_provisioning_approved": false,
|
|
"live_rollout_approved": false,
|
|
"independent_owner_reviews": "pending; not authored or inferred"
|
|
},
|
|
"existing_reader_search": {
|
|
"result": "No reuse-surface private-reader CCR or construction plan found in platform CCR directory or ops-mason plans. Existing CCR0005 is runtime writer/webhook custody; CCR0044/0045 concern caller writer access.",
|
|
"precedent": "CCR-2026-0031 core-hub source read is dedicated read:repository, but estate-wide repository membership must not be reused for this seven-repository lane."
|
|
},
|
|
"proposed_identity": {
|
|
"forgejo_user": "reuse-surface-source",
|
|
"forgejo_org": "coulomb",
|
|
"forgejo_team": "reuse-surface-source-readers",
|
|
"restricted": true,
|
|
"is_admin": false,
|
|
"visibility": "private",
|
|
"password": "random value retained only in attended process memory; never stored in evidence",
|
|
"team_permission": "read",
|
|
"includes_all_repositories": false,
|
|
"can_create_org_repo": false,
|
|
"units_map": {
|
|
"repo.code": "read",
|
|
"repo.actions": "none",
|
|
"repo.packages": "none",
|
|
"repo.issues": "none",
|
|
"repo.ext_issues": "none",
|
|
"repo.wiki": "none",
|
|
"repo.pulls": "none",
|
|
"repo.releases": "none",
|
|
"repo.projects": "none",
|
|
"repo.ext_wiki": "none"
|
|
},
|
|
"team_repositories": [
|
|
"coulomb/rapp-openbao",
|
|
"coulomb/rapp-policy-nexus",
|
|
"coulomb/rapp-postgres",
|
|
"coulomb/rapp-sbom-nexus",
|
|
"coulomb/rapp-telemetry",
|
|
"coulomb/rapp-tenant-engine",
|
|
"coulomb/rapp-user-engine"
|
|
],
|
|
"token_scopes": [
|
|
"read:repository"
|
|
],
|
|
"token_name_prefix": "reuse-surface-source-read-",
|
|
"reuse_other_workload_token": false,
|
|
"fail_on_differing_existing_identity_or_team": true,
|
|
"enforcement": "Verify complete team membership and all effective user repository grants; no other team, collaborator or organisation grants may provide extra private read access."
|
|
},
|
|
"proposed_delivery": {
|
|
"kv_mount": "platform",
|
|
"kv_path": "platform/workloads/reuse/reuse-surface/forgejo-source-read",
|
|
"field": "FORGEJO_SOURCE_TOKEN",
|
|
"auth_env": "REUSE_SURFACE_FORGEJO_SOURCE_READ_TOKEN",
|
|
"eso_role": "reuse-surface-runtime-eso",
|
|
"eso_identity": "reuse/reuse-surface-eso",
|
|
"audience": "openbao",
|
|
"ttl": "15m",
|
|
"cluster_secret_store": "openbao-reuse",
|
|
"store_namespace_condition": [
|
|
"reuse"
|
|
],
|
|
"external_secret": "reuse/reuse-surface-runtime",
|
|
"target_secret": "reuse/reuse-surface-env",
|
|
"existing_consumption": "Deployment reuse/reuse-surface envFrom secretRef reuse-surface-env; environment variable available only after controlled rollout. Existing image and resource requests retained.",
|
|
"policy_delta": {
|
|
"file": "railiance-platform/openbao/policies/workload-kv-read-reuse-surface-runtime-eso.hcl",
|
|
"add_exact_stanza": "path \"platform/data/workloads/reuse/reuse-surface/forgejo-source-read\" { capabilities = [\"read\"] }",
|
|
"retain_existing_paths": true,
|
|
"do_not_change": "Caller-facing workload-kv-read-reuse-surface-runtime policy or writer OIDC role; those remain unable to read this new path."
|
|
},
|
|
"external_secret_data_delta": {
|
|
"secretKey": "REUSE_SURFACE_FORGEJO_SOURCE_READ_TOKEN",
|
|
"remoteRef": {
|
|
"key": "workloads/reuse/reuse-surface/forgejo-source-read",
|
|
"property": "FORGEJO_SOURCE_TOKEN"
|
|
}
|
|
},
|
|
"delivery_design_reason": "Uses the existing namespace-limited ESO store and identity plus the existing envFrom interface. Separate new KV path keeps scoped writer callers from also acquiring private-source access. No new static ESO token or new store is needed.",
|
|
"native_source_auth": {
|
|
"auth_env": "REUSE_SURFACE_FORGEJO_SOURCE_READ_TOKEN",
|
|
"auth_header": "Authorization",
|
|
"header_behavior": "Native federation _auth_headers prefixes a bare token with Bearer; owner must verify accepted Forgejo raw API route with this actual native implementation."
|
|
}
|
|
},
|
|
"sources": [
|
|
{
|
|
"repo": "rapp-openbao",
|
|
"capability_ids": [
|
|
"capability.railiance.openbao-package"
|
|
],
|
|
"consented_commit": "35672be138036c8433a5ac5de91e068c03c2b124",
|
|
"native_raw_url": "https://forgejo.coulomb.social/api/v1/repos/coulomb/rapp-openbao/raw/registry/indexes/capabilities.yaml?ref=35672be138036c8433a5ac5de91e068c03c2b124",
|
|
"index_sha256": "044efa3d02b90e1872f2516c581159d388a8080a689f76fcd78bb4d048d6ee64",
|
|
"auth_env": "REUSE_SURFACE_FORGEJO_SOURCE_READ_TOKEN"
|
|
},
|
|
{
|
|
"repo": "rapp-policy-nexus",
|
|
"capability_ids": [
|
|
"capability.railiance.policy-publication-package"
|
|
],
|
|
"consented_commit": "088b78ac03b0cebeec34a69aae3569eb7ec2f9c3",
|
|
"native_raw_url": "https://forgejo.coulomb.social/api/v1/repos/coulomb/rapp-policy-nexus/raw/registry/indexes/capabilities.yaml?ref=088b78ac03b0cebeec34a69aae3569eb7ec2f9c3",
|
|
"index_sha256": "e68bdedf61eee9ca2026f46a2434ce384c26234616e74f7a5d08a06c75b3bb00",
|
|
"auth_env": "REUSE_SURFACE_FORGEJO_SOURCE_READ_TOKEN"
|
|
},
|
|
{
|
|
"repo": "rapp-postgres",
|
|
"capability_ids": [
|
|
"capability.railiance.postgres-isolation-recovery"
|
|
],
|
|
"consented_commit": "a9f569c96d74aa384ac8d3ac4aa960e4061550b5",
|
|
"native_raw_url": "https://forgejo.coulomb.social/api/v1/repos/coulomb/rapp-postgres/raw/registry/indexes/capabilities.yaml?ref=a9f569c96d74aa384ac8d3ac4aa960e4061550b5",
|
|
"index_sha256": "d939333eed9d85172e006f526c445fbe2602a721d53f7c0d14bc68286ae08776",
|
|
"auth_env": "REUSE_SURFACE_FORGEJO_SOURCE_READ_TOKEN"
|
|
},
|
|
{
|
|
"repo": "rapp-sbom-nexus",
|
|
"capability_ids": [
|
|
"capability.railiance.sbom-runtime-package"
|
|
],
|
|
"consented_commit": "adbedd349e8df97be43a1f57db7095af45ff29d1",
|
|
"native_raw_url": "https://forgejo.coulomb.social/api/v1/repos/coulomb/rapp-sbom-nexus/raw/registry/indexes/capabilities.yaml?ref=adbedd349e8df97be43a1f57db7095af45ff29d1",
|
|
"index_sha256": "d2ee0f193d2198bf8f16ce64c90ae7664e59a2bc307ad711426af3fd47deb057",
|
|
"auth_env": "REUSE_SURFACE_FORGEJO_SOURCE_READ_TOKEN"
|
|
},
|
|
{
|
|
"repo": "rapp-telemetry",
|
|
"capability_ids": [
|
|
"capability.railiance.telemetry-package"
|
|
],
|
|
"consented_commit": "f158307e24b86bab88a1af4830ff6b4f85afdeb5",
|
|
"native_raw_url": "https://forgejo.coulomb.social/api/v1/repos/coulomb/rapp-telemetry/raw/registry/indexes/capabilities.yaml?ref=f158307e24b86bab88a1af4830ff6b4f85afdeb5",
|
|
"index_sha256": "ee8801f143ed5cf064205710a61c2bb24efc6ea8585d5786d6b679426ec4c1d4",
|
|
"auth_env": "REUSE_SURFACE_FORGEJO_SOURCE_READ_TOKEN"
|
|
},
|
|
{
|
|
"repo": "rapp-tenant-engine",
|
|
"capability_ids": [
|
|
"capability.railiance.tenant-engine-package"
|
|
],
|
|
"consented_commit": "9bdc86572728783a5ed94266f04f7b12d414c557",
|
|
"native_raw_url": "https://forgejo.coulomb.social/api/v1/repos/coulomb/rapp-tenant-engine/raw/registry/indexes/capabilities.yaml?ref=9bdc86572728783a5ed94266f04f7b12d414c557",
|
|
"index_sha256": "d8e9c1282350b5d2fd4f4d69712aa7a5fbcd2367bb1a7fad1b6eb16a97e5d732",
|
|
"auth_env": "REUSE_SURFACE_FORGEJO_SOURCE_READ_TOKEN"
|
|
},
|
|
{
|
|
"repo": "rapp-user-engine",
|
|
"capability_ids": [
|
|
"capability.railiance.user-engine-package"
|
|
],
|
|
"consented_commit": "f35108f9e1b8702fb6c526fe42b2fec5ca032738",
|
|
"native_raw_url": "https://forgejo.coulomb.social/api/v1/repos/coulomb/rapp-user-engine/raw/registry/indexes/capabilities.yaml?ref=f35108f9e1b8702fb6c526fe42b2fec5ca032738",
|
|
"index_sha256": "95b4ed2d0b189f6847b1c0899f740d1da46933a8f40491e1a02f2d4e57c819fc",
|
|
"auth_env": "REUSE_SURFACE_FORGEJO_SOURCE_READ_TOKEN"
|
|
}
|
|
],
|
|
"owner_execution_route": {
|
|
"credential_owner": "railiance-platform",
|
|
"forgejo_owner": "railiance-forge",
|
|
"delivery_manifest_and_rollout_owner": "railiance-apps",
|
|
"consumer_owner": "reuse-surface",
|
|
"construction_planner": "ops-mason",
|
|
"routing_owner": "ops-warden (catalog review only; not secret issuer)",
|
|
"smallest_platform_handoff": "Assign new platform CCR and an owner construction plan covering the exact seven-repo restricted identity, separate KV path, existing ESO policy/data deltas, controlled same-image rollout, and positive/negative receipts. Adapt core-hub provisioning logic with includes_all_repositories=false and exact team repository reconciliation; do not execute unchanged core-hub script. Return CCR/plan references and metadata receipts, never PAT value.",
|
|
"attended_bootstrap_precedent": "warden access openbao-platform-admin-login --exec -- <platform-owned reviewed silent bootstrap>; bootstrap obtains Forgejo admin through existing forgejo-admin-api-token route, writes PAT to OpenBao from stdin, captures/discards raw output, and returns bounded receipt. New command is not yet implemented or approved.",
|
|
"catalog_new_lane_proposed": "reuse-surface-forgejo-source-read (owner allocates and reviews; not present or executable yet)"
|
|
},
|
|
"verification": {
|
|
"pre_apply": [
|
|
"Pin exact CCR and plan revision/digest, owner reviews, founder disposition and rollout artifacts. Resolve existing identity/team/path conflicts before any mutation.",
|
|
"Confirm live namespace/Deployment and its image digest, current ESO identity/binding and secret field presence through safe suppressing helper; no Secret dump.",
|
|
"Check CPU headroom and rollout strategy/PVC constraints; retain exact prior source manifest/image and server dry-run/client diff."
|
|
],
|
|
"positive": [
|
|
"PAT metadata scope exactly read:repository; exact seven team repos with no other private grants.",
|
|
"Actual native fetch_remote_index_text from hub process with the approved auth_env fetches all seven pinned raw index URLs; validate schema, one expected capability each and exact index SHA256. No token or fetched private source output.",
|
|
"ESO Ready and materialized key present checked without values; Deployment Ready on same pinned image after controlled rollout.",
|
|
"Register private sources only after credential and native fetch receipts; fresh hosted federation then proves all70 reviewed IDs exactly once and matching metadata."
|
|
],
|
|
"negative": [
|
|
"Reader cannot fetch a known private repository outside the seven (preselected by platform using metadata, no unauthorized body retention).",
|
|
"Forgejo writes, admin/user operations and non-code unit access denied; probe design must avoid creating writes if an unexpected permission exists.",
|
|
"Default identity and scoped writer OIDC caller cannot read new KV path; ESO role cannot read any other sibling path, and wrong SA/namespace/audience cannot authenticate.",
|
|
"Native missing-auth and anonymous private-index fetch fail closed; no fallback to admin/personal/core-hub credentials."
|
|
],
|
|
"receipts": "Sanitized IDs, repo names, scopes, hashes, status booleans and timestamps only; no credentials, raw errors, private index bodies or Secret objects."
|
|
},
|
|
"rollback": {
|
|
"immediate": "Revoke this dedicated PAT and remove exact new team/user grants. Disable only private registrations created by the associated attempt after reconciling ambiguous requests; preserve all public registrations.",
|
|
"delivery": "Remove only new ES data item and exact new ESO policy stanza, restore prior source revision through owner path, delete only new materialized token key if needed using suppressed owner helper, then roll same-image hub. Do not delete reuse-surface-env or rotate existing writer/webhook fields.",
|
|
"preserve_evidence": "Retain failed/partial outcomes, reconcile any ambiguous identity or token creation; never blindly remint after an observation timeout."
|
|
},
|
|
"cost_estimate_eur": 0,
|
|
"risk_estimate": "read:repository plus repo.code read exposes entire source code of the seven private repos to the hub process, not just registry files; Forgejo permissions are repository-wide. The approved public output is only pinned capability metadata. New hub credential and rollout need separate owner review/authorization. Existing ESO role reads new exact path; same namespace operators can reference the store. Rollout may briefly affect single-instance SQLite service if capacity/PVC sharing prevents surge; headroom and owner rollout plan required. No new billed infrastructure proposed.",
|
|
"unresolved": [
|
|
"Platform allocates CCR and exact script/manifests with approved revision/digest and verifies restricted account is not implicitly granted private access elsewhere.",
|
|
"Platform/Forgejo/reuse/railiance-apps owners perform their own reviews; credential provisioning and production rollout approval is separate from recorded metadata disclosure consent.",
|
|
"No actual Forgejo identity/token/OpenBao path provisioning, live binding survey, native hub fetch or rollout receipt exists in this preparation."
|
|
],
|
|
"evidence_sources": [
|
|
{
|
|
"path": "/home/worsch/railiance-platform/credential-change-requests/CCR-2026-0005-reuse-surface-runtime-secrets-lane.yaml",
|
|
"sha256": "8259abf8f044caab94414523c53bdb062d95c595b6c4d4590a4bb92ad703d22c"
|
|
},
|
|
{
|
|
"path": "/home/worsch/railiance-platform/credential-change-requests/CCR-2026-0031-core-hub-forgejo-source-read.yaml",
|
|
"sha256": "fcc0b9fe75e4ac75c554967f2466cb225814f934d6f01c310b626779fa0e8b4a"
|
|
},
|
|
{
|
|
"path": "/home/worsch/railiance-platform/scripts/provision-core-hub-forgejo-source.py",
|
|
"sha256": "2550e050a3c8de72d2eecf3db8bc27b3fb70ac4cb206364fdf65d6f9c8ab8f52"
|
|
},
|
|
{
|
|
"path": "/home/worsch/railiance-platform/openbao/policies/workload-kv-read-reuse-surface-runtime-eso.hcl",
|
|
"sha256": "fab29572fe82fc6674837e430f616409070f97a3867a411b7e21b5141dfaba20"
|
|
},
|
|
{
|
|
"path": "/home/worsch/railiance-platform/openbao/policies/workload-kv-read-reuse-surface-runtime.hcl",
|
|
"sha256": "53dd5eecc94fd8d7fc281a858f5d9fc27c8c895fd79161fd113cd3a1387a1257"
|
|
},
|
|
{
|
|
"path": "/home/worsch/railiance-platform/argocd/platform-addons/openbao-secretstore/openbao-reuse.clustersecretstore.yaml",
|
|
"sha256": "b1fb08ad2f15624b8d97b797bf8152a91ea0e66457d05f9058b95281624bf378"
|
|
},
|
|
{
|
|
"path": "/home/worsch/railiance-apps/manifests/reuse-surface-runtime-externalsecret.yaml",
|
|
"sha256": "e036084aec9fad3bea63cc0d591c3b40a392ab9f54d9226a2d2b3fd7194d8a47"
|
|
},
|
|
{
|
|
"path": "/home/worsch/railiance-apps/charts/reuse-surface/templates/deployment.yaml",
|
|
"sha256": "c20283d6db8c93fa182ef79ada53cbf03a53fe6358c7334ebc82feb94465ad54"
|
|
},
|
|
{
|
|
"path": "/home/worsch/reuse-surface/reuse_surface/federation.py",
|
|
"sha256": "b6bde1e0942189e422f0c87f226ae28027f0dff1a29887a55eb88c8eaafe58ce"
|
|
}
|
|
],
|
|
"consented_revision_preflight": {
|
|
"path": "docs/assessments/netkingdom-2026-10-14/private-source-consented-revision-preflight.json",
|
|
"sha256": "9757a0e94aef7adab4456a7e259243e0f039f1d2a9c9826d5685bc52a7a8a19f",
|
|
"result": "Main agent verified all seven HEAD file hashes and remote main match owner-consented commits; refresh if owner execution occurs after a source revision changes."
|
|
}
|
|
}
|