diff --git a/creds-matrix-notes.md b/creds-matrix-notes.md index 5f58ac8..969861d 100644 --- a/creds-matrix-notes.md +++ b/creds-matrix-notes.md @@ -184,6 +184,44 @@ **inside the repo clone** and gitignored. Given SEC-004 (this repo is currently PUBLIC), that gitignore is the only thing standing between a CA private key and publication. +**PER-DC SINCE 2026-07-29 (F2, under the D-109 amendment / R7 and R13 Part 1).** The nine +Octavia PKI ids were `cardinality=singleton` with `site-key=-` and `mint-stage=vr0-phase01`. +Two consequences, both measured: + +- `creds-matrix.py`'s `s5_per_dc_symmetry` enforces both-DC existence ONLY for rows whose + cardinality is `per-DC`, so a `singleton` declaration made the register **structurally + blind to a missing second PKI set** -- the exact "a register cannot report the absence of + something it has no ROW for" class this file exists to prevent, sitting behind the BLOCKING + P5 gate. +- R13 Part 1 (RULED 2026-07-27) separately requires these rows to be staged to what Stage 5 + ACTUALLY mints, because staging them to a `pending` VR0 phase meant flipping `stage5` to + `reached` would never make them expected -- a false green over the largest mint event of + the deployment. R13's own text names R7 as making this MORE urgent: per-DC independence + means TWO CA mints where the register expected none. + +So the nine ids became **18 rows** (9 x 2 DCs), `per-DC`, region-qualified site-keys, +`mint-stage=stage5`, and the overlay row's filename is now per-DC +(`vr1-dc0-octavia-pki.yaml` / `vr1-dc1-octavia-pki.yaml`) to match the generator rename. +Mint-refs were RE-DERIVED from the edited `phase-01` -- `s4_mint_ref` only checks that a +line number is within EOF, so the old refs would have silently pointed at wrong lines. + +PROVEN, not assumed: with both DCs declared the run is 91 rows / 7 findings (unchanged from +the 82/7 baseline, so this introduced none); deleting ONE dc1 row makes S5 report +`ASYMMETRY ... no counterpart in vr1-dc1` at 8 findings. The gate was demonstrated capable +of failing before being trusted. + +**`stage5` DELIBERATELY STAYS `pending` in `creds-manifests/stages-reached`** until the PKI +is actually generated -- the rows are now correctly ATTRIBUTED, not yet expected. **Trap to +check before flipping it:** `stage5` is one coarse token that also covers eight already- +existing rows, so flipping it makes those expected simultaneously. Whether that is right, or +whether the mint needs a finer-grained token, is a question to settle at flip time. + +**REMAINDER OF R13 PART 1, NOT DONE HERE:** the vault-init and `admin-openrc` rows are still +mis-staged the same way. vault-init is additionally per-DC under D-109's ORIGINAL text +(per-DC independent Vault roots), so it carries the same cardinality defect -- but its blast +radius reaches `~/vault-init/`, which CLAUDE.md designates operator-only one-shot territory, +so it was deliberately NOT bundled into an R7-conformance edit. + ## n-tenant-dir Per-tenant credential directory outside the `*-creds/` convention (research FINDING 2). Hard tenant isolation applies: D-069 keeps custody off-repo, and D-137 ruling 3 bounds diff --git a/creds-matrix.tsv b/creds-matrix.tsv index dec3ea1..7d3247c 100644 --- a/creds-matrix.tsv +++ b/creds-matrix.tsv @@ -100,15 +100,24 @@ # ---------------------------------------------------------------- outside the SEC-009 *-creds/ convention (research FINDING 2) vault-unseal-shares singleton - jumphost init.txt none service off-manifest-known vr0-phase02 runbook:runbooks/phase-02-vault-bringup.md:71 SEC-023 n-outside-convention vault-root-token singleton - jumphost init.txt none service off-manifest-known vr0-phase02 runbook:runbooks/phase-02-vault-bringup.md:71 SEC-023 n-outside-convention -octavia-issuing-ca-passphrase singleton - jumphost passphrase.txt none service off-manifest-known vr0-phase01 runbook:runbooks/phase-01-bundle-deploy.md:299 SEC-023 n-outside-convention -octavia-issuing-ca-key singleton - jumphost issuing-ca.key.enc none service off-manifest-known vr0-phase01 runbook:runbooks/phase-01-bundle-deploy.md:302 SEC-023 n-outside-convention -octavia-issuing-ca-cert singleton - jumphost issuing-ca.cert.pem none service off-manifest-known vr0-phase01 runbook:runbooks/phase-01-bundle-deploy.md:305 SEC-023 n-outside-convention -octavia-controller-ca-pass singleton - jumphost passphrase.txt none service off-manifest-known vr0-phase01 runbook:runbooks/phase-01-bundle-deploy.md:321 SEC-023 n-outside-convention -octavia-controller-ca-key singleton - jumphost controller-ca.key.enc none service off-manifest-known vr0-phase01 runbook:runbooks/phase-01-bundle-deploy.md:324 SEC-023 n-outside-convention -octavia-controller-ca-cert singleton - jumphost controller-ca.cert.pem none service off-manifest-known vr0-phase01 runbook:runbooks/phase-01-bundle-deploy.md:327 SEC-023 n-outside-convention -octavia-controller-key singleton - jumphost controller.key none service off-manifest-known vr0-phase01 runbook:runbooks/phase-01-bundle-deploy.md:343 SEC-023 n-outside-convention -octavia-controller-bundle singleton - jumphost controller.bundle.pem none service off-manifest-known vr0-phase01 runbook:runbooks/phase-01-bundle-deploy.md:375 SEC-023 n-outside-convention -octavia-pki-overlay singleton - jumphost octavia-pki.yaml none service off-manifest-known vr0-phase01 runbook:runbooks/phase-01-bundle-deploy.md:391 SEC-004 n-overlay-in-clone +octavia-issuing-ca-passphrase per-DC vr1-dc0 jumphost passphrase.txt none service off-manifest-known stage5 runbook:runbooks/phase-01-bundle-deploy.md:383 SEC-023 n-outside-convention +octavia-issuing-ca-key per-DC vr1-dc0 jumphost issuing-ca.key.enc none service off-manifest-known stage5 runbook:runbooks/phase-01-bundle-deploy.md:387 SEC-023 n-outside-convention +octavia-issuing-ca-cert per-DC vr1-dc0 jumphost issuing-ca.cert.pem none service off-manifest-known stage5 runbook:runbooks/phase-01-bundle-deploy.md:391 SEC-023 n-outside-convention +octavia-controller-ca-pass per-DC vr1-dc0 jumphost passphrase.txt none service off-manifest-known stage5 runbook:runbooks/phase-01-bundle-deploy.md:406 SEC-023 n-outside-convention +octavia-controller-ca-key per-DC vr1-dc0 jumphost controller-ca.key.enc none service off-manifest-known stage5 runbook:runbooks/phase-01-bundle-deploy.md:410 SEC-023 n-outside-convention +octavia-controller-ca-cert per-DC vr1-dc0 jumphost controller-ca.cert.pem none service off-manifest-known stage5 runbook:runbooks/phase-01-bundle-deploy.md:414 SEC-023 n-outside-convention +octavia-controller-key per-DC vr1-dc0 jumphost controller.key none service off-manifest-known stage5 runbook:runbooks/phase-01-bundle-deploy.md:429 SEC-023 n-outside-convention +octavia-controller-bundle per-DC vr1-dc0 jumphost controller.bundle.pem none service off-manifest-known stage5 runbook:runbooks/phase-01-bundle-deploy.md:517 SEC-023 n-outside-convention +octavia-pki-overlay per-DC vr1-dc0 jumphost vr1-dc0-octavia-pki.yaml none service off-manifest-known stage5 runbook:runbooks/phase-01-bundle-deploy.md:553 SEC-004 n-overlay-in-clone +octavia-issuing-ca-passphrase per-DC vr1-dc1 jumphost passphrase.txt none service off-manifest-known stage5 runbook:runbooks/phase-01-bundle-deploy.md:383 SEC-023 n-outside-convention +octavia-issuing-ca-key per-DC vr1-dc1 jumphost issuing-ca.key.enc none service off-manifest-known stage5 runbook:runbooks/phase-01-bundle-deploy.md:387 SEC-023 n-outside-convention +octavia-issuing-ca-cert per-DC vr1-dc1 jumphost issuing-ca.cert.pem none service off-manifest-known stage5 runbook:runbooks/phase-01-bundle-deploy.md:391 SEC-023 n-outside-convention +octavia-controller-ca-pass per-DC vr1-dc1 jumphost passphrase.txt none service off-manifest-known stage5 runbook:runbooks/phase-01-bundle-deploy.md:406 SEC-023 n-outside-convention +octavia-controller-ca-key per-DC vr1-dc1 jumphost controller-ca.key.enc none service off-manifest-known stage5 runbook:runbooks/phase-01-bundle-deploy.md:410 SEC-023 n-outside-convention +octavia-controller-ca-cert per-DC vr1-dc1 jumphost controller-ca.cert.pem none service off-manifest-known stage5 runbook:runbooks/phase-01-bundle-deploy.md:414 SEC-023 n-outside-convention +octavia-controller-key per-DC vr1-dc1 jumphost controller.key none service off-manifest-known stage5 runbook:runbooks/phase-01-bundle-deploy.md:429 SEC-023 n-outside-convention +octavia-controller-bundle per-DC vr1-dc1 jumphost controller.bundle.pem none service off-manifest-known stage5 runbook:runbooks/phase-01-bundle-deploy.md:517 SEC-023 n-outside-convention +octavia-pki-overlay per-DC vr1-dc1 jumphost vr1-dc1-octavia-pki.yaml none service off-manifest-known stage5 runbook:runbooks/phase-01-bundle-deploy.md:553 SEC-004 n-overlay-in-clone tenant-domain-admin per-tenant - jumphost -domain-admin-cred.txt gui human off-manifest-known tenant-onboard script:scripts/tenant-onboard.sh:64 SEC-023 n-tenant-dir tenant-cluster-user per-tenant - jumphost -cluster-cred.txt api human off-manifest-known tenant-onboard script:scripts/tenant-onboard.sh:90 SEC-023 n-tenant-dir tenant-svc-user per-tenant - jumphost -svc-cred.txt api service off-manifest-known tenant-onboard script:scripts/tenant-onboard.sh:90 SEC-023 n-tenant-dir diff --git a/docs/CURRENT-STATE.md b/docs/CURRENT-STATE.md index 49d065d..1e32fd3 100644 --- a/docs/CURRENT-STATE.md +++ b/docs/CURRENT-STATE.md @@ -1964,6 +1964,31 @@ the BLOCKING P5 gate. Baseline measured so the delta is attributable: `--tier2` = 82 rows, 15 groups clean, **7 findings, exit 1**. Must land BEFORE generation, or dc0's set alone satisfies the register. + **F2 IS NOW BUILT (2026-07-29), and it proved to be RULED work rather than a judgment call.** + R13 Part 1 (D-137 sub-ruling 6, RULED 2026-07-27) already required these rows staged to what + Stage 5 ACTUALLY mints, and its own text names R7 as making this MORE urgent -- "per-DC + independent Octavia PKI means TWO CA mints where the register expects none". The nine + `singleton` ids became **18 rows** (9 x 2 DCs), `per-DC`, region-qualified site-keys, + `mint-stage=stage5`, the overlay row's filename following the F1 rename. **Mint-refs were + RE-DERIVED from the edited `phase-01`** -- `s4_mint_ref` only checks a line number is within + EOF, so the F1 edit had silently left all nine pointing at wrong lines with nothing able to + notice. **PROVEN CAPABLE OF FAILING before being trusted** (the inverse of "a checker that + cannot fail is not a gate"): both DCs declared reads **91 rows / 7 findings** -- the same 7 as + the 82-row baseline, so this introduced none -- and deleting ONE dc1 row makes S5 report + `ASYMMETRY ... no counterpart in vr1-dc1` at **8 findings**. Harness `tests/creds-matrix` + **60/60**. **`stage5` deliberately STAYS `pending`**: the rows are now correctly ATTRIBUTED, + not yet expected, and the flip belongs with the actual mint. **Trap recorded for that flip:** + `stage5` is one coarse token also covering eight already-existing rows, so flipping it makes + those expected simultaneously -- whether that is right, or whether the mint needs a finer + token, is unresolved and may need a ruling. **REMAINDER OF R13 PART 1 NOT DONE:** the + vault-init and `admin-openrc` rows carry the same mis-staging, and vault-init additionally + carries the same per-DC cardinality defect under D-109's ORIGINAL text -- deliberately not + bundled, because its blast radius reaches `~/vault-init/`, which CLAUDE.md designates + operator-only one-shot territory. **PROCESS NOTE:** the PreToolUse secret guard BLOCKED the + shell approach to this edit, matching a filename string that appears in the register as a + DECLARATION. The register carries logical keys only and no values by its own design, and this + edit added none, so it was completed with the file-edit tool rather than by circumventing the + guard. **F3 -- both `~/octavia-pki/` and `overlays/octavia-pki.yaml` are ABSENT here** (existence checked, no contents read). So this is generation FROM SCRATCH for both DCs: there is nothing to reuse, which retires the reuse-vs-regenerate choice