#60 - Epic: Forge identity lifecycle — OpenBao leases, Vedanta effect, Kanidm credentials - Ting/Ting

larandar commented

2026-08-29 17:04:37 +00:00

Owner

Proposal

Outcome

Deliver the ratified Forge identity lifecycle 0.1.4: OpenBao is the only workload-facing lease authority; Vedanta is its private effector; Kanidm owns durable principal and credential state; and Forge access uses bounded, per-lease capabilities without per-drone Forgejo accounts. Ordinary completion returns the same durable worker UUID to the pool under a new immutable grant and generation.

Why

The earlier backlog carried incompatible direct, KV-only, provider-minting, bootstrap, and policy-authority roads. The ratified contract and native Session graph make those roads temporary and give their retirement objective production gates.

Design

AssignmentGrant is the immutable, versioned authority join; RFC 8785 digest, UUID, generations, projections, custody, evidence, lifecycle, and decommission rules are binding.
Teyla initially holds the runtime swarm-alpha/queen seat. A seat is runtime authority, not identity; handover revokes the old tenure before issuing a distinct successor tenure.
Providers create and reconcile principals, grants, and projections. They mint no runtime bearer credential.
flake-ops deploys generic inactive OpenBao/Vedanta and Forge-adapter machinery before realizing authority.
The swarm-alpha pool has ten stable slots. Automation reserves each final swarm-alpha-drone-<word>-<word>-<word>-<word> name before creation, creates or adopts the principal with swarm/slot metadata, reads and pins its UUID without renaming, and generates one distinct immutable queen-delegated grant for every pool member.
Pool realization creates no per-drone Forgejo account, standing Forge token, or active lease. The Freeholder ratifies the complete generated ten-name/UUID/grant mapping before activation.
For an active drone lease, OpenBao authorizes and Vedanta privately causes Forgejo to mint a distinct read-only, repository-restricted token under the active queen holder's account. Effective visibility is the intersection of queen visibility, exact grant repositories, and token scope.
Every mutation produces the correlation chain from queen tenure and drone grant through lease, operation, token ID, and resource event.
The pilot uses a 30-minute maximum lease, renews by T-minus ten minutes, bounds predecessor overlap to five minutes, and expires one-shot delivery after five minutes. Unverified Forge token deletion remains revocation_pending and blocks worker reuse.

Delivery frontier

The native dependency graph is authoritative:

Ting/Ting#61
  -> (Ting/Vedanta#20 || lar.ad/nixops4-providers#27 || Ting/Jostoph#103)
(Ting/Vedanta#20 + lar.ad/nixops4-providers#27)
  -> lar.ad/flake-ops#426
(lar.ad/flake-ops#426 + Ting/Jostoph#103)
  -> lar.ad/flake-ops#435

Within deployment:

(lar.ad/flake-ops#432 || lar.ad/flake-ops#433) -> #427 -> #434

#432/#433 deliver generic inactive machinery; #427 realizes and gates the ten-grant pool; #434 proves the private topology. The workload Session #435 ends at #154's operator-gated production lifecycle, same-UUID reuse, and legacy-path retirement proof.

Tasks

Complete Ting/Ting#61; contract 0.1.4 is ratified and #63/#64/#65 reconcile its projections.
Deliver Ting/Vedanta#20 — lease backend and private effector.
Deliver nixops4-providers#27 — grant validation and lifecycle projections.
Deliver Ting/Jostoph#103 — independent audit and reconciliation.
Deliver flake-ops#426 — machinery-first deployment, ten-grant realization, HITL activation, and topology proof.
Deliver flake-ops#435 — workload client and production proof.
Pass flake-ops#154, return the same UUID to the pool under a new grant/generation, and retire legacy delivery paths only after every old-path exit condition passes.

Specification Delta

Requirement: machinery precedes realized authority

Scenario: the pool becomes eligible for activation

GIVEN #432 and #433 have deployed generic inactive machinery
WHEN #427 creates or adopts ten UUID-pinned drone principals and renders ten distinct immutable grants
THEN no Forge account, standing token, active lease, or projection authority exists merely from provisioning
AND activation waits for Freeholder ratification of the complete realized mapping

Requirement: ordinary completion preserves the durable worker

Scenario: a production session ends

GIVEN the pilot has proved issue, use, rotation, predecessor expiry, revocation, and negative liveness
WHEN checkout credentials rotate and the checkout generation advances
THEN the same durable worker UUID returns to the available pool under a new immutable grant
AND legacy delivery paths retire without suppressing, tombstoning, renaming, deleting, or recreating the principal

Requirement: legacy roads have measurable exits

Scenario: decommission is proposed

GIVEN direct, KV-only, bootstrap, or legacy credential delivery still exists
WHEN #154 evaluates retirement
THEN retirement occurs only after the ratified old-path exit conditions pass
AND no retained legacy road is described as production-final

OpenSpec

OpenSpec 61 — Forge identity lifecycle contract 0.1.4

## Proposal ### Outcome Deliver the ratified Forge identity lifecycle 0.1.4: OpenBao is the only workload-facing lease authority; Vedanta is its private effector; Kanidm owns durable principal and credential state; and Forge access uses bounded, per-lease capabilities without per-drone Forgejo accounts. Ordinary completion returns the same durable worker UUID to the pool under a new immutable grant and generation. ### Why The earlier backlog carried incompatible direct, KV-only, provider-minting, bootstrap, and policy-authority roads. The ratified contract and native Session graph make those roads temporary and give their retirement objective production gates. ## Design - `AssignmentGrant` is the immutable, versioned authority join; RFC 8785 digest, UUID, generations, projections, custody, evidence, lifecycle, and decommission rules are binding. - Teyla initially holds the runtime `swarm-alpha/queen` seat. A seat is runtime authority, not identity; handover revokes the old tenure before issuing a distinct successor tenure. - Providers create and reconcile principals, grants, and projections. They mint no runtime bearer credential. - flake-ops deploys generic inactive OpenBao/Vedanta and Forge-adapter machinery before realizing authority. - The `swarm-alpha` pool has ten stable slots. Automation reserves each final `swarm-alpha-drone-<word>-<word>-<word>-<word>` name before creation, creates or adopts the principal with swarm/slot metadata, reads and pins its UUID without renaming, and generates one distinct immutable queen-delegated grant for every pool member. - Pool realization creates no per-drone Forgejo account, standing Forge token, or active lease. The Freeholder ratifies the complete generated ten-name/UUID/grant mapping before activation. - For an active drone lease, OpenBao authorizes and Vedanta privately causes Forgejo to mint a distinct read-only, repository-restricted token under the active queen holder's account. Effective visibility is the intersection of queen visibility, exact grant repositories, and token scope. - Every mutation produces the correlation chain from queen tenure and drone grant through lease, operation, token ID, and resource event. - The pilot uses a 30-minute maximum lease, renews by T-minus ten minutes, bounds predecessor overlap to five minutes, and expires one-shot delivery after five minutes. Unverified Forge token deletion remains `revocation_pending` and blocks worker reuse. ## Delivery frontier The native dependency graph is authoritative: ```text Ting/Ting#61 -> (Ting/Vedanta#20 || lar.ad/nixops4-providers#27 || Ting/Jostoph#103) (Ting/Vedanta#20 + lar.ad/nixops4-providers#27) -> lar.ad/flake-ops#426 (lar.ad/flake-ops#426 + Ting/Jostoph#103) -> lar.ad/flake-ops#435 ``` Within deployment: ```text (lar.ad/flake-ops#432 || lar.ad/flake-ops#433) -> #427 -> #434 ``` #432/#433 deliver generic inactive machinery; #427 realizes and gates the ten-grant pool; #434 proves the private topology. The workload Session #435 ends at #154's operator-gated production lifecycle, same-UUID reuse, and legacy-path retirement proof. ## Tasks - [ ] Complete [Ting/Ting#61](https://jo.et0.pw/Ting/Ting/issues/61); contract 0.1.4 is ratified and #63/#64/#65 reconcile its projections. - [ ] Deliver [Ting/Vedanta#20](https://jo.et0.pw/Ting/Vedanta/issues/20) — lease backend and private effector. - [ ] Deliver [nixops4-providers#27](https://jo.et0.pw/lar.ad/nixops4-providers/issues/27) — grant validation and lifecycle projections. - [ ] Deliver [Ting/Jostoph#103](https://jo.et0.pw/Ting/Jostoph/issues/103) — independent audit and reconciliation. - [ ] Deliver [flake-ops#426](https://jo.et0.pw/lar.ad/flake-ops/issues/426) — machinery-first deployment, ten-grant realization, HITL activation, and topology proof. - [ ] Deliver [flake-ops#435](https://jo.et0.pw/lar.ad/flake-ops/issues/435) — workload client and production proof. - [ ] Pass [flake-ops#154](https://jo.et0.pw/lar.ad/flake-ops/issues/154), return the same UUID to the pool under a new grant/generation, and retire legacy delivery paths only after every old-path exit condition passes. ## Specification Delta ### Requirement: machinery precedes realized authority #### Scenario: the pool becomes eligible for activation - **GIVEN** #432 and #433 have deployed generic inactive machinery - **WHEN** #427 creates or adopts ten UUID-pinned drone principals and renders ten distinct immutable grants - **THEN** no Forge account, standing token, active lease, or projection authority exists merely from provisioning - **AND** activation waits for Freeholder ratification of the complete realized mapping ### Requirement: ordinary completion preserves the durable worker #### Scenario: a production session ends - **GIVEN** the pilot has proved issue, use, rotation, predecessor expiry, revocation, and negative liveness - **WHEN** checkout credentials rotate and the checkout generation advances - **THEN** the same durable worker UUID returns to the available pool under a new immutable grant - **AND** legacy delivery paths retire without suppressing, tombstoning, renaming, deleting, or recreating the principal ### Requirement: legacy roads have measurable exits #### Scenario: decommission is proposed - **GIVEN** direct, KV-only, bootstrap, or legacy credential delivery still exists - **WHEN** #154 evaluates retirement - **THEN** retirement occurs only after the ratified old-path exit conditions pass - **AND** no retained legacy road is described as production-final ## OpenSpec [OpenSpec 61 — Forge identity lifecycle contract 0.1.4](https://jo.et0.pw/Ting/Ting/wiki/OpenSpec-61-forge-identity-lifecycle-contract)

larandar added the

Kind/Security

Meta/Epic

labels

2026-08-29 17:04:37 +00:00

larandar referenced this issue

2026-08-29 17:05:03 +00:00

Session: Ratify and reconcile the Forge identity lifecycle contract #61

larandar referenced this issue from Ting/Vedanta

2026-08-29 17:05:03 +00:00

Session: OpenBao-owned Forge identity leases and private Vedanta effect #20

~~larandar referenced this issue from Ting/Jostoph 2026-08-29 17:05:03 +00:00~~