3 Commits

Author	SHA1	Message	Date
tegwick	85a781b7a4	NET-WP-0020 finished: attended-ceremony + auto-unseal-transit profiles, greenfield init/unseal proof ... T2: greenfield live proof against a fresh uninitialized OpenBao 2.5.5 — caught and fixed 'bao operator unseal -' not reading stdin (now 'bao write sys/unseal key=-'); init and reseal-replay paths proven. T3: attended-ceremony selectable — runbook, non-secret ceremony-record template + validator, and a lab/production deployment profile that blocks sops-held-automation in console selection, gates, and the init script. T4: console gate + evidence flags for auto-unseal-transit (Helm seal stanza prepared in railiance-platform). Also: SCOPE.md refreshed to current repo state; adhoc fix for the broken check-secrets Make target (unescaped $). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-02 22:08:33 +02:00
tegwick	f625dd0681	feat: OpenBao unseal custody models — automation-first with blocked alternatives ... Document three init/unseal custody paths; default sops-held-automation for fast rebuild cycles. Security bootstrap console lists models, blocks planned attended-ceremony and auto-unseal-transit with hints, and gates init ceremony on implemented selection. NET-WP-0020 tracks downstream SSH automation.	2026-06-18 00:51:48 +02:00
tegwick	e20b322a2e	feat(NET-WP-0018-T07): add automated tests for bootstrap UI sections and runbooks ... - Created tools/security-bootstrap-console/tests/test_security_bootstrap_console.py (pytest-based, 8 tests covering templates (incl. 0019 dry-run fields), runbook_payloads (T06 entry), audit_core_posture, etc. per layered spec + 0019 note) - Makefile: added security-bootstrap-console-test (pytest), security-bootstrap-scripts-syntax (bash -n for key sh scripts like dry-run-nonroot-user.sh); integrated into .PHONY and bootstrap lists - Updated workplan T07 status done + detailed note with pragmatic refs - Tests pass (python -m pytest) - Commit + will sync/fix/progress - Covers console UI, validators, 0019 polish artifacts (orchestrator, cmds, claims, evidence) as required for T07 T07 complete. 6/9 now.	2026-06-03 17:28:21 +02:00