runtime: add fenced per-service auth enrollment and refresh journal

toasterson commented

2026-10-17 14:29:36 +00:00

Owner

Codex subscription refresh rotated both tokens in the retained-PVC probe. This prerequisite adds an offline, same-service auth enrollment CLI and an OpenBao CAS journal that refuses stale auth after interrupted provider use. It is based on merged #664 (17f94ecd).

akh-runtime-auth defaults to planning. It holds the existing profile lock, validates the source service/profile, verifies the reviewed store-import manifest against service/schema/kind/digest, and acquires that exact Postgres store exclusively with require_receipt. Apply requires the reviewed auth manifest; exact retries use CAS readback. It accepts only bounded private subscription auth, never a common seed or another service's file.

The library publishes using before provider use, retains using across checkpoints, and permits ready only through an explicit quiescent final capture. Missing, revoked, conflicting, inaccessible and ambiguous records fail closed. The journal binds service/profile and migration fence. Real provider launch/refresh/shutdown/startup hooks are not yet connected; this is the coordinator-approved bounded prerequisite, not runtime durability or cutover acceptance.

Validation at 8d210f37438f9e4748d4a5d9ed9304d46d4d4924:

Runtime-only library: 92 passed; CLI: 2 passed. This includes 13 focused auth tests and 2 CLI refusal tests.
One real Postgres/OpenBao ownership-loss/restart test compiled but locally ignored; wired into the existing CI disposable-backend harness.
Formatting, whitespace, Python syntax, evidence JSON and all four exact opaque slot paths checked.
No local Docker/image build; one 2-job Rust build reused the existing cache, with approximately 70 GiB headroom afterward.

RUNTIME-AUTH.md gives exact per-service sources/destinations, coordinator-owned dedicated reauthorization fallback, rollout ordering and remaining PR8/PR9 gates. Live evidence verifies all 19 claims/27 PVs protected and 14 pods Ready. All four Codex runtimes still use shared akh_sessions; owner-specific store reconciliation must precede enrollment. The shared seed remains inactive. Production auth, bindings, policies, manifests and volumes are unchanged.

Required later evidence: daemon/helper integration, actual same-service refresh/checkpoint/failure/shutdown acceptance, transcript reconciliation, and merged-main arm64+amd64 conformance. Main image build run 4309 is still pending in the recorded snapshot. Sessions/core reconciliation, per-Akh Sokar authorization, house schema compatibility, MausBot post-PR8 recapture and PR9 sharing remain explicit gates. No self-merge or activation.

Codex subscription refresh rotated both tokens in the retained-PVC probe. This prerequisite adds an offline, same-service auth enrollment CLI and an OpenBao CAS journal that refuses stale auth after interrupted provider use. It is based on merged #664 (`17f94ecd`). `akh-runtime-auth` defaults to planning. It holds the existing profile lock, validates the source service/profile, verifies the reviewed store-import manifest against service/schema/kind/digest, and acquires that exact Postgres store exclusively with `require_receipt`. Apply requires the reviewed auth manifest; exact retries use CAS readback. It accepts only bounded private subscription auth, never a common seed or another service's file. The library publishes `using` before provider use, retains `using` across checkpoints, and permits `ready` only through an explicit quiescent final capture. Missing, revoked, conflicting, inaccessible and ambiguous records fail closed. The journal binds service/profile and migration fence. Real provider launch/refresh/shutdown/startup hooks are **not yet connected**; this is the coordinator-approved bounded prerequisite, not runtime durability or cutover acceptance. Validation at `8d210f37438f9e4748d4a5d9ed9304d46d4d4924`: - Runtime-only library: 92 passed; CLI: 2 passed. This includes 13 focused auth tests and 2 CLI refusal tests. - One real Postgres/OpenBao ownership-loss/restart test compiled but locally ignored; wired into the existing CI disposable-backend harness. - Formatting, whitespace, Python syntax, evidence JSON and all four exact opaque slot paths checked. - No local Docker/image build; one 2-job Rust build reused the existing cache, with approximately 70 GiB headroom afterward. `RUNTIME-AUTH.md` gives exact per-service sources/destinations, coordinator-owned dedicated reauthorization fallback, rollout ordering and remaining PR8/PR9 gates. Live evidence verifies all 19 claims/27 PVs protected and 14 pods Ready. All four Codex runtimes still use shared `akh_sessions`; owner-specific store reconciliation must precede enrollment. The shared seed remains inactive. Production auth, bindings, policies, manifests and volumes are unchanged. Required later evidence: daemon/helper integration, actual same-service refresh/checkpoint/failure/shutdown acceptance, transcript reconciliation, and merged-main arm64+amd64 conformance. Main image build run 4309 is still pending in the recorded snapshot. Sessions/core reconciliation, per-Akh Sokar authorization, house schema compatibility, MausBot post-PR8 recapture and PR9 sharing remain explicit gates. No self-merge or activation.

toasterson added 1 commit

2026-10-17 14:29:36 +00:00