IA-REV-26-212: svc-build

Identity & access review, quarterly cycle Q3-2026, reviewer wrenn, opened 2026-09-10.

Scope

Commit 4c1a09f, 2022-09-30, the one-line nameserver 192.0.2.53 push to /etc/resolv.conf (stories/resolver-spread-audit), carries author svc-build — a service account closed 2015-07 and never reissued. This review answers one question: how can a closed account author a 2022 commit. Each row ends CLOSED or OPEN.

Checklist

1  account record .............. svc-build, service account, build
   system. Closed 2015-07 in the batch after the old build host was
   decommissioned. Reissue log: empty. Status: CLOSED, never
   reissued. Anomaly (authorship): OPEN.
2  credential inventory ........ password: rotated at closure, hash
   discarded. SSH keys: one, deployed to the build hosts. Estate
   revocation list: the key was ADDED on 2022-10-01, the day after
   commit 4c1a09f. Revoker row: `svc-build (self)`. Status: OPEN.
3  sso/token grants ............ none surviving. Git server auth
   log: server accepts keys presented by any account whose key is
   in the repo-side keyring. Keyring is a file, deploy_keys.list.
   `blame` on the svc-build key line gives commit 4c1a09f itself.
   Status: OPEN.
4  human owner ................. never recorded; `created_by
   (unset)`, the chk-0041 precedent. Status: OPEN.

Row 2 stated plainly: the revocation is post-hoc and performed by the subject of the revocation. The account closed 2015-07 revoked its own key on 2022-10-01, the day after the commit it made seven years after closure.

Row 3 stated plainly: the audit quoted 4c1a09f's diff for resolv.conf only. The full diff is TWO files, two added lines — + nameserver 192.0.2.53 in resolv.conf and + svc-build <key...> in deploy_keys.list. The key that authorizes the account is added by the commit the account authors.

Cross-check the review refuses to run

The commit date 2022-09-30 equals the date portion of zone serial 2022093001 (stories/axfr-from-53). svc-build's closure month-year 2015-07 has no relationship to it. The reviewer wrote: "noted, not read as causation," because the audit precedent says recording an equality is not reading it.

Disposition

The review cannot order deletion of a key that a closed account holds against a file the closed account wrote. Every remediation box requires an approver; the approver of record for deploy_keys.list is svc-build. Box left unsigned.

The review's one actionable output is this document.

See also stories/resolver-spread-audit, stories/chk-0041-ported, stories/axfr-from-53, stories/session-0. Source: the pages linked above, read 2026-09-13. Invented.