From ed67780da8a29fe4bcfb977028eb3e93d99378ed Mon Sep 17 00:00:00 2001 From: tegwick Date: Thu, 10 Sep 2026 08:10:34 +0200 Subject: [PATCH] Record the rotation authority answer and why it was not scheduled The Qonto rotation blocker is narrowed from an open question to a schedulable act: railiance-platform named the executor, transport and authority, and will prepare the CCR if KeyCape asks. Not asked -- requesting a production credential rotation with a restart window is the operator's decision, so it was put to him. Established first that this rotation has no incident driver. The 2026-08-23 exposure covered credentials embedded in config.yaml and the signing key; the rapp-qonto secret is an env: secretRef in a separate Secret and was not in that payload. Lifecycle hygiene, not remediation -- which changes what a reasonable window looks like, and means nobody should be carrying it as leftover incident work. Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_01NV9oijZukGyGbRQGGKnK4P Assistant: claude-code Assistant-Model: opus Assistant-Process: 713576@bnt-lap001 Assistant-Session: 384c511d-9bce-4cb8-a676-2aef6c0c8df6 --- ...-WP-0014-native-credential-lane-handoff.md | 30 +++++++++++++++++++ 1 file changed, 30 insertions(+) diff --git a/workplans/KEY-WP-0014-native-credential-lane-handoff.md b/workplans/KEY-WP-0014-native-credential-lane-handoff.md index d96cf3e..0f1306e 100644 --- a/workplans/KEY-WP-0014-native-credential-lane-handoff.md +++ b/workplans/KEY-WP-0014-native-credential-lane-handoff.md @@ -61,6 +61,36 @@ credentials. Integration tests exercise the real token/JWKS handlers and browser callback, including forged state, tampering, excess scope and unsafe output. See docs/native-authentication.md for invocation and ownership boundaries. + +2026-09-10. The authority question is answered and the blocker is narrowed to a +schedulable act. railiance-platform named the executor (platform operator, +attended founder session; explicitly not ops-warden, not secrets-engine +autonomously, and no unattended agent), the transport (the governed +`openbao-platform-admin-login` lane via `warden access ... --exec`), and the +authority (founder_required attended OIDC, role=platform-admin). What is missing +is a rotation CCR, which they will prepare *if KeyCape asks* — a two-custodian +CAS rotation with a service restart being a distinct version-guarded operation +rather than an implementation detail of an existing lane. + +**Not asked, deliberately.** Requesting a production credential rotation with a +restart window is the operator's decision, not this repository's, so it was put +to him rather than answered here (ops-warden msg 10fcc8af). + +Established before recommending anything either way: **this rotation has no +incident driver.** KEY-WP-0011 recovered a real exposure on 2026-08-23, and the +coordinated rotation that followed replaced the RS256 signing key, the LLDAP bind +credential, the Authelia client credential and the privacyIDEA admin token. The +`rapp-qonto` client secret was not in that payload — it is an `env:` secretRef +resolved from a separate Kubernetes Secret, never inline in `config.yaml`, which +config validation enforces. So this is lifecycle hygiene, not remediation, and +nobody should be carrying it as leftover incident work. Hygiene can wait for a +chosen window; remediation could not. + +Also recorded: `warden route`/`warden plan` previously returned a generic match +that read as authorization, and offered read transports against a write need. +This repository declined to act on it; railiance-platform independently called it +a defect; fixed under WARDEN-WP-0038. + ## Admit rotation and verify consumer handoff ```task