---
id: KEY-WP-0011
type: workplan
title: "Recover from live KeyCape Secret output exposure"
domain: infotech
repo: key-cape
status: blocked
owner: codex
topic_slug: netkingdom
created: "2026-08-23"
updated: "2026-08-23"
state_hub_workstream_id: "158aa957-8818-52ea-b7a5-3962cf30ba5e"
---

# KEY-WP-0011 — Live KeyCape Secret exposure recovery

Recover safely after the base64 data map of Kubernetes Secret
`sso/keycape-config` was mistakenly rendered in agent tool output during a
metadata check. Never reproduce, decode, or store the exposed payload.

## Contain and notify owners

```task
id: KEY-WP-0011-T01
status: done
priority: high
state_hub_task_id: "a8f5e33d-c725-5181-849e-a42bba34d3d8"
```

Stopped live rollout work, treated the payload as exposed, and notified
railiance-platform and NetKingdom without values. The affected classes are the
KeyCape RS256 signing private key and credentials embedded in `config.yaml`
(LLDAP bind credential, Authelia client credential, and privacyIDEA admin
token). No value was decoded, reused, or intentionally repeated and no live
mutation was attempted.

## Approve and execute coordinated rotation

```task
id: KEY-WP-0011-T02
status: wait
priority: high
state_hub_task_id: "9d60569c-a0f1-53a9-b4dc-01687ab92bcc"
```

Requires an approved owner-coordinated rotation plan. KeyCape signing-key
rollover must account for JWT/JWKS continuity or deliberate invalidation;
backend credential rotations must update each issuing system and every
consumer atomically enough to avoid an authentication outage. Secret values
must use approved custody transports and never enter Git, State Hub, chat,
arguments, or ordinary logs.

## Verify recovery without values

```task
id: KEY-WP-0011-T03
status: wait
priority: high
state_hub_task_id: "a079573d-97fd-5c6c-b1f9-c0af65e2933a"
```

After rotation, verify new resource versions and non-secret fingerprints,
KeyCape readiness/discovery/JWKS, LLDAP lookup, Authelia authorization handoff,
privacyIDEA fail-closed MFA, and invalidation of the superseded credentials.
Verification must not render any Kubernetes Secret data or authentication
value.