From 8857d9ff6ffbcf257a8e0445be4bda9d3aef09bc Mon Sep 17 00:00:00 2001
From: tegwick <bernd.worsch@gmail.com>
Date: Fri, 16 Oct 2026 07:49:48 +0200
Subject: [PATCH] security(recovery): fence agent reads before publishing
 backup credentials

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a13eab-1e6a-7b33-9c37-372e90ada3a2
---
 .../identity-credential-setup.py              | 22 ++++++++++---------
 1 file changed, 12 insertions(+), 10 deletions(-)

diff --git a/tools/bootstrap-recovery/identity-credential-setup.py b/tools/bootstrap-recovery/identity-credential-setup.py
index 25549b8..da49bc0 100644
--- a/tools/bootstrap-recovery/identity-credential-setup.py
+++ b/tools/bootstrap-recovery/identity-credential-setup.py
@@ -202,6 +202,18 @@ def run(action,expected,receipt):
     if action=='publisher':
         receipt['publisher_quota_available']=offsite.quota(client,token)
         if receipt['publisher_quota_available']<offsite.HEADROOM+offsite.LIMIT:raise Refused()
+    # Fence agent reads before any initial secret publication.
+    boundary_path='sys/policies/acl/agent-high-risk-boundary'
+    current=data(bao(['read','-format=json',boundary_path]))['data']['policy'];added=''
+    for path in [lane['kv_path'],lane['kv_path'].replace('/data/','/metadata/',1)]:
+        stanza='path "'+path+'" { capabilities = ["deny"] }\n'
+        if '"'+path+'"' not in current:added+=stanza
+        elif stanza.strip() not in current:raise Refused()
+    if added:
+        if data(bao(['read','-format=json',boundary_path]))['data']['policy']!=current:raise Refused()
+        bao(['write',boundary_path,'-'],payload={'policy':current+'\n'+added})
+        if data(bao(['read','-format=json',boundary_path]))['data']['policy']!=current+'\n'+added:raise Refused()
+    receipt['coding_agent_fence_verified_before_publication']=True
     existing=bao(['read','-format=json',lane['kv_path']],allow_failure=True)
     if existing.returncode==0:
         native=data(existing)['data']
@@ -216,16 +228,6 @@ def run(action,expected,receipt):
         'path "auth/token/lookup-self" { capabilities = ["read"] }\n'
         'path "auth/token/revoke-self" { capabilities = ["update"] }\n')
     if policy!=expected_policy:raise Refused()
-    boundary_path='sys/policies/acl/agent-high-risk-boundary'
-    current=data(bao(['read','-format=json',boundary_path]))['data']['policy'];added=''
-    for path in [lane['kv_path'],lane['kv_path'].replace('/data/','/metadata/',1)]:
-        stanza='path "'+path+'" { capabilities = ["deny"] }\n'
-        if '"'+path+'"' not in current:added+=stanza
-        elif stanza.strip() not in current:raise Refused()
-    if added:
-        if data(bao(['read','-format=json',boundary_path]))['data']['policy']!=current:raise Refused()
-        bao(['write',boundary_path,'-'],payload={'policy':current+'\n'+added})
-        if data(bao(['read','-format=json',boundary_path]))['data']['policy']!=current+'\n'+added:raise Refused()
     ensure('sys/policies/acl/'+lane['policy'],{'policy':policy},lambda actual: None if actual['policy']==policy else (_ for _ in ()).throw(Refused()))
     ensure('auth/kubernetes/role/'+lane['role'],role_payload(lane),lambda actual:check_role(actual,lane))
     child=data(bao(['token','create','-format=json','-policy='+lane['policy'],'-policy=agent-high-risk-boundary','-no-default-policy','-ttl=60s']))['auth']['client_token']