coulomb/net-kingdom
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix: separate bootstrap encryption from private root custody
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a12d13-27f2-7163-b8c0-f682af02772c
This commit is contained in:
tegwick 2026-10-12 09:41:08 +02:00
parent d552bf253c
commit b97f9f616f
11 changed files with 566 additions and 339 deletions
Download patch file Download diff file Expand all files Collapse all files

22
docs/security-bootstrap-age-custody.md
View file

@ -130,3 +130,25 @@ make sops-custody-shell
Run the required SOPS, recovery, or lockdown commands inside that shell. Exit
the shell to shred the temporary key file.
## Bootstrap implementation correction — 2026-10-12
The compatibility `creds-agent-init` command now encrypts using `keys/age.pub`.
It does not generate or discover private keys. Live bootstrap requires the
operator terminal; `--dry-run` is a non-mutating plan. For an encrypted resume,
use the explicit custody helper with the independently held matching key. The
bootstrap validates that temporary key before contacting the cluster.
The former emergency-bundle export is a non-secret guide. The current encrypted
ops bundle is handed off by location and SHA256, and a fresh operator
acknowledgment is required before plaintext cleanup/completion. Old delivery
flags retain their historical meaning and do not acknowledge a new artifact.
Generation no longer logs value prefixes and creates private files even under a
permissive caller umask. These controls do not enforce agent runtime isolation.
Recovery verification uses an owner-approved isolated workspace and target. With
the helper's temporary key, decrypt the exact bundle to a private file, verify
its expected contents without printing values, then remove decrypted files and
retain a non-secret receipt. Acknowledgment of a guide is not that verification.
No live root or password was read or rotated during the source correction.
NK-WP-0049 tracks remaining native acceptance and other legacy custody callers.