coulomb/net-kingdom
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

docs(security): map KeyCape rotation dependencies
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a02929-244b-7391-b933-c04010e8eedb
This commit is contained in:
tegwick 2026-08-23 14:17:42 +02:00
parent 9ae4e24305
commit c24d67bb85
2 changed files with 143 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

16
workplans/NK-WP-0033-keycape-secret-exposure-rotation.md
View file

@ -72,6 +72,16 @@ immediate token invalidation and verifier refresh. Evidence was routed in
`2b24ccc2-c031-453e-ac70-52f0aaa127d5` and
`9277d962-b511-4da7-9fc6-2c79bac448c1`.
Railiance-platform published its forward-only owner contract at revision
`453fed3`. NetKingdom review is recorded in
`history/2026-08-23-keycape-exposure-dependency-map.md`. The review found that
the LLDAP credential also feeds identity-provisioner and privacyIDEA's
persisted LDAP resolver. It also found that privacyIDEA `/auth` issues an
expiring administrative session JWT with no individual revocation operation;
`/token/revoke` applies to MFA authenticators, not that JWT. T02 therefore
remains in progress until the contract chooses expiry-based predecessor denial
or separately authorizes wider JWT-signing-secret invalidation.
Warden routing has no concrete entries for these four KeyCape lanes. Catalog
repair was requested in `e5794329-cda5-4a6f-8234-a6eaa1fc318c`; generic or
unrelated routes do not authorize execution.
@ -90,6 +100,12 @@ replacement material through hidden input or mode-0600 files, updates every
provider and consumer in the agreed order, never reconstructs the bundle from
stale local inputs, and retains no plaintext artifact after verification.
Provider-specific helpers must cover field-safe updates for `lldap-secrets`
and `authelia-secrets`, the persistent LLDAP admin password, the
identity-provisioner restart, privacyIDEA resolver `lldap-coulomb`, the
Authelia client hash, and the privacyIDEA JWT expiry disposition. Static or
dry-run tests must prove replacements do not enter argv or stdout.
Do not use `sso-mfa/bootstrap/creds-rotate.sh` through an agent as currently
written: it prints generated replacement values and its signing-key path
causes immediate invalidation. Do not use a helper that reads the live Secret