net-kingdom/workplans/NK-WP-0033-keycape-secret-exposure-rotation.md

id	type	title	domain	repo	status	owner	topic_slug	planning_priority	created	updated	origin	origin_ref	related	state_hub_workstream_id
NK-WP-0033	workplan	Contain and rotate the exposed KeyCape credential bundle	infotech	net-kingdom	active	codex	net-kingdom	P0	2026-08-23	2026-08-23	routed	State Hub message 8cc44a39-683c-4fab-80dd-b2275d0728e0	NK-WP-0032	63665674-6880-593e-96e6-bab3211b1352

NK-WP-0033 — KeyCape credential exposure containment and rotation

KeyCape reported that an agent tool rendered the base64 data map of the live sso/keycape-config Secret. Base64 is encoding, not protection. Treat the carried RS256 signing private key, LLDAP bind credential, Authelia client credential, and privacyIDEA admin token as exposed even though no value was decoded, reused, or intentionally repeated.

No task in this workplan authorizes a credential value in Git, State Hub, agent output, command arguments, or non-secret evidence. Live mutation requires the exact provider/custody owners, a reviewed sequence, abort and rollback conditions, and the authority stated by the owning execution path.

T01 — Contain, classify, and route the exposure

id: NK-WP-0033-T01
status: done
priority: high
state_hub_task_id: "28a655da-7cd6-58e2-8ca8-64d192de63a6"

Mark every credential class in the rendered bundle exposed, stop further rendering, consult credential routing, notify custody and issuer owners, and publish a sanitized risk notice.

Completed 2026-08-23. State Hub decision c43eef14-a209-41b1-ba67-781ca14c5ea2 requires governed rotation. Coordination was routed to railiance-platform in acf98be3-ff6b-4270-bd21-0193bebd806b and KeyCape in c774f748-6240-4733-89c7-518079a30f61; risk-nexus received sanitized notice c5d67801-1bc3-4e66-98c9-e08a58313970. No value was inspected or copied.

T02 — Agree the value-safe rotation and issuer-continuity contract

id: NK-WP-0033-T02
status: progress
priority: high
state_hub_task_id: "c5ca817c-d601-5172-a106-1546c0743635"

KeyCape and railiance-platform must name the authoritative provider, custody, and consumer update for all four classes; select one revision-pinned bundle or field-safe sequence that cannot replay a stale exposed value; specify positive and predecessor-negative verification; and state abort, rollback, and evidence rules.

KeyCape currently loads one private key and signs under static kid=key-1 even though its JWKS type can serve multiple keys. The contract must either add and verify an active-key plus retained-public-key overlap or deliberately accept immediate token invalidation and verifier refresh. Evidence was routed in 2b24ccc2-c031-453e-ac70-52f0aaa127d5 and 9277d962-b511-4da7-9fc6-2c79bac448c1.

Railiance-platform published its forward-only owner contract at revision 453fed3. NetKingdom review is recorded in history/2026-08-23-keycape-exposure-dependency-map.md. The review found that the LLDAP credential also feeds identity-provisioner and privacyIDEA's persisted LDAP resolver. It also found that privacyIDEA /auth issues an expiring administrative session JWT with no individual revocation operation; /token/revoke applies to MFA authenticators, not that JWT. T02 therefore remains in progress until the contract chooses expiry-based predecessor denial or separately authorizes wider JWT-signing-secret invalidation.

Warden routing has no concrete entries for these four KeyCape lanes. Catalog repair was requested in e5794329-cda5-4a6f-8234-a6eaa1fc318c; generic or unrelated routes do not authorize execution.

T03 — Implement a non-printing, non-stale rotation path

id: NK-WP-0033-T03
status: wait
priority: high
state_hub_task_id: "f0f6d6c3-9c45-56b7-9fd6-52fb0ea9054a"

After T02 review, implement or select an owner-controlled path that receives replacement material through hidden input or mode-0600 files, updates every provider and consumer in the agreed order, never reconstructs the bundle from stale local inputs, and retains no plaintext artifact after verification.

Provider-specific helpers must cover field-safe updates for lldap-secrets and authelia-secrets, the persistent LLDAP admin password, the identity-provisioner restart, privacyIDEA resolver lldap-coulomb, the Authelia client hash, and the privacyIDEA JWT expiry disposition. Static or dry-run tests must prove replacements do not enter argv or stdout.

Do not use sso-mfa/bootstrap/creds-rotate.sh through an agent as currently written: it prints generated replacement values and its signing-key path causes immediate invalidation. Do not use a helper that reads the live Secret unless its output and temporary-state behavior have been independently reviewed for this incident.

T04 — Execute the governed replacement cutover

id: NK-WP-0033-T04
status: wait
priority: high
state_hub_task_id: "751cca48-2bc9-5d44-80a0-60478717e99e"

Under the separately approved authority/window, replace the signing material, LLDAP bind credential, Authelia client credential, and privacyIDEA admin token; roll or reload every affected provider/consumer; preserve or explicitly end JWT continuity according to T02; and abort on partial-bundle or stale-source evidence. This task is not authorized until T02 and T03 are done.

T05 — Prove replacement, predecessor rejection, and cleanup

id: NK-WP-0033-T05
status: wait
priority: high
state_hub_task_id: "41e55d5c-ae28-5ee2-be25-b9a3758428f7"

Record only sanitized identifiers, public-key fingerprints, revisions, rollout status, positive authentication/MFA outcomes, predecessor rejection or expiry, cleanup receipts, and residual limitations. Close the incident only after all four credential classes have an authoritative disposition and no temporary plaintext or stale bundle remains.