diff --git a/manifests/custody-descriptions.yaml b/manifests/custody-descriptions.yaml index cafcf38..8c5639a 100644 --- a/manifests/custody-descriptions.yaml +++ b/manifests/custody-descriptions.yaml @@ -30,7 +30,7 @@ platform/workloads/activity-core/llm-connect/llm-connect-provider-secrets: on_loss: 'Re-issue per rotation: Replace OPENROUTER_API_KEY directly in OpenBao and record non-secret rotation evidence.' owner: railiance-platform - review: draft + review: accepted rotation: railiance-platform/credential-change-requests/CCR-2026-0003-llm-connect-openrouter-api-key.yaml#lifecycle.rotate sources: - CCR-2026-0003-llm-connect-openrouter-api-key.yaml @@ -43,7 +43,7 @@ platform/workloads/activity-core/ops-run-workers/rein-aharness-metered-railiance on_loss: 'Re-issue per rotation: activity-core re-mints the worker token at its path. ESO syncs it within 1h, and the queue accepts the new token per ACTIVITY_CORE_WORKERS.' owner: railiance-platform - review: draft + review: accepted rotation: railiance-platform/credential-change-requests/CCR-2026-0030-activity-core-ops-run-worker-rein-aharness-metered-railiance01.yaml#lifecycle.rotate sources: - CCR-2026-0030-activity-core-ops-run-worker-rein-aharness-metered-railiance01.yaml @@ -56,7 +56,7 @@ platform/workloads/activity-core/ops-run-workers/rein-aharness-railiance01: on_loss: 'Re-issue per rotation: activity-core re-mints the worker token at its path. ESO syncs it within 1h, and the queue accepts the new token per ACTIVITY_CORE_WORKERS.' owner: railiance-platform - review: draft + review: accepted rotation: railiance-platform/credential-change-requests/CCR-2026-0029-activity-core-ops-run-worker-rein-aharness-railiance01.yaml#lifecycle.rotate sources: - CCR-2026-0029-activity-core-ops-run-worker-rein-aharness-railiance01.yaml @@ -82,7 +82,7 @@ platform/workloads/approval-engine/audit-sender: only, deliver it, prove acceptance, then remove the predecessor and prove refusal. The first-provision helper refuses rotation and unexpected existing values.' owner: railiance-platform - review: draft + review: accepted rotation: railiance-platform/credential-change-requests/CCR-2026-0021-approval-engine-audit.yaml#lifecycle.rotate sources: - CCR-2026-0021-approval-engine-audit.yaml @@ -96,7 +96,7 @@ platform/workloads/approval-engine/operator-client: on_loss: 'Re-issue per rotation: KeyCape mints a replacement client secret; platform writes the new KV version under the same attended authority. Rotation is independent of CCR-2026-0017.' owner: railiance-platform - review: draft + review: accepted rotation: railiance-platform/credential-change-requests/CCR-2026-0018-keycape-approval-engine-operator-client.yaml#lifecycle.rotate; railiance-platform/credential-change-requests/CCR-2026-0020-approval-engine-operator-client-read.yaml#lifecycle.rotate sources: @@ -113,7 +113,7 @@ platform/workloads/audit-core/senders: on_loss: audit-core re-mints sender tokens and every projected copy is reseeded; senders queue to their local outboxes meanwhile. See ops-mason/plans/audit-core-openbao-runtime-custody.md. owner: ops-mason - review: draft + review: accepted rotation: ops-warden/wiki/playbooks/audit-core-senders.md#worker-checklist sources: - ops-warden catalog audit-core-senders @@ -129,7 +129,7 @@ platform/workloads/core-hub/forgejo-source-read: PAT for core-hub-source, write it to OpenBao from stdin, let ESO refresh (5m), pass make verify-publisher, then revoke the predecessor PAT and record evidence.' owner: railiance-platform - review: draft + review: accepted rotation: railiance-platform/credential-change-requests/CCR-2026-0031-core-hub-forgejo-source-read.yaml#lifecycle.rotate sources: - CCR-2026-0031-core-hub-forgejo-source-read.yaml @@ -147,7 +147,7 @@ platform/workloads/core-hub/runtime: the OpenBao field through attended custody, wait for ESO sync, roll Core Hub and consumers, verify protected calls, then invalidate the old token.' owner: railiance-platform - review: draft + review: accepted rotation: railiance-platform/credential-change-requests/CCR-2026-0013-core-hub-runtime-api-token.yaml#lifecycle.rotate sources: - CCR-2026-0013-core-hub-runtime-api-token.yaml @@ -162,7 +162,7 @@ platform/workloads/coulomb-social/backup-primary: required. This helper refuses different existing bytes; retain old provider identity until new publication/recovery acceptance, then revoke predecessor at provider.' owner: railiance-platform - review: draft + review: accepted rotation: railiance-platform/credential-change-requests/CCR-2026-0036-coulomb-social-backup-primary.yaml#lifecycle.rotate sources: - CCR-2026-0036-coulomb-social-backup-primary.yaml @@ -188,7 +188,7 @@ platform/workloads/email-connect/backup-primary: required. This helper refuses different existing bytes; retain old provider identity until new publication/recovery acceptance, then revoke predecessor at provider.' owner: railiance-platform - review: draft + review: accepted rotation: railiance-platform/credential-change-requests/CCR-2026-0037-email-connect-backup-primary.yaml#lifecycle.rotate sources: - CCR-2026-0037-email-connect-backup-primary.yaml @@ -202,7 +202,7 @@ platform/workloads/email-connect/transactional: wait for ESO refresh (or force sync); roll email-connect and user-engine as needed; revoke old provider password / retire old bearer.' owner: railiance-platform - review: draft + review: accepted rotation: railiance-platform/credential-change-requests/CCR-2026-0010-email-connect-transactional.yaml#lifecycle.rotate sources: - CCR-2026-0010-email-connect-transactional.yaml @@ -219,7 +219,7 @@ platform/workloads/forgejo/forgejo-admin: on_loss: 'Re-issue per rotation: Mint a new PAT in Forgejo, update API_TOKEN in OpenBao, record non-secret rotation evidence, and restart dependent automation after downstream consumers load from OpenBao.' owner: railiance-platform - review: draft + review: accepted rotation: railiance-platform/credential-change-requests/CCR-2026-0006-forgejo-admin-api-token-lane.yaml#lifecycle.rotate sources: - CCR-2026-0006-forgejo-admin-api-token-lane.yaml @@ -234,7 +234,7 @@ platform/workloads/glas-harness/claude-agent-dev: stop old runs, verify new delivery and inference, then revoke the predecessor at Anthropic and prove its denial.' owner: railiance-platform - review: draft + review: accepted rotation: railiance-platform/credential-change-requests/CCR-2026-0016-glas-claude-anthropic.yaml#lifecycle.rotate sources: - CCR-2026-0016-glas-claude-anthropic.yaml @@ -246,7 +246,7 @@ platform/workloads/inbound-library/imap: on_loss: 'rotate by ops-mason: bao write -f auth/approle/role/inbound-library/secret-id -> new secret_id; deliver mode-0600 to ~/.local/inbound-library/approle; shred old secret_id file.' owner: ops-mason - review: draft + review: accepted rotation: ops-warden/wiki/playbooks/inbound-library-imap-approle.md#worker-checklist sources: - ops-warden catalog inbound-library-imap-approle @@ -261,7 +261,7 @@ platform/workloads/informed-decision/audit-sender: only, deliver it, prove acceptance, then remove the predecessor and prove refusal. The first-provision helper refuses rotation and unexpected existing values.' owner: railiance-platform - review: draft + review: accepted rotation: railiance-platform/credential-change-requests/CCR-2026-0022-informed-decision-audit.yaml#lifecycle.rotate sources: - CCR-2026-0022-informed-decision-audit.yaml @@ -275,7 +275,7 @@ platform/workloads/informed-decision/sitting-requester: on_loss: 'Re-issue per rotation: Rotate through KeyCape and platform using a new version with predecessor refusal proof.' owner: railiance-platform - review: draft + review: accepted rotation: railiance-platform/credential-change-requests/CCR-2026-0026-informed-decision-sitting-requester-verifier.yaml#lifecycle.rotate; railiance-platform/credential-change-requests/CCR-2026-0027-informed-decision-sitting-requester-reader.yaml#lifecycle.rotate sources: @@ -289,7 +289,7 @@ platform/workloads/issue-core/issue-core/issue-core-runtime: on_loss: 'Re-issue per rotation: Replace issue-core runtime secret values directly in OpenBao and record non-secret rotation evidence.' owner: railiance-platform - review: draft + review: accepted rotation: railiance-platform/credential-change-requests/CCR-2026-0002-issue-core-ingestion-api-key.yaml#lifecycle.rotate sources: - CCR-2026-0002-issue-core-ingestion-api-key.yaml @@ -304,7 +304,7 @@ platform/workloads/keycape/secrets-engine-openbao: under a standing rotation approval for this CCR (event-driven + 90d); never a read or restore of an old version' owner: railiance-platform - review: draft + review: accepted rotation: railiance-platform/credential-change-requests/CCR-2026-0033.yaml#lifecycle.rotate; railiance-platform/credential-change-requests/CCR-2026-0034.yaml#lifecycle.rotate sources: - CCR-2026-0033.yaml @@ -330,7 +330,7 @@ platform/workloads/net-kingdom/keycape-factor-read: on_loss: 'Re-issue per rotation: Issue replacement before expiry, CAS update exact KV, verify ESO projection and consumer acceptance; retain no plaintext artifacts.' owner: railiance-platform - review: draft + review: accepted rotation: railiance-platform/credential-change-requests/CCR-2026-0023-keycape-factor-read.yaml#lifecycle.rotate sources: - CCR-2026-0023-keycape-factor-read.yaml @@ -343,7 +343,7 @@ platform/workloads/policy-nexus/forgejo-source-read: on_loss: 'Re-issue per rotation: Mint a replacement read:repository-only PAT, update OpenBao and the Actions secret through attended custody, pass one candidate build, then revoke the predecessor.' owner: railiance-platform - review: draft + review: accepted rotation: railiance-platform/credential-change-requests/CCR-2026-0014-policy-nexus-forgejo-source-read.yaml#lifecycle.rotate sources: - CCR-2026-0014-policy-nexus-forgejo-source-read.yaml @@ -357,7 +357,7 @@ platform/workloads/railiance-clock/authority-signing: on_loss: 'Re-issue per rotation: Stop authority, perform separately versioned attended CAS rotation and atomic host replacement, then admit new public key and epoch for consumers.' owner: railiance-platform - review: draft + review: accepted rotation: railiance-platform/credential-change-requests/CCR-2026-0028-railiance-clock-authority-signing.yaml#lifecycle.rotate sources: - CCR-2026-0028-railiance-clock-authority-signing.yaml @@ -380,7 +380,7 @@ platform/workloads/railiance/backup/object-storage: on_loss: 'Re-issue per rotation: Overlap-first. Put a new key in OpenBao, wait for ESO refresh, revoke the old Scaleway key.' owner: railiance-platform - review: draft + review: accepted rotation: railiance-platform/credential-change-requests/CCR-2026-0012-backup-object-storage.yaml#lifecycle.rotate sources: - CCR-2026-0012-backup-object-storage.yaml @@ -395,7 +395,7 @@ platform/workloads/railiance/backup/offsite-lane: on_loss: 'Re-issue per rotation: Mint a new Nextcloud upload token, update NC_WEBDAV_TOKEN in OpenBao, and record non-secret rotation evidence.' owner: railiance-platform - review: draft + review: accepted rotation: railiance-platform/credential-change-requests/CCR-2026-0004-railiance-backup-offsite-lane.yaml#lifecycle.rotate sources: - CCR-2026-0004-railiance-backup-offsite-lane.yaml @@ -407,7 +407,7 @@ platform/workloads/railiance/scaleway/bootstrap: missing: [] on_loss: 'Re-issue per rotation: Put a new bootstrap key; do not reuse the scoped backup key.' owner: railiance-platform - review: draft + review: accepted rotation: railiance-platform/credential-change-requests/CCR-2026-0011-scaleway-object-storage-bootstrap.yaml#lifecycle.rotate sources: - CCR-2026-0011-scaleway-object-storage-bootstrap.yaml @@ -431,7 +431,7 @@ platform/workloads/reuse/reuse-surface/runtime-secrets: on_loss: 'Re-issue per rotation: Replace field values directly in OpenBao, wait for ESO refresh, rollout reuse-surface, then run make reuse-forgejo-webhook when rotating the webhook HMAC.' owner: railiance-platform - review: draft + review: accepted rotation: railiance-platform/credential-change-requests/CCR-2026-0005-reuse-surface-runtime-secrets-lane.yaml#lifecycle.rotate sources: - CCR-2026-0005-reuse-surface-runtime-secrets-lane.yaml @@ -448,7 +448,7 @@ platform/workloads/secrets-engine/approval-client: KV version under the same attended authority; ESO refresh delivers it and KeyCape restarts or re-reads. Rotation is independent of the operator client.' owner: railiance-platform - review: draft + review: accepted rotation: railiance-platform/credential-change-requests/CCR-2026-0017-keycape-secrets-engine-approval-client.yaml#lifecycle.rotate; railiance-platform/credential-change-requests/CCR-2026-0019-secrets-engine-approval-client-read.yaml#lifecycle.rotate sources: @@ -466,7 +466,7 @@ platform/workloads/secrets-engine/approval-requester: on_loss: 'Re-issue per rotation: Rotate through KeyCape and platform using a new version with predecessor refusal proof.' owner: railiance-platform - review: draft + review: accepted rotation: railiance-platform/credential-change-requests/CCR-2026-0024-t03-requester-verifier.yaml#lifecycle.rotate; railiance-platform/credential-change-requests/CCR-2026-0025-t03-requester-reader.yaml#lifecycle.rotate sources: @@ -480,7 +480,7 @@ platform/workloads/state-hub/repository-rename-preflight: on_loss: 'Re-issue per rotation: Stop every API replica and verify no matching pods before CAS rotation; wait ESO, recreate API replicas with one version, verify old token invalidation and health.' owner: railiance-platform - review: draft + review: accepted rotation: railiance-platform/credential-change-requests/CCR-2026-0015-state-hub-preflight-signing.yaml#lifecycle.rotate sources: - CCR-2026-0015-state-hub-preflight-signing.yaml @@ -507,7 +507,7 @@ platform/workloads/tenant-engine/audit-core-sender: audit-core re-mints if the registry entry is also gone; emission waits in tenant-engine's local outbox meanwhile. owner: railiance-platform - review: draft + review: accepted rotation: ops-mason/plans/tenant-engine-audit-core-sender-projection.md; reseed with railiance-platform/scripts/tenant_engine_audit_core_sender_seed.py sources: - ops-mason plan (hand-filled 2026-10-09)