36 lines
1.4 KiB
Markdown
36 lines
1.4 KiB
Markdown
|
# flex-auth decision-envelope signing key
|
||
|
|
|
||
|
|
Date: 2026-09-14
|
||
|
|
Catalog: `flex-auth-decision-envelope-signing-key` (status `draft` until the OpenBao lane exists)
|
||
|
|
Owner of **shape**: `flex-auth` (`docs/decision-envelope-signature.md`)
|
||
|
|
Owner of **key material**: OpenBao / `railiance-platform` — flex-auth does not mint this key
|
||
|
|
|
||
|
|
Detached Ed25519 key used to sign `flex-auth.decision-record.v1` envelopes so a
|
||
|
|
stored allow remains attributable after the HTTP connection is gone
|
||
|
|
(`FLEX-WP-0024`, `FLEX-DEC-2026-010`).
|
||
|
|
|
||
|
|
**This lane is a pointer.** ops-warden routes it and executes nothing.
|
||
|
|
|
||
|
|
**Ask first:** `warden plan "decision envelope signing key" --json`.
|
||
|
|
|
||
|
|
---
|
||
|
|
|
||
|
|
## Worker checklist
|
||
|
|
|
||
|
|
1. Do **not** generate a key in `flex-auth` or paste a seed into Git, State Hub, or chat.
|
||
|
|
2. The proposed KV path is `platform/workloads/flex-auth/envelope-signing`.
|
||
|
|
Fields: `ED25519_PRIVATE_KEY` (secret), `ED25519_PUBLIC_KEY` and `kid` (public).
|
||
|
|
3. flex-auth loads the private key the same way it loads TokenReview credentials.
|
||
|
|
With no key configured it emits `signature.mode=unsigned`.
|
||
|
|
4. Consumers verify with `kid` against the published public key list, not a pinned
|
||
|
|
single key. Rotation overlap is the allow TTL (default 15m) plus a short margin.
|
||
|
|
|
||
|
|
## Verify (capabilities-safe)
|
||
|
|
|
||
|
|
```bash
|
||
|
|
bao token capabilities <lane-token> platform/data/workloads/flex-auth/envelope-signing
|
||
|
|
# expect: read on the workload identity; deny for unrelated paths
|
||
|
|
```
|
||
|
|
|
||
|
|
Do not print the private field.
|