# flex-auth decision-envelope signing key

Date: 2026-09-14
Catalog: `flex-auth-decision-envelope-signing-key` (status `draft` until the OpenBao lane exists)
Owner of **shape**: `flex-auth` (`docs/decision-envelope-signature.md`)
Owner of **key material**: OpenBao / `railiance-platform` — flex-auth does not mint this key

Detached Ed25519 key used to sign `flex-auth.decision-record.v1` envelopes so a
stored allow remains attributable after the HTTP connection is gone
(`FLEX-WP-0024`, `FLEX-DEC-2026-010`).

**This lane is a pointer.** ops-warden routes it and executes nothing.

**Ask first:** `warden plan "decision envelope signing key" --json`.

---

## Worker checklist

1. Do **not** generate a key in `flex-auth` or paste a seed into Git, State Hub, or chat.
2. The proposed KV path is `platform/workloads/flex-auth/envelope-signing`.
   Fields: `ED25519_PRIVATE_KEY` (secret), `ED25519_PUBLIC_KEY` and `kid` (public).
3. flex-auth loads the private key the same way it loads TokenReview credentials.
   With no key configured it emits `signature.mode=unsigned`.
4. Consumers verify with `kid` against the published public key list, not a pinned
   single key. Rotation overlap is the allow TTL (default 15m) plus a short margin.

## Verify (capabilities-safe)

```bash
bao token capabilities <lane-token> platform/data/workloads/flex-auth/envelope-signing
# expect: read on the workload identity; deny for unrelated paths
```

Do not print the private field.