coulomb/ops-warden
4
0
Fork 0
Code Issues Pull requests Projects Releases 2 Packages Wiki Activity Actions
ops-warden/wiki/playbooks/flex-auth-decision-envelope-signing-key.md
tegwick 8a40dcb11b
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details
Draft the flex-auth envelope-signing credential route. 
Pointer-only, warden_executes false. Shape lives in flex-auth;
OpenBao path is not built yet. Testdata keys are not this lane.

Assistant: grok
Assistant-Session: 01a09dc1-b21e-77e1-919e-fcad2f82b267
2026-09-14 09:59:11 +02:00

1.4 KiB
Raw Blame History

flex-auth decision-envelope signing key

Date: 2026-09-14 Catalog: flex-auth-decision-envelope-signing-key (status draft until the OpenBao lane exists) Owner of shape: flex-auth (docs/decision-envelope-signature.md) Owner of key material: OpenBao / railiance-platform — flex-auth does not mint this key

Detached Ed25519 key used to sign flex-auth.decision-record.v1 envelopes so a stored allow remains attributable after the HTTP connection is gone (FLEX-WP-0024, FLEX-DEC-2026-010).

This lane is a pointer. ops-warden routes it and executes nothing.

Ask first: warden plan "decision envelope signing key" --json.

Worker checklist

  1. Do not generate a key in flex-auth or paste a seed into Git, State Hub, or chat.
  2. The proposed KV path is platform/workloads/flex-auth/envelope-signing. Fields: ED25519_PRIVATE_KEY (secret), ED25519_PUBLIC_KEY and kid (public).
  3. flex-auth loads the private key the same way it loads TokenReview credentials. With no key configured it emits signature.mode=unsigned.
  4. Consumers verify with kid against the published public key list, not a pinned single key. Rotation overlap is the allow TTL (default 15m) plus a short margin.

Verify (capabilities-safe)

bao token capabilities <lane-token> platform/data/workloads/flex-auth/envelope-signing
# expect: read on the workload identity; deny for unrelated paths

Do not print the private field.