coulomb/railiance-infra
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Fix rotation review evidence and reconcile blocked S1 workplans
Some checks failed
CI Smoke / host-smoke (push) Waiting to run
Details
CI Smoke / container-smoke (push) Waiting to run
Details
CI Smoke / source-contract (push) Has been cancelled
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a0e3b9-b19e-7ba1-9eb4-4faea76af3ea
This commit is contained in:
codex 2026-09-27 18:47:55 +02:00
parent 41f25fe42d
commit 9886567b40
10 changed files with 255 additions and 18 deletions
Download patch file Download diff file Expand all files Collapse all files

7
docs/sops-rotation.md
View file

@ -8,6 +8,8 @@ python3 scripts/sops_rotation.py --check
It compares each protected file's public age-recipient metadata with the first
matching rule in `.sops.yaml`. CI runs this check to detect recipient drift.
The JSON output includes the exact file paths, ciphertext SHA-256 hashes, and
before/after recipient sets. Run without `--check` to inspect proposed drift.
An attended non-printing decryption check may emit a receipt:
@ -21,7 +23,10 @@ receipt or command output.
Actual key updates require `--apply` and an approval YAML containing
`approved: true`, `approved_by`, `approved_at`, and an exact `changes` list from
the current plan. The command fails if that list differs from current metadata.
the current plan (including each changed file's `sha256`). The command fails if
that list differs from current metadata or the reviewed ciphertext has changed.
Applied receipts retain the reviewed before/after recipient sets and original
ciphertext hash, plus `after_sha256` for the resulting ciphertext.
Review and preserve recovery-key custody before approving recipient removal.
Start from `docs/sops-rotation-approval.example.yaml`; the committed example is
deliberately unapproved and contains no usable recipient.