coulomb/railiance-platform
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Record KeyCape exposure owner receipts
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a02e56-e4ad-71a2-b3e2-b6193e0d8093
This commit is contained in:
codex 2026-08-23 14:37:36 +02:00
parent d18649fc6e
commit 7ce3bc8380
2 changed files with 23 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

14
docs/keycape-live-secret-exposure-recovery.md
View file

@ -62,6 +62,19 @@ Recheck these fields before a window using metadata-only columns and public
OIDC endpoints. A changed UID, resource version, source revision, image, or
JWKS digest invalidates the prepared approval receipt and requires review.
## Owner receipt update (2026-08-23)
KeyCape reports that its emergency signing-key rotation completed with
deliberate JWT invalidation; consumers must refresh JWKS/re-authenticate. The
receipt contains no secret values, but it does not yet identify the reviewed
non-secret client-config revision or the post-rotation public JWKS digest.
NetKingdom published the value-safe dependency and provider sequence at
`c24d67b`, noting that the LLDAP admin account is persistent and that the
privacyIDEA admin token is an expiring session JWT without individual
revocation. Use expiry-based predecessor denial unless a separate global
signing-secret invalidation is explicitly approved. These acknowledgements do
not constitute a live GO; the approval template remains pending.
## Ownership
| Boundary | Owner | Required contribution |
@ -174,4 +187,3 @@ provider access, unsafe helper output, an unverified cleanup trap, or no exact
human GO. Abort forward after mutation on failed readiness, missing negative
proof, an unexpected JWKS result, any captured value, or elapsed window. The
abort operator may stop the sequence at any time.

15
workplans/RAILIANCE-WP-0029-keycape-live-secret-exposure-recovery.md
View file

@ -12,7 +12,7 @@ updated: "2026-08-23"
related:
- KEY-WP-0011
origin: routed
origin_ref: "State Hub messages e88abb61-e393-4a82-817c-5ac378a2ee3d and acf98be3-ff6b-4270-bd21-0193bebd806b"
origin_ref: "State Hub messages e88abb61-e393-4a82-817c-5ac378a2ee3d, acf98be3-ff6b-4270-bd21-0193bebd806b, aeb216b5-9f1b-404b-a483-fb08a00a49b1, and 71b1008a-7fd7-4500-85c6-e8893a6d80d4"
---
# RAILIANCE-WP-0029 — KeyCape live Secret exposure recovery
@ -57,10 +57,15 @@ status: progress
priority: high
```
KeyCape must pin the non-secret client-config revision and either a unique-kid
overlap implementation or the exact immediate-invalidation/cache-refresh
procedure. NetKingdom must pin the LLDAP, Authelia, and privacyIDEA provider
steps. Railiance-platform must then issue one digest-bound approval template.
KeyCape acknowledged emergency rotation with deliberate JWT invalidation and
JWKS/cache refresh required (message `aeb216b5-9f1b-404b-a483-fb08a00a49b1`),
but has not yet supplied the non-secret client-config revision or a post-change
JWKS digest. NetKingdom pinned the value-safe dependency and provider sequence
at `c24d67b` (message `71b1008a-7fd7-4500-85c6-e8893a6d80d4`), including the
expiry-based privacyIDEA predecessor decision. The digest-bound approval
template is published at
`docs/keycape-exposure-rotation-approval.example.json`; all authorization
gates remain false pending the missing receipts and an exact human GO.
## T04 — Execute the attended rotation