coulomb/secrets-engine
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Close warden-sign token lane

Browse source
This commit is contained in:
tegwick 2026-06-30 01:01:55 +02:00
parent 52e850f26b
commit e0ab1b8420
3 changed files with 64 additions and 14 deletions
Download patch file Download diff file Expand all files Collapse all files

9
docs/hardening-backlog.md
View file

@ -14,13 +14,14 @@ Every minted bootstrap token has a revocation task. Track each here:
| Token file | Stage | Minted | TTL | Revoked? |
| --- | --- | --- | --- | --- |
| `~/.secrets-engine/bootstrap/prod.token` | prod | (n/a — demo uses dev server) | 1h | n/a |
| `~/.secrets-engine/bootstrap/prod-warden-sign.token` | prod | pending SECRETS-WP-0004 live apply | 1h | pending |
| `~/.secrets-engine/bootstrap/prod-warden-sign.token` | prod | SECRETS-WP-0004 live lane applied via attended operator flow; file use not recorded in repo | 1h | cleanup/revocation evidence not recorded |
| `~/.secrets-engine/bootstrap/prod-whynot-design.token` | prod | pending SECRETS-WP-0003 live apply/provision | 1h | pending |
Revoke: `bao token revoke -accessor <accessor>` then `shred -u <file>`.
For SECRETS-WP-0004, revoke the scoped `warden-sign` token/accessor after the
FLEX-WP-0007 T4 smoke or when its `15m` TTL expires, and remove the handoff
files under `~/.secrets-engine/handoff/`.
For SECRETS-WP-0004, the scoped `warden-sign` token used for the 2026-06-29
smoke had a `15m` TTL; explicit accessor revocation and handoff-file cleanup are
operator-side hygiene if any material remains. Do not record accessors or file
contents in this repo.
## H0a — Revoke pilot workload tokens

11
docs/warden-sign-auth-capability.md
View file

@ -198,3 +198,14 @@ BAO_ADDR=https://bao.coulomb.social \
secrets-engine revoke warden-sign \
--bootstrap-token-file ~/.secrets-engine/bootstrap/prod-warden-sign.token
```
## Closeout status
On 2026-06-29 ops-warden reported the joint production smoke as passed against
the flex-auth runtime and production OpenBao. Non-secret evidence only:
`warden sign agt-state-hub-bridge` returned policy decision
`decision:032b096c433ad80c`, `--ttl 999` was denied with
`ttl_out_of_bounds` before OpenBao signing, and the vault-backed allow path used
the scoped `warden-sign` lane. `policy.enabled` remains off until the ecosystem
moves from build-stage/pre-testing into the maturity posture where live
enforcement is appropriate.