coulomb/secrets-engine
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Close warden-sign token lane

Browse source
This commit is contained in:
tegwick 2026-06-30 01:01:55 +02:00
parent 52e850f26b
commit e0ab1b8420
3 changed files with 64 additions and 14 deletions
Download patch file Download diff file Expand all files Collapse all files

9
docs/hardening-backlog.md
View file

@ -14,13 +14,14 @@ Every minted bootstrap token has a revocation task. Track each here:
| Token file | Stage | Minted | TTL | Revoked? |
| --- | --- | --- | --- | --- |
| `~/.secrets-engine/bootstrap/prod.token` | prod | (n/a — demo uses dev server) | 1h | n/a |
| `~/.secrets-engine/bootstrap/prod-warden-sign.token` | prod | pending SECRETS-WP-0004 live apply | 1h | pending |
| `~/.secrets-engine/bootstrap/prod-warden-sign.token` | prod | SECRETS-WP-0004 live lane applied via attended operator flow; file use not recorded in repo | 1h | cleanup/revocation evidence not recorded |
| `~/.secrets-engine/bootstrap/prod-whynot-design.token` | prod | pending SECRETS-WP-0003 live apply/provision | 1h | pending |
Revoke: `bao token revoke -accessor <accessor>` then `shred -u <file>`.
For SECRETS-WP-0004, revoke the scoped `warden-sign` token/accessor after the
FLEX-WP-0007 T4 smoke or when its `15m` TTL expires, and remove the handoff
files under `~/.secrets-engine/handoff/`.
For SECRETS-WP-0004, the scoped `warden-sign` token used for the 2026-06-29
smoke had a `15m` TTL; explicit accessor revocation and handoff-file cleanup are
operator-side hygiene if any material remains. Do not record accessors or file
contents in this repo.
## H0a — Revoke pilot workload tokens