coulomb/secrets-engine
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

chore: record prod-whynot-design bootstrap token cleanup

Browse source 
Mark H0 bootstrap file shredded after SECRETS-WP-0003 closeout; accessor
revoke deferred while OpenBao is sealed (1h TTL likely expired).
This commit is contained in:
tegwick 2026-07-03 17:39:34 +02:00
parent 32dfd4c78b
commit f374287a99
1 changed files with 1 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

2
docs/hardening-backlog.md
View file

@ -15,7 +15,7 @@ Every minted bootstrap token has a revocation task. Track each here:
| --- | --- | --- | --- | --- |
| `~/.secrets-engine/bootstrap/prod.token` | prod | (n/a — demo uses dev server) | 1h | n/a |
| `~/.secrets-engine/bootstrap/prod-warden-sign.token` | prod | SECRETS-WP-0004 live lane applied via attended operator flow; file use not recorded in repo | 1h | cleanup/revocation evidence not recorded |
| `~/.secrets-engine/bootstrap/prod-whynot-design.token` | prod | SECRETS-WP-0003 live apply/provision/publish 2026-07-03 | 1h | pending |
| `~/.secrets-engine/bootstrap/prod-whynot-design.token` | prod | SECRETS-WP-0003 live apply/provision/publish 2026-07-03 | 1h | file shredded 2026-07-03; accessor revoke deferred (OpenBao sealed; 1h TTL likely expired) |
Revoke: `bao token revoke -accessor <accessor>` then `shred -u <file>`.
For SECRETS-WP-0004, the scoped `warden-sign` token used for the 2026-06-29