From f374287a998bd16638676c717f3eafb9d1833760 Mon Sep 17 00:00:00 2001 From: tegwick Date: Fri, 3 Jul 2026 17:39:34 +0200 Subject: [PATCH] chore: record prod-whynot-design bootstrap token cleanup Mark H0 bootstrap file shredded after SECRETS-WP-0003 closeout; accessor revoke deferred while OpenBao is sealed (1h TTL likely expired). --- docs/hardening-backlog.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/hardening-backlog.md b/docs/hardening-backlog.md index 431aec2..a7d36db 100644 --- a/docs/hardening-backlog.md +++ b/docs/hardening-backlog.md @@ -15,7 +15,7 @@ Every minted bootstrap token has a revocation task. Track each here: | --- | --- | --- | --- | --- | | `~/.secrets-engine/bootstrap/prod.token` | prod | (n/a — demo uses dev server) | 1h | n/a | | `~/.secrets-engine/bootstrap/prod-warden-sign.token` | prod | SECRETS-WP-0004 live lane applied via attended operator flow; file use not recorded in repo | 1h | cleanup/revocation evidence not recorded | -| `~/.secrets-engine/bootstrap/prod-whynot-design.token` | prod | SECRETS-WP-0003 live apply/provision/publish 2026-07-03 | 1h | pending | +| `~/.secrets-engine/bootstrap/prod-whynot-design.token` | prod | SECRETS-WP-0003 live apply/provision/publish 2026-07-03 | 1h | file shredded 2026-07-03; accessor revoke deferred (OpenBao sealed; 1h TTL likely expired) | Revoke: `bao token revoke -accessor ` then `shred -u `. For SECRETS-WP-0004, the scoped `warden-sign` token used for the 2026-06-29