secrets-engine/docs/hardening-backlog.md

Hardening Backlog — Exit From Bootstrap Mode

The MVP runs in bootstrap mode: stage roles may be driven by temporary root-created OpenBao tokens read from mode-0600 files. That is acceptable setup material, not the steady state. This backlog tracks the work to retire it.

The MVP is honest about this: bootstrap mode is a documented, bounded phase with explicit revocation tasks — not a hidden permanent security posture.

H0 — Revoke outstanding bootstrap tokens (always-on hygiene)

Every minted bootstrap token has a revocation task. Track each here:

Token file	Stage	Minted	TTL	Revoked?
~/.secrets-engine/bootstrap/prod.token	prod	(n/a — demo uses dev server)	1h	n/a
~/.secrets-engine/bootstrap/prod-warden-sign.token	prod	SECRETS-WP-0004 live lane applied via attended operator flow; file use not recorded in repo	1h	cleanup/revocation evidence not recorded
~/.secrets-engine/bootstrap/prod-whynot-design.token	prod	SECRETS-WP-0003 live apply/provision/publish 2026-07-03	1h	file shredded 2026-07-03; accessor revoke deferred (OpenBao sealed; 1h TTL likely expired)

Revoke: bao token revoke -accessor <accessor> then shred -u <file>. For SECRETS-WP-0004, the scoped warden-sign token used for the 2026-06-29 smoke had a 15m TTL; explicit accessor revocation and handoff-file cleanup are operator-side hygiene if any material remains. Do not record accessors or file contents in this repo.

H0a — Revoke pilot workload tokens

Credential	Custody path	Minted	Revocation task	Revoked?
whynot-design Gitea bot npm/package token	OpenBao lanes whynot-design-npm-publish + platform/workloads/coulomb/whynot-design/npm-publish; handoff file shredded after provision	SECRETS-WP-0003 publish @whynot/design@0.4.1 2026-07-03	Rotate in Gitea when TTL/policy requires; handoff source file deleted with shred -u after provision	handoff shredded; lane value remains in OpenBao

H1 — Replace bootstrap token files with OIDC / service auth

• Implemented consumer scaffold: exact KeyCape client-credentials exchange, claim/lifetime preflight, strict client-secret file input, renewal boundary, and no implicit fallback.
• Remaining: railiance-platform stands up the exact-bound OpenBao JWT auth mount/role and publishes its non-secret connection contract.
• secrets-engine logs in via that method instead of reading a token file.
• Remove --bootstrap-token-file from the steady-state path (keep only for true break-glass, heavily audited).

H2 — Response-wrapped handoff

• Add a wrapped delivery mode using OpenBao response wrapping for operator handoff flows where exec-time injection does not fit.

H3 — Production dual-control

• Implemented consumer validator: exact action request, decision digest/binding, validity, State Hub provenance, and caller-selected minimum distinct approval count.
• Remaining: State Hub stores/serves the durable object and production handlers resolve it; all production live actions currently fail closed.

H4 — Rotation & lifecycle states

• Implement rotate and persistent compromised / deactivated lane states with evidence. Explicit suspend/deactivate/destroy plans now exist, and ordinary revoke safely aliases native AppRole/policy deactivation, but lane state and coordinated provider/workload rotation remain outstanding. Live destroy remains disabled until exact-action authorization is available.

H4a — Known-accessor operator command

• Delivery sessions already self-revoke in finally (SECRETS-WP-0007-T05).
• Residual from T03: no general CLI to revoke an already-issued token or lease by a non-secret accessor the operator already holds.
• Do not print accessors. Prefer fingerprint-only evidence.

H5 — Audit report command

• Implemented: secrets-engine audit <catalog-id> summarizes allowlisted local action/result, decision, session-cleanup, and State Hub delivery evidence.
• Implemented: idempotency/source headers and edge-relay queued-receipt/outbox-id visibility.
• Remaining: operator replay verification and OpenBao audit request-id correlation.

H6 — API service mode

• Expose the stabilized CLI semantics as a local service API for ops-warden, CI, agents, and a future UI — after the CLI contract is proven.

Exit criteria for "bootstrap mode is over"

• No steady-state flow reads a bootstrap token file.
• Every stage role authenticates through OIDC/service auth.
• Production provisioning beyond the pilot requires dual-control.
• Rotation and deactivation are first-class, evidenced operations.