coulomb/secrets-engine
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
secrets-engine/docs/native-lane-cutover.md
tegwick 3b355de300
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details
Prepare WP-0006 first-lane native cutover packet 
Re-render admitted-lane plans as kv-mount-check plus exact-path AppRole.
Name openrouter-llm-connect as the first candidate. Document apply,
verify, and rollback without authorizing live mutation. T05 stays wait
on T04 serving and attended authority.

Assistant: grok
Assistant-Session: 01a05f07-ae72-7781-9fcb-19efd61add00
2026-09-03 23:36:42 +02:00

2.6 KiB
Raw Blame History

Native lane cutover (SECRETS-WP-0006-T05 / T06)

Status: procedure only. Live apply is still fail-closed until SECRETS-WP-0007-T04 serves an exact-action approval and railiance-platform grants scoped attended authority. CCR references below are workload-lane provenance, not executable authorization for the native AppRole.

This document does not authorize production mutation.

Scope

Five admitted KV lanes on the existing platform mount. Workload delivery (ESO/OIDC) stays with current owners. Native apply adds only an exact-path read policy and bounded AppRole.

Do not batch-retire ops-warden interim proxies. T06 is per lane, after native evidence.

Cutover order

Chosen for increasing blast radius, not CCR age.

Order Lane Why this position
1 openrouter-llm-connect One field, one ESO consumer besides operator exec
2 email-connect-transactional Three fields; ingest bearer shared with user-engine
3 issue-core-ingestion-api-key Two fields, two ESO consumers
4 reuse-surface-hub-write-token Hub write + webhook HMAC, two coordinated consumers
5 forgejo-admin-api-token Site-admin PAT; last on purpose

What live apply would mutate (once approved)

Re-rendered 2026-09-02 against current build_plan. Every lane:

  • [kv-mount-check] platform — no mount create
  • [policy] exact platform/data/<path> read + metadata read
  • [approle] 15m TTL, 30m max, 15m single-use secret_id, 8 token uses

No KV put/patch, no ESO change, no provider rotation.

First-lane packet: openrouter-llm-connect

Provenance CCR: CCR-2026-0003 (existing workload lane only).

Required before OpenBao:

  1. Canonical ActionAuthorization for action=apply, resource catalog:openrouter-llm-connect, stage prod, exact policy/auth targets se-prod-openrouter-llm-connect.
  2. Successful approval-engine CAS consume of that request digest (GH-DEC-2026-003).
  3. Scoped attended production authority from railiance-platform (not a standing bootstrap token).
  4. llm-connect owner ready to confirm ESO/application health after apply.

Apply: secrets-engine apply openrouter-llm-connect --stage prod
then metadata-safe verify of field presence and unrelated-identity denial. No value in evidence. Delivery session must self-revoke.

Rollback (native only): delete AppRole and policy se-prod-openrouter-llm-connect. Leave KV and ESO untouched. Keep the ops-warden proxy until T06.

Explicit non-goals for T05

  • Provision or rotate the live OpenRouter key.
  • Retire all five proxies in one batch.
  • Treat CCR status or a local fixture as apply authorization.