tegwick
6f8b7bade5
T03, T05, and T06 are done: lifecycle split, session self-revoke, and verification/evidence acceptance are in the CLI. T04 waits on the durable ActionAuthorization serving path rather than looking like local progress. Known-accessor operator command is residual H4a, not unfinished T03. Assistant: grok Assistant-Session: 01a04cea-cb33-7c63-bad7-c1b0f9f0076b
90 lines
4.6 KiB
Markdown
90 lines
4.6 KiB
Markdown
# Hardening Backlog — Exit From Bootstrap Mode
|
|
|
|
The MVP runs in **bootstrap mode**: stage roles may be driven by temporary
|
|
root-created OpenBao tokens read from mode-0600 files. That is acceptable setup
|
|
material, **not** the steady state. This backlog tracks the work to retire it.
|
|
|
|
The MVP is honest about this: bootstrap mode is a documented, bounded phase with
|
|
explicit revocation tasks — not a hidden permanent security posture.
|
|
|
|
## H0 — Revoke outstanding bootstrap tokens (always-on hygiene)
|
|
|
|
Every minted bootstrap token has a revocation task. Track each here:
|
|
|
|
| Token file | Stage | Minted | TTL | Revoked? |
|
|
| --- | --- | --- | --- | --- |
|
|
| `~/.secrets-engine/bootstrap/prod.token` | prod | (n/a — demo uses dev server) | 1h | n/a |
|
|
| `~/.secrets-engine/bootstrap/prod-warden-sign.token` | prod | SECRETS-WP-0004 live lane applied via attended operator flow; file use not recorded in repo | 1h | cleanup/revocation evidence not recorded |
|
|
| `~/.secrets-engine/bootstrap/prod-whynot-design.token` | prod | SECRETS-WP-0003 live apply/provision/publish 2026-07-03 | 1h | file shredded 2026-07-03; accessor revoke deferred (OpenBao sealed; 1h TTL likely expired) |
|
|
|
|
Revoke: `bao token revoke -accessor <accessor>` then `shred -u <file>`.
|
|
For SECRETS-WP-0004, the scoped `warden-sign` token used for the 2026-06-29
|
|
smoke had a `15m` TTL; explicit accessor revocation and handoff-file cleanup are
|
|
operator-side hygiene if any material remains. Do not record accessors or file
|
|
contents in this repo.
|
|
|
|
## H0a — Revoke pilot workload tokens
|
|
|
|
| Credential | Custody path | Minted | Revocation task | Revoked? |
|
|
| --- | --- | --- | --- | --- |
|
|
| whynot-design Gitea bot npm/package token | OpenBao lanes `whynot-design-npm-publish` + `platform/workloads/coulomb/whynot-design/npm-publish`; handoff file shredded after provision | SECRETS-WP-0003 publish `@whynot/design@0.4.1` 2026-07-03 | Rotate in Gitea when TTL/policy requires; handoff source file deleted with `shred -u` after provision | handoff shredded; lane value remains in OpenBao |
|
|
|
|
## H1 — Replace bootstrap token files with OIDC / service auth
|
|
|
|
- Implemented consumer scaffold: exact KeyCape client-credentials exchange,
|
|
claim/lifetime preflight, strict client-secret file input, renewal boundary,
|
|
and no implicit fallback.
|
|
- Remaining: railiance-platform stands up the exact-bound OpenBao JWT auth
|
|
mount/role and publishes its non-secret connection contract.
|
|
- secrets-engine logs in via that method instead of reading a token file.
|
|
- Remove `--bootstrap-token-file` from the steady-state path (keep only for true
|
|
break-glass, heavily audited).
|
|
|
|
## H2 — Response-wrapped handoff
|
|
|
|
- Add a `wrapped` delivery mode using OpenBao response wrapping for operator
|
|
handoff flows where exec-time injection does not fit.
|
|
|
|
## H3 — Production dual-control
|
|
|
|
- Implemented consumer validator: exact action request, decision digest/binding,
|
|
validity, State Hub provenance, and caller-selected minimum distinct approval
|
|
count.
|
|
- Remaining: State Hub stores/serves the durable object and production handlers
|
|
resolve it; all production live actions currently fail closed.
|
|
|
|
## H4 — Rotation & lifecycle states
|
|
|
|
- Implement `rotate` and persistent `compromised` / `deactivated` lane states
|
|
with evidence. Explicit suspend/deactivate/destroy plans now exist, and
|
|
ordinary `revoke` safely aliases native AppRole/policy deactivation, but lane
|
|
state and coordinated provider/workload rotation remain outstanding. Live
|
|
destroy remains disabled until exact-action authorization is available.
|
|
|
|
## H4a — Known-accessor operator command
|
|
|
|
- Delivery sessions already self-revoke in `finally` (`SECRETS-WP-0007-T05`).
|
|
- Residual from T03: no general CLI to revoke an already-issued token or
|
|
lease by a non-secret accessor the operator already holds.
|
|
- Do not print accessors. Prefer fingerprint-only evidence.
|
|
|
|
## H5 — Audit report command
|
|
|
|
- Implemented: `secrets-engine audit <catalog-id>` summarizes allowlisted local
|
|
action/result, decision, session-cleanup, and State Hub delivery evidence.
|
|
- Implemented: idempotency/source headers and edge-relay queued-receipt/outbox-id
|
|
visibility.
|
|
- Remaining: operator replay verification and OpenBao audit request-id
|
|
correlation.
|
|
|
|
## H6 — API service mode
|
|
|
|
- Expose the stabilized CLI semantics as a local service API for ops-warden,
|
|
CI, agents, and a future UI — **after** the CLI contract is proven.
|
|
|
|
## Exit criteria for "bootstrap mode is over"
|
|
|
|
- No steady-state flow reads a bootstrap token file.
|
|
- Every stage role authenticates through OIDC/service auth.
|
|
- Production provisioning beyond the pilot requires dual-control.
|
|
- Rotation and deactivation are first-class, evidenced operations.
|