secrets-engine/docs/hardening-backlog.md

# Hardening Backlog — Exit From Bootstrap Mode

The MVP runs in **bootstrap mode**: stage roles may be driven by temporary
root-created OpenBao tokens read from mode-0600 files. That is acceptable setup
material, **not** the steady state. This backlog tracks the work to retire it.

The MVP is honest about this: bootstrap mode is a documented, bounded phase with
explicit revocation tasks — not a hidden permanent security posture.

## H0 — Revoke outstanding bootstrap tokens (always-on hygiene)

Every minted bootstrap token has a revocation task. Track each here:

| Token file | Stage | Minted | TTL | Revoked? |
| --- | --- | --- | --- | --- |
| `~/.secrets-engine/bootstrap/prod.token` | prod | (n/a — demo uses dev server) | 1h | n/a |
| `~/.secrets-engine/bootstrap/prod-warden-sign.token` | prod | SECRETS-WP-0004 live lane applied via attended operator flow; file use not recorded in repo | 1h | cleanup/revocation evidence not recorded |
| `~/.secrets-engine/bootstrap/prod-whynot-design.token` | prod | SECRETS-WP-0003 live apply/provision/publish 2026-07-03 | 1h | file shredded 2026-07-03; accessor revoke deferred (OpenBao sealed; 1h TTL likely expired) |

Revoke: `bao token revoke -accessor <accessor>` then `shred -u <file>`.
For SECRETS-WP-0004, the scoped `warden-sign` token used for the 2026-06-29
smoke had a `15m` TTL; explicit accessor revocation and handoff-file cleanup are
operator-side hygiene if any material remains. Do not record accessors or file
contents in this repo.

## H0a — Revoke pilot workload tokens

| Credential | Custody path | Minted | Revocation task | Revoked? |
| --- | --- | --- | --- | --- |
| whynot-design Gitea bot npm/package token | OpenBao lanes `whynot-design-npm-publish` + `platform/workloads/coulomb/whynot-design/npm-publish`; handoff file shredded after provision | SECRETS-WP-0003 publish `@whynot/design@0.4.1` 2026-07-03 | Rotate in Gitea when TTL/policy requires; handoff source file deleted with `shred -u` after provision | handoff shredded; lane value remains in OpenBao |

## H1 — Replace bootstrap token files with OIDC / service auth

- Implemented consumer scaffold: exact KeyCape client-credentials exchange,
  claim/lifetime preflight, strict client-secret file input, renewal boundary,
  and no implicit fallback.
- Implemented named providers (`service-jwt`, `bootstrap`, `env`) with no
  JWT→bootstrap/env fallback. JWT login uses a JSON file, never argv, and
  self-revokes the issued OpenBao token.
- Remaining: railiance-platform stands up the exact-bound OpenBao JWT auth
  mount/role and publishes its non-secret connection contract
  (`SECRETS_ENGINE_OPENBAO_JWT_LOGIN`). Until then `--auth service-jwt`
  fail-closes and `--auth auto` keeps named bootstrap/env providers.
- `--bootstrap-token-file` is a named break-glass provider with distinct
  evidence, not an implicit fallback.

## H2 — Response-wrapped handoff

- Implemented: `secrets-engine wrap <catalog-id> --out F [--ttl 15m]` writes a
  single-use wrap token to a mode-0600 out-of-repo file. KV lanes wrap a read;
  auth-capability lanes wrap a secret_id. The wrap token is never printed.
  Evidence is wrap-handle fingerprint, ttl, and path only. TTL max 15m.
  Unwrapped secret payloads fail closed. Production remains fail-closed.
- `exec --mode wrapped` is still not an exec adapter; this is operator handoff.

## H3 — Production dual-control

- Implemented consumer validator: exact action request, decision digest/binding,
  validity, State Hub provenance, and caller-selected minimum distinct approval
  count.
- Implemented PEP consume-before-OpenBao (`GH-DEC-2026-003`): production
  handlers share `require_production_consume` and fail closed on conflict,
  unavailability, or a missing consume binding.
- Remaining: State Hub stores/serves the durable object and production handlers
  resolve it; all production live actions currently fail closed.

## H4 — Rotation & lifecycle states

- Implemented native `rotate`: merge-safe KV field replace from a mode-0600
  file, sibling preservation, no argv values. Auth-capability lanes stay on
  wrap/handoff. Provider/workload consumer rollout remains the catalog
  `rotation.owner` duty.
- Implemented persistent overlay states `active` / `suspended` /
  `deactivated` / `compromised` under `evidence_dir/lane-state/` (non-secret,
  not Git). `lifecycle compromise` / `reactivate` and successful
  suspend/deactivate/revoke update the overlay. exec/wrap/handoff/provision
  refuse non-active lanes; rotate remains allowed on compromised.
- Live destroy remains disabled until exact-action authorization is available.

## H4a — Known-accessor operator command

- Delivery sessions already self-revoke in `finally` (`SECRETS-WP-0007-T05`).
- Implemented: `secrets-engine session revoke --accessor-file F` or
  `--lease-id-file F` reads a mode-0600 out-of-repo handle, revokes it, and
  records only a fingerprint. Production remains fail-closed.

## H5 — Audit report command

- Implemented: `secrets-engine audit <catalog-id>` summarizes allowlisted local
  action/result, decision, session-cleanup, and State Hub delivery evidence.
- Implemented: idempotency/source headers and edge-relay queued-receipt/outbox-id
  visibility.
- Remaining: operator replay verification and OpenBao audit request-id
  correlation.

## H6 — API service mode

- Expose the stabilized CLI semantics as a local service API for ops-warden,
  CI, agents, and a future UI — **after** the CLI contract is proven.

## Exit criteria for "bootstrap mode is over"

- No steady-state flow reads a bootstrap token file.
- Every stage role authenticates through OIDC/service auth.
- Production provisioning beyond the pilot requires dual-control.
- Rotation and deactivation are first-class, evidenced operations.