open-platform/mitosis

Fork 0

/goal /ultracode-workflows [SEC-1] sovereign age-key backup, escrow verification, and rotation runbook + tooling #26

New issue

Closed

opened 2026-07-01 02:03:43 +00:00 by plat · 1 comment

plat commented

2026-07-01 02:03:43 +00:00

Owner

Track/Wave: SEC-1 · Wave M4 · Size M
Repos: mitosis
Depends on: HYB-1

Why

You cannot responsibly hand a client a platform whose single sovereign age key has no backup or rotation path. This is the "robust foundation" gate.

Scope

In bin/lib.sh: (1) germination-time age-encrypted BACKUP of the fork key to an operator-specified location, with explicit acknowledgment before proceeding past the "keep your key forever" banner; (2) a rotate_age_key op that mints a new keypair, rekeys .sops.yaml, re-encrypts every clusters/** sops file PRESERVING VALUES (sops updatekeys, not fork's regen-fresh shortcut), updates the in-cluster sops-age Secret, and gates on fork_verify_all_sealed; (3) a lost-key + suspected-compromise runbook.

Acceptance

On a germinated daughter, after rotate_age_key a previously-set app secret still resolves in the running pod; fork_verify_all_sealed passes against the NEW key and FAILS against the old; the old key decrypts nothing; a documented restore-from-backup recovers a platform whose local key was "lost".

Notes

Seam A (bin/lib.sh) — after HYB-1. Open decision: off-box custody target (password manager / hardware token / escrow).

Part of the First Client Deploy → Governance roadmap. The owning agent may recurse into its own subagent team (ultracode workflow) if the task warrants. Honor the seam-serialization: land on a shared seam by rebase, and don't start a seam position until the prior one has merged.

**Track/Wave:** `SEC-1` · Wave **M4** · Size **M** **Repos:** `mitosis` **Depends on:** HYB-1 ## Why You cannot responsibly hand a client a platform whose single sovereign age key has no backup or rotation path. This is the "robust foundation" gate. ## Scope In bin/lib.sh: (1) germination-time age-encrypted BACKUP of the fork key to an operator-specified location, with explicit acknowledgment before proceeding past the "keep your key forever" banner; (2) a `rotate_age_key` op that mints a new keypair, rekeys .sops.yaml, re-encrypts every clusters/** sops file PRESERVING VALUES (`sops updatekeys`, not fork's regen-fresh shortcut), updates the in-cluster sops-age Secret, and gates on fork_verify_all_sealed; (3) a lost-key + suspected-compromise runbook. ## Acceptance On a germinated daughter, after rotate_age_key a previously-set app secret still resolves in the running pod; fork_verify_all_sealed passes against the NEW key and FAILS against the old; the old key decrypts nothing; a documented restore-from-backup recovers a platform whose local key was "lost". ## Notes **Seam A (bin/lib.sh) — after HYB-1.** Open decision: off-box custody target (password manager / hardware token / escrow). --- *Part of the **First Client Deploy → Governance** roadmap. The owning agent may recurse into its own subagent team (ultracode workflow) if the task warrants. Honor the seam-serialization: land on a shared seam by rebase, and don't start a seam position until the prior one has merged.*

plat added this to the Client Deploy → Governance Roadmap milestone

2026-07-01 02:03:43 +00:00

plat added the

roadmap

goal

horizon:mvp

labels

2026-07-01 02:03:43 +00:00

plat added a new dependency

2026-07-01 02:04:42 +00:00

#25 /goal /ultracode-workflows [HYB-1] harden the bare-k3s VPS germination path (two-step registries + tunnel cutover + public-edge-aware germinate)

plat added a new dependency

2026-07-01 02:04:43 +00:00

#27 /goal /ultracode-workflows [SPINE-4] re-establish a known-good baseline — germinate a fresh long-lived reference/staging platform from post-SPINE-2/3 main

plat added a new dependency

2026-07-01 02:04:50 +00:00

#42 /goal /ultracode-workflows [POL-4] policy-govern the secrets + domains + network invariants

plat added a new dependency

2026-07-01 02:04:52 +00:00

#45 /goal /ultracode-workflows [SEC-3] secrets threat-model + reviewer FAQ (no store code changes)

plat added a new dependency

2026-07-01 02:04:53 +00:00

#46 /goal /ultracode-workflows [GATE] validated grandchild acceptance gate — secrets+domains+rbac+policy on a VPS depth-2/3 platform

plat referenced this issue

2026-07-01 02:05:20 +00:00

[ROADMAP] First Client Deploy → Governance — tracker #47

plat referenced this issue from a pull request that will close it,

2026-07-01 04:35:18 +00:00

SEC-1: sovereign age-key backup + rotation tooling + runbook #52

plat commented

2026-07-01 04:45:05 +00:00

Author

Owner

SEC-1 delivered in plat/mitosis PR #52 (merged).

Validated LIVE on the vxrail:

Backup gate exercised during a real valid8e germination: age-encrypted backup written (chmod 600), FORK_KEY_ACK=1 honored, restore decrypts byte-identical to the sovereign key.
Rotation run live on throwaway k3d-valid8c (value-preserving): the previously-set MCP_BEARER_TOKEN still resolves in the SAME running mcp pod after rotation (identical value); platform Kustomization Ready=True at the pushed revision (Flux decrypts with the NEW key); in-cluster sops-age swapped to the new key; fork_verify_all_sealed PASSES on the new key and FAILS on the old; the old key decrypts 0/9 clusters/** files; restore-from-backup recovers a platform whose local key was moved aside.
Also proven offline against real valid8b gitops: 9/9 decrypted plaintexts identical pre/post rotation.

valid8b (current-stack reference) untouched; platgold2 never touched.

SEC-1 delivered in plat/mitosis PR #52 (merged). Validated LIVE on the vxrail: - **Backup gate** exercised during a real `valid8e` germination: age-encrypted backup written (chmod 600), `FORK_KEY_ACK=1` honored, restore decrypts byte-identical to the sovereign key. - **Rotation** run live on throwaway `k3d-valid8c` (value-preserving): the previously-set `MCP_BEARER_TOKEN` still resolves in the SAME running mcp pod after rotation (identical value); platform Kustomization Ready=True at the pushed revision (Flux decrypts with the NEW key); in-cluster `sops-age` swapped to the new key; `fork_verify_all_sealed` PASSES on the new key and FAILS on the old; the old key decrypts 0/9 `clusters/**` files; restore-from-backup recovers a platform whose local key was moved aside. - Also proven offline against real `valid8b` gitops: 9/9 decrypted plaintexts identical pre/post rotation. `valid8b` (current-stack reference) untouched; `platgold2` never touched.

plat removed a dependency

2026-07-01 04:47:10 +00:00

#25 /goal /ultracode-workflows [HYB-1] harden the bare-k3s VPS germination path (two-step registries + tunnel cutover + public-edge-aware germinate)

plat closed this issue

2026-07-01 04:47:10 +00:00

plat referenced this issue

2026-07-02 02:21:34 +00:00

[ROADMAP] First Client Deploy → Governance — tracker #47