SEC-1: sovereign age-key backup + rotation tooling + runbook #52

Merged

plat merged 1 commit from feat/sec-1-age-key-rotation into main

2026-07-01 04:45:03 +00:00

plat commented

2026-07-01 04:35:18 +00:00

Owner

Implements roadmap SEC-1 (plat/mitosis#26): backup + rotation lifecycle for the sovereign age key.

What

bin/lib.sh

fork_backup_key — at germination, writes an age-encrypted (or clearly operator-guarded) backup of the sovereign key to FORK_KEY_BACKUP, encrypting to FORK_KEY_BACKUP_RECIPIENT when given, and forces an explicit custody acknowledgment (FORK_KEY_ACK=1 or a typed YES on a TTY) before the platform is built. No backup path → loud instruction, never a silent skip. The on-disk key is unchanged and remains the sole key — sovereignty is not weakened.
rotate_age_key (+ _rotate_* helpers) — mints a new keypair, re-seals every clusters/** sops file preserving values via sops updatekeys (not the regenerate-fresh shortcut), rotates the data key so the retired key decrypts nothing, updates .sops.yaml and the in-cluster sops-age Secret, removes the old recipient, and gates on fork_verify_all_sealed. Safe live ordering (add recipient+push → swap in-cluster key → remove old+rotate+push) so Flux never loses the ability to decrypt.

bin/germinate — calls fork_backup_key at key creation; the YOUR PLATFORM card notes the backup path.

docs/ops/age-key-rotation.md — runbook: backup, lost-key recovery, suspected-compromise rotation.

Validation

Validated LIVE on a throwaway vxrail k3d platform (see PR thread for evidence): values preserved in a running pod after rotation; new key verifies + old key fails; old key decrypts nothing under clusters/**; restore-from-backup recovers a platform whose local key was moved aside.

Closes #26.

🤖 Generated with Claude Code

Implements roadmap **SEC-1** (plat/mitosis#26): backup + rotation lifecycle for the sovereign age key. ## What **`bin/lib.sh`** - **`fork_backup_key`** — at germination, writes an age-encrypted (or clearly operator-guarded) backup of the sovereign key to `FORK_KEY_BACKUP`, encrypting to `FORK_KEY_BACKUP_RECIPIENT` when given, and **forces an explicit custody acknowledgment** (`FORK_KEY_ACK=1` or a typed `YES` on a TTY) before the platform is built. No backup path → loud instruction, never a silent skip. The on-disk key is unchanged and remains the sole key — sovereignty is not weakened. - **`rotate_age_key`** (+ `_rotate_*` helpers) — mints a new keypair, re-seals **every** `clusters/**` sops file **preserving values** via `sops updatekeys` (not the regenerate-fresh shortcut), rotates the data key so the retired key decrypts nothing, updates `.sops.yaml` and the in-cluster `sops-age` Secret, removes the old recipient, and gates on `fork_verify_all_sealed`. Safe live ordering (add recipient+push → swap in-cluster key → remove old+rotate+push) so Flux never loses the ability to decrypt. **`bin/germinate`** — calls `fork_backup_key` at key creation; the YOUR PLATFORM card notes the backup path. **`docs/ops/age-key-rotation.md`** — runbook: backup, lost-key recovery, suspected-compromise rotation. ## Validation Validated LIVE on a throwaway vxrail k3d platform (see PR thread for evidence): values preserved in a running pod after rotation; new key verifies + old key fails; old key decrypts nothing under `clusters/**`; restore-from-backup recovers a platform whose local key was moved aside. Closes #26. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

plat added 1 commit

2026-07-01 04:35:18 +00:00

SEC-1: sovereign age-key backup + rotation tooling + runbook cdede95230

Adds bin/lib.sh:
- fork_backup_key: at germination, write an (age-encrypted or operator-guarded)
  backup of the sovereign key (FORK_KEY_BACKUP[/_RECIPIENT]) and force an explicit
  custody acknowledgment before building. Sovereignty unchanged — the key stays sole.
- rotate_age_key (+ _rotate_* helpers): mint a new keypair, re-seal every
  clusters/** sops file PRESERVING values (sops updatekeys), rotate the data key,
  swap the in-cluster sops-age Secret, retire the old recipient, gate on
  fork_verify_all_sealed. Safe live ordering (add+push, swap key, remove+push).

Wires fork_backup_key into bin/germinate at key creation; notes backup in the card.
Adds docs/ops/age-key-rotation.md (backup, recovery, rotation runbook).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

plat merged commit 9422cbd91e into main

2026-07-01 04:45:03 +00:00

plat referenced this pull request from a commit

2026-07-01 04:45:04 +00:00

Merge pull request 'SEC-1: sovereign age-key backup + rotation tooling + runbook' (#52) from feat/sec-1-age-key-rotation into main

plat referenced this pull request

2026-07-01 04:45:05 +00:00

/goal /ultracode-workflows [SEC-1] sovereign age-key backup, escrow verification, and rotation runbook + tooling #26

plat referenced this pull request

2026-07-01 05:10:06 +00:00

HYB-1: harden bare-k3s single-VPS germination + Cloudflare-tunnel edge #51

plat referenced this pull request