RBAC-5: seal a per-daughter Forgejo-webhook HMAC secret (plat/mitosis#32) #58

Merged

plat merged 1 commit from feat/rbac-5-webhook-hmac-seal into main

2026-07-01 21:22:32 +00:00

plat commented

2026-07-01 20:45:48 +00:00

Owner

RBAC-5 (plat/mitosis#32): seal the webhook HMAC secret per daughter

fork_regen_secrets now mints a fresh WEBHOOK_SECRET (openssl rand -hex 32) and seals it into the daughter's plat-agents-secrets, sealed to the sovereign fork key. The agents Deployment already loads it via envFrom(plat-agents-secrets), so the dispatcher reads WEBHOOK_SECRET and both signs the Forgejo system-hook and verifies X-Hub-Signature-256 on /hook before dispatch (agents PR).

Edits fork_regen_secrets only (germinate seam; bin/up untouched — DOM-2 owns it).

Validation. Ran fork_rekey_sops + fork_regen_secrets against a fresh gitops clone with a throwaway fork key: the decrypted plat-agents-secrets carries WEBHOOK_SECRET (sops-decryptable by the fork key), and two independent runs produce distinct secrets (per-daughter randomness confirmed).

Pairs with agents PR (verify + seal-into-Forgejo). Do not merge — orchestrator gates.

🤖 Generated with Claude Code

## RBAC-5 (plat/mitosis#32): seal the webhook HMAC secret per daughter `fork_regen_secrets` now mints a fresh `WEBHOOK_SECRET` (`openssl rand -hex 32`) and seals it into the daughter's `plat-agents-secrets`, sealed to the sovereign fork key. The agents Deployment already loads it via `envFrom(plat-agents-secrets)`, so the dispatcher reads `WEBHOOK_SECRET` and both **signs** the Forgejo system-hook and **verifies** `X-Hub-Signature-256` on `/hook` before dispatch (agents PR). Edits **`fork_regen_secrets` only** (germinate seam; bin/up untouched — DOM-2 owns it). **Validation.** Ran `fork_rekey_sops` + `fork_regen_secrets` against a fresh gitops clone with a throwaway fork key: the decrypted `plat-agents-secrets` carries `WEBHOOK_SECRET` (sops-decryptable by the fork key), and two independent runs produce **distinct** secrets (per-daughter randomness confirmed). Pairs with agents PR (verify + seal-into-Forgejo). **Do not merge — orchestrator gates.** 🤖 Generated with [Claude Code](https://claude.com/claude-code)

plat added 1 commit

2026-07-01 20:45:48 +00:00

RBAC-5: seal a per-daughter Forgejo-webhook HMAC secret (plat/mitosis#32 ) 8dbfb0f927

fork_regen_secrets mints a fresh WEBHOOK_SECRET (openssl rand -hex 32) and seals
it into the daughter's plat-agents-secrets, sealed to the sovereign fork key.
The agents Deployment already loads it via envFrom(plat-agents-secrets), so the
dispatcher reads WEBHOOK_SECRET and (a) signs the Forgejo system-hook and
(b) verifies X-Hub-Signature-256 on /hook before dispatch. Every germinated
platform gets a distinct, sovereign webhook-signing key — closing the
unauthenticated agent-work forgery hole per daughter.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

plat merged commit d04eda4f47 into main

2026-07-01 21:22:32 +00:00

plat referenced this pull request from a commit

2026-07-01 21:22:33 +00:00

Merge pull request 'RBAC-5: seal a per-daughter Forgejo-webhook HMAC secret (plat/mitosis#32)' (#58) from feat/rbac-5-webhook-hmac-seal into main

plat referenced this pull request

2026-07-02 02:21:34 +00:00

[ROADMAP] First Client Deploy → Governance — tracker #47