pdurlej/platform

Fork 0

chore(m04): run Vault Phase 1 read-only inventory packet #607

New issue

Closed

opened 2026-05-29 16:51:33 +02:00 by codex · 2 comments

codex commented

2026-05-29 16:51:33 +02:00

Collaborator

Scope

Run the first Vault sunset step as a read-only inventory packet.

This is Phase 1 from migrations/vault-to-infisical.md, carved out of parent #64 so Vault sunset does not start as a large runtime mutation.

Spec sources

migrations/vault-to-infisical.md Phase 1
modules/vault/module.yaml
modules/infisical/module.yaml
docs/specs/vault-to-infisical-migration-v0/03-notes-and-readme.md
runbooks/secrets-pipeline.md
Parent issue #64
Gate issue #539

Extracted context

M02 restore confidence is closed after post-M01 DR evidence.
M03 secrets/access hardening is closed for current closeout; future token rotation stays in M10.
ADR-0024 says Infisical is the primary backend and Vault is a migration source only.
Phase 1 inventory is read-only and must not print secret values.

Acceptance criteria

Produce a metadata-only inventory report: Vault engines, paths, key names/counts, and any unreadable paths by status/error class.
Do not print, commit, paste, or store secret values.
Do not write to Infisical.
Do not edit Vault data.
Do not stop, restart, seal, unseal, or sunset Vault.
Cross-check the inventory shape against module secret references where practical.
If Vault is sealed, token access is missing, or any command would expose values, stop and report the safe blocker only.
Recommend Phase 2 split/no-go based on inventory quality.

Out of scope

Mirroring secrets to Infisical.
Per-module cutover.
Runtime restarts.
Vault shutdown or volume cleanup.
VPS1000 / Iskra cross-host secret migration; if found, file/mark as a separate M08/W3e follow-up.

Safety

This is class/security-sensitive because Vault contains platform secrets. Read-only does not mean casual: evidence must be metadata-only.

## Scope Run the first Vault sunset step as a read-only inventory packet. This is Phase 1 from `migrations/vault-to-infisical.md`, carved out of parent #64 so Vault sunset does not start as a large runtime mutation. ## Spec sources - `migrations/vault-to-infisical.md` Phase 1 - `modules/vault/module.yaml` - `modules/infisical/module.yaml` - `docs/specs/vault-to-infisical-migration-v0/03-notes-and-readme.md` - `runbooks/secrets-pipeline.md` - Parent issue #64 - Gate issue #539 ## Extracted context - M02 restore confidence is closed after post-M01 DR evidence. - M03 secrets/access hardening is closed for current closeout; future token rotation stays in M10. - ADR-0024 says Infisical is the primary backend and Vault is a migration source only. - Phase 1 inventory is read-only and must not print secret values. ## Acceptance criteria - Produce a metadata-only inventory report: Vault engines, paths, key names/counts, and any unreadable paths by status/error class. - Do not print, commit, paste, or store secret values. - Do not write to Infisical. - Do not edit Vault data. - Do not stop, restart, seal, unseal, or sunset Vault. - Cross-check the inventory shape against module secret references where practical. - If Vault is sealed, token access is missing, or any command would expose values, stop and report the safe blocker only. - Recommend Phase 2 split/no-go based on inventory quality. ## Out of scope - Mirroring secrets to Infisical. - Per-module cutover. - Runtime restarts. - Vault shutdown or volume cleanup. - VPS1000 / Iskra cross-host secret migration; if found, file/mark as a separate M08/W3e follow-up. ## Safety This is `class/security-sensitive` because Vault contains platform secrets. Read-only does not mean casual: evidence must be metadata-only.

codex added this to the 04 - Vault sunset milestone

2026-05-29 16:51:33 +02:00

codex added the

class/security-sensitive

flow/ready

kind/ops

labels

2026-05-29 16:51:33 +02:00

codex referenced this issue

2026-05-29 16:51:33 +02:00

chore(m04): define Vault sunset entry criteria after DR and secrets gates #539

codex referenced this issue

2026-05-29 16:51:33 +02:00

docs(migrations): vault-to-infisical Phase 1-5 execution #64

codex referenced this issue

2026-05-29 16:59:57 +02:00

chore(w9): milestone archaeology packet for stale open issues #535

codex referenced this issue

2026-05-29 19:01:07 +02:00

chore(m04): decide safe-session Vault signer future before Vault sunset #609

codex commented

2026-05-29 19:01:07 +02:00

Author

Collaborator

#607 inventory result recorded locally in state/reports/m04-vault-phase1-inventory-2026-05-29.md.

Sanitized finding:

secret engines: cubbyhole/, identity/, ssh/, sys/
policy: safe-session-signer
AppRole: safe-session-api
SSH role: safe-session
KV secret/ engine: not observed

Interpretation: this does not look like a general Vault-to-Infisical secret mirror problem. It looks like Vault is currently a narrow internal SSH signer for safe-session-api.

Created follow-up #609 to decide the safe-session/Vault signer future before any Vault sunset continues.

No secret values were printed, no Infisical writes were performed, and Vault was not restarted/stopped/sealed/unsealed.

#607 inventory result recorded locally in `state/reports/m04-vault-phase1-inventory-2026-05-29.md`. Sanitized finding: ```text secret engines: cubbyhole/, identity/, ssh/, sys/ policy: safe-session-signer AppRole: safe-session-api SSH role: safe-session KV secret/ engine: not observed ``` Interpretation: this does not look like a general Vault-to-Infisical secret mirror problem. It looks like Vault is currently a narrow internal SSH signer for `safe-session-api`. Created follow-up #609 to decide the safe-session/Vault signer future before any Vault sunset continues. No secret values were printed, no Infisical writes were performed, and Vault was not restarted/stopped/sealed/unsealed.

codex referenced this issue

2026-05-29 19:01:07 +02:00

docs(migrations): vault-to-infisical Phase 1-5 execution #64

codex referenced this issue from a pull request that will close it,

2026-05-29 19:03:30 +02:00

docs(vault): record Phase 1 inventory result #610

codex commented

2026-05-29 22:53:55 +02:00

Author

Collaborator

Codex update after M04 batch.

Phase 1 read-only inventory is complete enough to close this atomic issue:

durable report: state/reports/m04-vault-accelerated-sunset-decision-2026-05-29.md;
Vault is present, initialized/unsealed, healthy, raft active;
useful non-system engine identified as ssh/;
auth methods identified as approle/ and token/;
active dependency narrowed to safe-session-api SSH signing path;
current readiness evidence confirms no runtime mutation happened yet and safe-session is still on Vault signer;
DeepSeek V4 Pro redteam blocked live CA replacement without dual-trust handoff, which is now captured by merged #618.

No secret values were printed or committed. No Vault data was edited. No Vault stop/restart/seal/unseal/sunset happened.

Next work remains under parent #64: CA bootstrap gate, safe-session runtime cutover, smoke/rollback evidence, then Vault quarantine. Destructive deletion remains separately gated.

Codex update after M04 batch. Phase 1 read-only inventory is complete enough to close this atomic issue: - durable report: `state/reports/m04-vault-accelerated-sunset-decision-2026-05-29.md`; - Vault is present, initialized/unsealed, healthy, raft active; - useful non-system engine identified as `ssh/`; - auth methods identified as `approle/` and `token/`; - active dependency narrowed to `safe-session-api` SSH signing path; - current readiness evidence confirms no runtime mutation happened yet and safe-session is still on Vault signer; - DeepSeek V4 Pro redteam blocked live CA replacement without dual-trust handoff, which is now captured by merged #618. No secret values were printed or committed. No Vault data was edited. No Vault stop/restart/seal/unseal/sunset happened. Next work remains under parent #64: CA bootstrap gate, safe-session runtime cutover, smoke/rollback evidence, then Vault quarantine. Destructive deletion remains separately gated.

codex closed this issue

2026-05-29 22:53:55 +02:00

codex referenced this issue

2026-05-29 22:54:27 +02:00

docs(migrations): vault-to-infisical Phase 1-5 execution #64