feat(security): add platform secret recovery verifier #715

Merged

pdurlej merged 1 commit from codex/secret-recovery-verifier into main

2026-06-04 22:22:07 +02:00

codex commented

2026-06-04 22:16:39 +02:00

Collaborator

Canary status: missing — fire canary via python -m platformctl.tools.run_review before merge

Summary

Adds a metadata-only platform secret recovery verifier and runbook for Waves A-F after the Kan analytics deploy secret incident. This does not rotate secrets, run backups, restart services, or mutate production.

Part of #711.

Changes

Add scripts/security/secret_recovery_verify.py for repo, Infisical, and RS2000 runtime metadata comparison.
Add runbooks/platform-secret-recovery.md with Wave A-F backup, verifier, token, DB, crypto, and evidence workflow.
Add regression tests proving reports omit secret values, detect runtime-only drift, ignore env files, classify waves, and use safe SSH stdin for runtime inspection.

Verification

python3 -m pytest tests/test_secret_recovery_verify.py — 7 passed.
python3 -m pytest tests/test_secret_recovery_verify.py tests/test_kan_runtime_contract.py — 11 passed.
python3 -m py_compile scripts/security/secret_recovery_verify.py — passed.
Live metadata-only verifier run against Infisical + RS2000 passed with schema platform_secret_recovery_report.v1; output contained only names, lengths, identity metadata, source classification, and findings.

Live metadata findings, redacted

Codex PAT identity remains login=codex, isAdmin=false.
FORGEJO_READ_TOKEN identity is Iskra, non-admin.
Core platform DB secrets such as FORGEJO_DB_PASSWORD, INFISICAL_DB_PASSWORD, N8N_DB_PASSWORD, UMAMI_DB_PASSWORD, POSTGRES_SUPERPASS, and REDIS_PASSWORD are visible as Infisical + runtime after runtime alias normalization.
Remaining important drift includes Kan runtime-only keys (KAN_AGENT_TOKEN, KAN_BETTER_AUTH_SECRET, KAN_MCP_BEARER_TOKEN, KAN_POSTGRES_PASSWORD) and derived Honcho/Kan DSNs that need planned handling, not immediate rotation.

Owner gates

No production backup was run.
No secret was rotated, revoked, created, printed, or updated.
No service was restarted.
Running Wave A backup gate and any Wave C/D/E rotation still requires explicit operator GO.

Spec sources read

AGENTS.md — repo actor, PR, and security-sensitive work rules.
docs/forgejo-agent-operations.md — Forgejo actor PAT and direct API write rules.
contexts/security-policy/MAP.md — secret metadata-only boundary.
contexts/cutover-ops/MAP.md — backup/production mutation gates.
contexts/observability/MAP.md — metadata-only evidence boundary.
tests/test_kan_runtime_contract.py — local test style and platform/Kan runtime contract examples.
Existing runtime metadata from RS2000 via safe length-only Docker inspection.

Canary status: missing — fire canary via `python -m platformctl.tools.run_review` before merge ## Summary Adds a metadata-only platform secret recovery verifier and runbook for Waves A-F after the Kan analytics deploy secret incident. This does not rotate secrets, run backups, restart services, or mutate production. Part of #711. ## Changes - Add `scripts/security/secret_recovery_verify.py` for repo, Infisical, and RS2000 runtime metadata comparison. - Add `runbooks/platform-secret-recovery.md` with Wave A-F backup, verifier, token, DB, crypto, and evidence workflow. - Add regression tests proving reports omit secret values, detect runtime-only drift, ignore env files, classify waves, and use safe SSH stdin for runtime inspection. ## Verification - `python3 -m pytest tests/test_secret_recovery_verify.py` — 7 passed. - `python3 -m pytest tests/test_secret_recovery_verify.py tests/test_kan_runtime_contract.py` — 11 passed. - `python3 -m py_compile scripts/security/secret_recovery_verify.py` — passed. - Live metadata-only verifier run against Infisical + RS2000 passed with schema `platform_secret_recovery_report.v1`; output contained only names, lengths, identity metadata, source classification, and findings. ## Live metadata findings, redacted - Codex PAT identity remains `login=codex`, `isAdmin=false`. - `FORGEJO_READ_TOKEN` identity is `Iskra`, non-admin. - Core platform DB secrets such as `FORGEJO_DB_PASSWORD`, `INFISICAL_DB_PASSWORD`, `N8N_DB_PASSWORD`, `UMAMI_DB_PASSWORD`, `POSTGRES_SUPERPASS`, and `REDIS_PASSWORD` are visible as Infisical + runtime after runtime alias normalization. - Remaining important drift includes Kan runtime-only keys (`KAN_AGENT_TOKEN`, `KAN_BETTER_AUTH_SECRET`, `KAN_MCP_BEARER_TOKEN`, `KAN_POSTGRES_PASSWORD`) and derived Honcho/Kan DSNs that need planned handling, not immediate rotation. ## Owner gates - No production backup was run. - No secret was rotated, revoked, created, printed, or updated. - No service was restarted. - Running Wave A backup gate and any Wave C/D/E rotation still requires explicit operator GO. ## Spec sources read - `AGENTS.md` — repo actor, PR, and security-sensitive work rules. - `docs/forgejo-agent-operations.md` — Forgejo actor PAT and direct API write rules. - `contexts/security-policy/MAP.md` — secret metadata-only boundary. - `contexts/cutover-ops/MAP.md` — backup/production mutation gates. - `contexts/observability/MAP.md` — metadata-only evidence boundary. - `tests/test_kan_runtime_contract.py` — local test style and platform/Kan runtime contract examples. - Existing runtime metadata from RS2000 via safe length-only Docker inspection.

codex added 1 commit

2026-06-04 22:16:39 +02:00

feat(security): add platform secret recovery verifier

patchwarden-client-dry-run / collect-diff (pull_request) Successful in 4s

Details

python-ci / Python 3.11 (pull_request) Successful in 46s

Details

python-ci / Python 3.12 (pull_request) Successful in 48s

Details

python-ci / Python 3.13 (pull_request) Successful in 47s

Details

canary-required / canary (pull_request) Successful in 14s