Trilltechnician/incredigo
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

rotate: LIVE-REAL proof level + execute-time proof gate (M2)

Browse Source 
Add ProofLiveReal (highest level, no driver yet) and enforce it at
execute time: rotate --execute only runs drivers with proof >= LIVE-VM
(MinExecuteProof). MOCK-ONLY/UNPROVEN drivers are skipped before any
provider call unless --allow-mock-proven is passed. ExecuteResult gains
Skipped/SkipReason; the CLI reports and audit-logs skips separately from
failures. Closes the last structural gap where an emulator-only driver
could touch a real credential unattended. Covered by execute_gate_test.go.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
This commit is contained in:
leetcrypt
2026-07-15 11:29:07 -07:00
parent 96c9aeeb7a
commit 2459cd4fd8
7 changed files with 229 additions and 24 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/ROTATION-PROOFS.md
+14 -2
View File
@@ -19,16 +19,28 @@ stops a mock-only driver from ever being mistaken for a live one.
## Levels
Ordered lowest → highest (a higher level is a strictly stronger cutover proof):
| Level | Meaning |
|-----------|---------|
| **LIVE-VM** | Cutover proven against the **real target software** running in the sandbox VM (real PostgreSQL / MariaDB / Redis / `wg` / Gitea / local files). |
| **MOCK-ONLY** | Cutover proven only against an **emulator** — our own `httptest` / in-process SSH server, **or a third-party mock** (e.g. `moto` for AWS). **NOT** proven against the real target service. |
| **UNPROVEN** | No cutover proof recorded (e.g. the dry-run noop helper). |
| **MOCK-ONLY** | Cutover proven only against an **emulator** — our own `httptest` / in-process SSH server, **or a third-party mock** (e.g. `moto` for AWS). **NOT** proven against the real target service. |
| **LIVE-VM** | Cutover proven against the **real target software** running in the sandbox VM (real PostgreSQL / MariaDB / Redis / `wg` / Gitea / local files). |
| **LIVE-REAL** | Cutover proven against a **real, host-owned credential at the real provider** (not the VM, not an emulator) — recorded only after an authorized per-credential rotation on the safe-candidate ladder (ROADMAP M2). **No driver carries this yet.** |
> **Honesty note:** running in the VM does **not** automatically make a driver LIVE-VM.
> AWS ran in the VM but only against **moto** (a mock AWS), so it is **MOCK-ONLY**. LIVE-VM
> means the *real* target software validated the cutover.
### Execute-time proof gate
`rotate --execute` runs a driver **only if its proof is ≥ LIVE-VM** (`MinExecuteProof`
in `proofs.go`). MOCK-ONLY and UNPROVEN drivers are **skipped** — their
`Rotate`/`Verify`/`RevokeOld` are never called, so the old secret is left fully intact —
unless the operator passes the explicit **`--allow-mock-proven`** opt-in. This closes the
last structural gap where a driver proven only against an emulator could touch a real
credential unattended.
## Current status
### LIVE-VM — proven against real target software in the sandbox VM