fix(deploy): preserve transport hardening; require independent Keyverse custody

[seonghobae]

Owner correction — 2026-09-10

Keyverse must itself be usable as the independent KMS/cryptographic trust service. External KMS/HSM is OPTIONAL, not a production prerequisite. Moving the same static password from .env to POSTGRES_PASSWORD_FILE does not meet the CWL migration requirement.

Keep Draft. This PR's current runtime delta is transport-only and is NOT accepted as the final standalone profile. It must not merge or deploy as completed Keyverse migration merely because wiring tests pass.

Current correction

Head 61b30595bea4639517387d3ad55c2464a5d8f3d8 revises ADR-0017 and its index and adds the primary-source doctoring record. It is an ordinary child of cf8498dd33b7d64363a8359d76cab4cb47577ba9, preserving every existing source/test delta.

The revised architecture requires:

• Independent Rust custody core with init/seal/unseal/recovery, startable without the dependent Keycloak/database authentication plane, another Keyverse, or external KMS. Durable bootstrap storage contains ciphertext and public/authenticated metadata, not its complete plaintext unlock factor.
• Native key generation/lifecycle and non-exportable root/wrapping/signing-key operations; a key handle plus permitted operation is distinct from secret-string retrieval. Explicit data-key export has separate policy.
• Standalone threshold-unseal design with separately protected custodians; optional local hardware or external-provider profiles. No unattended cold-recovery promise without a separately available unlocking factor, and no software-to-physical-HSM/FIPS equivalence claim.
• PostgreSQL application logins use verified workload identity with short-lived certificates where the actual driver supports them, or a governed dynamic-role adapter. Database-image administrative initialization is a separate contract. Expiry/revocation must cover new connections and existing pooled sessions.
• Any driver-mandated ephemeral file is only a compatibility sink for a valid Keyverse-issued lease, not a static authority. Current host files do not implement that lifecycle.

Full rationale, rejected alternatives, concrete acceptance scenarios and primary references are in docs/adr/0017-keyverse-root-bootstrap-secret-transport.md; interpretation and evidence limits are in docs/doctoring/keyverse_standalone_custody.md.

Preserved implementation — not migration acceptance

The prior tree deletes .env.example, mounts three /run/keyverse-bootstrap/* files, uses POSTGRES_PASSWORD_FILE, and adds a Keycloak file-to-process-environment entrypoint. Non-secret deployment settings and CWL_IDP_BOOTSTRAP remain configuration/locator values. README, CLAUDE, bootstrap descriptor, CHANGELOG and wiring tests reflect that earlier transport implementation.

These controls are not discarded, but their default-profile/source integration must be repaired or explicitly confined before adoption. The host-file producer still has no implemented Keyverse issuance/rotation/revocation contract. Existing wiring tests prove only wiring. No native KMS, PostgreSQL dynamic issuance, real driver acceptance or organization-wide migration has been implemented by this documentation correction.

Stack and ownership

Current base remains fix/remove_stale_hourly_pr_steward_test_20260910 (#154); protected integration must respect prerequisite order and reacquire fresh evidence. #129 owns the encrypted vault foundation, #151 the protected root-file compatibility repair, and #103 the authorization plane. No source copying into consumers and no mutable PR-head runtime dependencies.

The earlier mandatory external-custody direction in the proposed #151 ADR/operations/baseline must be reconciled with this owner correction before promotion. Central migration remains ContextualWisdomLab/.github#2063; do not duplicate it.

Verification boundary

This increment changes documentation only. No local full checkout or runtime tests were run; the local clone failed DNS resolution, so connected GitHub reads and Git Data publication were used. No historical test or security result is transferred to this head. Fresh documentation/full-service/security checks, independent review, native custody/lifecycle acceptance, protected merge and immutable release remain outstanding.

No live credentials were read, migrated, rotated or deleted. No production source rewrite, force push, Ready transition, approval, merge or deployment occurred in this correction.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, add credits to your account and enable them for code reviews in your settings.

[seonghobae]

@coderabbitai review

Please review exact head cf8498dd33b7d64363a8359d76cab4cb47577ba9, focusing on the self-bootstrap trust boundary: Compose secret mounts, upstream PostgreSQL _FILE semantics, the Keycloak file-to-native-environment entrypoint, accidental dotenv fallback, exposure through process/log/argument surfaces, and the distinction between root bootstrap and ordinary Keyverse workload secrets. Hosted exact-head CI/security checks are now running; this is not an approval or merge request.

[seonghobae]

2026-09-10 owner correction: Keyverse must itself be usable as an independent KMS/cryptographic trust service; an external KMS/HSM is optional, not a production prerequisite. Moving the same static password from .env into POSTGRES_PASSWORD_FILE does not satisfy the migration.

I am correcting this PR's ADR-0017, ADR index and doctoring only, from cf8498dd33b7d64363a8359d76cab4cb47577ba9. The existing transport hardening delta is preserved, but remains unaccepted compatibility work, not a standalone Keyverse release or a completed consumer migration. Current source/default Compose still requires repair before adoption. No deployment, credential rotation/deletion, force push, Ready transition, merge or release is performed. Keep this PR Draft while native custody, independent initialization/unseal, workload authorization and database credential lifecycle remain unimplemented.

[seonghobae]

Continuing the independent-custody correction on this existing owner branch; no second vault owner or consumer cutover. Source scope: new services/key_custody Rust internal library, executable quorum/seal/context-tamper tests, and a non-secret native verification job in the existing repository CI. Existing #129/#151/#154 source deltas remain untouched. The full open-PR inventory showed no native custody implementation; #128 also proposes ADR-0017, so this increment uses a uniquely named specification/plan rather than allocating another conflicting ADR number.

First deliverable is the internal custody barrier: OS-random root, threshold recovery shares via an existing Shamir implementation, authenticated encrypted root record, sealed-by-default recovery, and context-bound record protection without a root-key export API. It is not a remote KMS, workload authenticator, durable audit service, database credential issuer, or production rollout. External KMS and static credential files are not required by this library.

The local container has no Rust toolchain and cannot resolve download hosts. Rust execution must therefore be obtained from actual hosted CI; no compile/test success will be inferred from source inspection. The initial dependency lock and RED fixture execution are preparation only. Keep Draft; do not merge a lock-bootstrap or deliberately RED revision. No existing credentials, deployments, protections or other writers' refs are modified.