aaronrene / knowtation public
patch feat/sec-kn-p6-rotate #1 / 2
aaronrene · 35 days ago · Aug 1, 2026 · Diff

SEC-KN-P6-ROTATE-b: R1+R2 done; P6-C1-C5 dual-secret verify helper

R1 (T1, operator-authorized): EC2 MCP host /opt/knowtation fast-forwarded 257ef705 -> 15fba5f5 (current GitHub main, SEC-KN-3 present), npm ci clean, PM2 knowtation-gateway restarted healthy.

R2 (freeze 5.1) PASS: non-admin agent_access discard of nonexistent id now 401 on BOTH gateway and MCP (was 200 on MCP pre-deploy); controls green (session 200/200, garbage 401, GET fake id 404/404). Live P6 elevation path closed by deploy. Evidence: docs/reviews/2026-08-01-sec-kn-p6-rotate-b-r1-r2-deploy-probe.md

R3 (P6-C1-C5): hub/lib/session-secret-rotation.mjs verifyJwtWithSecretRotation (primary-first, previous verify-only, fail-closed on missing primary, previous==primary no-op) wired at ALL nine G10 access-JWT verify sites: gateway verifyToken / decodeVerifiedToken / resolveHostedActorRole / metadata-bulk / mcp-oauth-provider; bridge userIdFromJwt + flow/capture/task sessionBoundFromReq. Signing/HMAC/encrypt stay primary-only. README post-deploy: SESSION_SECRET_PREVIOUS contract + 24h drain floor.

Tests: new seven-tier test/sec-kn-p6-session-secret-rotation.test.mjs (30/30) incl. G10 source scan; refreshed 2 stale single-secret source shapes in RBAC trio (verify-once property preserved). Full suite 4378/4380 pass (1 unrelated flow-store perf flake passes in isolation, 1 pre-existing skip). SEC-KN-3 31/31 green.

No T2 (no env/secret write). No posture flips. SD-14 respected.

sha256:635cfdefb9f04dba9c0648b252bef17dfd9015fd1adc0888548c0e461bea80b9 sha
sha256:1e8be82efeb8655d4a61875feef7501383ae52505de8473aadf769ba75116cbb parent
+12 ~17 symbols
sha256:a815330b91a02bf8180234d8d1ed1daf35aff77b677914023551e8c20386624a snapshot
+12
symbols added
~17
symbols modified
0
dead code introduced
Semantic Changes 29 symbols
~ docs/reviews/2026-08-01-sec-kn-p6-rotate-b-r1-r2-deploy-probe.md .md 6 symbols added
+ Access-path notes (operator) section Access-path notes (operator) L46–54
+ R1 — EC2 MCP host deployed to current main (T1) section R1 — EC2 MCP host deployed to current main (T1) L12–23
+ table section table L14–22
+ 1) — PASS section R2 — role-cap probe (freeze §5.1) — PASS L23–39
+ table section table L28–34
+ R3 note — G10 sweep confirmation section R3 note — G10 sweep confirmation L39–46
~ hub/lib/session-secret-rotation.mjs .mjs 2 symbols added
+ resolveSessionSecretPrevious function function resolveSessionSecretPrevious L55–58
+ verifyJwtWithSecretRotation function function verifyJwtWithSecretRotation L32–46
~ test/sec-kn-p6-session-secret-rotation.test.mjs .mjs 4 symbols added
+ fnBlock function function fnBlock L54–59
+ jwtSignCallArgs function function jwtSignCallArgs L220–237
+ read function function read L49–51
+ sign function function sign L45–47
~ hub/bridge/flow-capture-routes.mjs .mjs 2 symbols modified
~ registerBridgeFlowCaptureRoutes
~ sessionBoundFromReq
~ hub/bridge/flow-routes.mjs .mjs 2 symbols modified
~ registerBridgeFlowRoutes
~ sessionBoundFromReq
~ hub/bridge/server.mjs .mjs 1 symbol modified
~ userIdFromJwt
~ hub/bridge/task-routes.mjs .mjs 2 symbols modified
~ registerBridgeTaskRoutes
~ sessionBoundFromReq
~ hub/gateway/README.md .md 2 symbols modified
~ Knowtation Hub Gateway
~ Post-deploy verification (GitHub backup + CORS)
~ hub/gateway/mcp-oauth-provider.mjs .mjs 3 symbols modified
~ KnowtationOAuthProvider
~ constructor
~ verifyAccessToken
~ hub/gateway/metadata-bulk-canister.mjs .mjs 2 symbols modified
~ createMetadataBulkHandlers
~ resolveRole
~ hub/gateway/server.mjs .mjs 3 symbols modified
~ decodeVerifiedToken
~ resolveHostedActorRole
~ verifyToken
~ test/proposal-approve-rbac-fix-security.test.mjs .mjs
~ test/proposal-approve-rbac-fix-unit.test.mjs .mjs
Older SEC-KN-P6-ROTATE-a: freeze one signing domain + dual-secret runbook sha256:1e8be82efeb8655d4a61875feef7501383ae52505de8473aadf769ba75116cbb All commits
Newer → Latest on feat/sec-kn-p6-rotate

0 comments

No comments yet. Be the first to start the discussion.

To add a comment, use the Muse CLI: muse hub commit comment sha256:635cfdefb9f04dba9c0648b252bef17dfd9015fd1adc0888548c0e461bea80b9 --body "your comment"