docs(dnn): prod machineKey is OUT OF SCOPE — the runbook's open conditional, closed on evidence

[jsboige]

The machineKey runbook (#854) stated the threat model as: "The prod site (dnn.argumentum.myia.io) is the target if it runs the exposed key." That conditional was never tested — it sat open while the sandbox rotation proceeded.

myia-web1 closed it. Classification of the live prod web.config — lengths and algorithm names only, zero values transmitted, per this file's own secret-safe policy:

attribute	exposed (sandbox 4b0297ee)	prod web1
validationKey	128 hex chars	40 chars
decryptionKey	64 hex chars	48 chars
validation	HMACSHA256	SHA1
decryption	AES	3DES

All four differ. Not two instances sharing a key — two keys of different generations. 40/48 + 3DES/SHA1 is the legacy ASP.NET shape (validationKey 40 hex = 20 bytes for SHA1, decryptionKey 48 hex = 24 bytes for 3DES); the sandbox used the modern AES/HMACSHA256 shape. Prod has neither the length nor the algorithms of the leaked key.

Consequence

Prod is out of scope of the compromise remediation. No emergency rotation, no maintenance window, no session invalidation on argumentum.games.

The jsboige GO of 2026-07-24 covered the sandbox — the po-2023 box, whose key was genuinely leaked live. web1 declined to extend it to prod and asked for confirmation instead of acting. That was the right call on process grounds (outward-facing, hard to reverse, user unreachable) and it turns out to have been right on the facts too: the rotation would have invalidated every live session for no security benefit.

Kept separate on purpose

SHA1 and 3DES are legacy algorithms. That is a hardening observation, not an incident response — it belongs in a normal maintenance window with explicit jsboige sign-off, not bundled into a compromise action taken while he is unreachable. Recorded as backlog, not executed.

Folding it into the incident would have been the pendulum move: an emergency scoped to one instance quietly growing into an unrelated crypto upgrade on a live public site.

Method note (kept in the doc)

This was settled without any secret crossing a wire. Comparing lengths and algorithm names was sufficient to prove non-identity. When the question is "is this the same key?", compare fingerprints — never values.

Docs-only. No key touched, no server action. Refs #131 #854

🤖 Coordinator ai-01