feat(custody): add independent Rust quorum barrier; keep migration staged

[seonghobae]

Current scope — 2026-09-10

Keyverse itself is the independent custody/KMS and secret-lifecycle owner. External KMS/HSM is optional. Replacing .env with static credential files, _FILE or Kubernetes Secrets does not satisfy the migration requirement. Central register: ContextualWisdomLab/.github#2063.

Exact source head: 8418d8bde90ad65a3c4b98aeccee830426f34f14.
Exact tree: 47b47ce6f0641116cdf8463ed646424729d33cc9.
Lifecycle: Draft / internal native source added / compilation and runtime acceptance unverified / no deployment.

This ordinary child preserves all earlier #153 transport and architecture-correction deltas. It is not a released KMS, and no consumer may depend on this branch.

Native implementation added

services/key_custody is an internal Rust library with publish = false, unsafe code forbidden and public documentation required:

• OS-random wrapping root and independent recovery factor; bounded Shamir quorum shares are returned separately from an authenticated encrypted root record.
• Initialization and reconstruction return sealed. A full, distinct, matching quorum and successful encrypted-root authentication are required before installing any root state.
• Reseal drops the locally held zeroizing root. No public root export, Clone or serialization API is provided.
• XChaCha20Poly1305 record protection binds the instance and length-framed tenant/environment/namespace/key/version/purpose fields. Wrong context, ciphertext or nonce does not authenticate.
• Bounded parsing, input sizes and share counts; entropy failure has no fallback; sensitive buffer Debug output is redacted.
• No environment, dotenv, credential-file, database or network reader; no external vault/KMS bootstrap dependency.

Context binding is cryptographic association, not workload authentication or authorization. This internal primitive requires a trusted in-process caller; it is deliberately not exposed as an unauthenticated remote API.

Authored tests and actual evidence

There are 18 authored Rust test functions: 15 lifecycle/context integration cases, two private error/entropy cases, and one independent C-generated ciphertext interoperability case. They cover quorum combinations, insufficient/duplicate/foreign/corrupt shares, every root-record byte mutation, sealed operations, reseal/recovery, all context dimensions, ambiguous field concatenation, data mutation/truncation, size bounds and redacted diagnostics.

Native tests executed locally: zero. Cargo/rustc are unavailable in the current container and toolchain downloads failed. Rust compilation, Clippy, rustdoc, formatting and native coverage are not verified.

Test-first scaffold a66a65f71c8c048c9590e70bfbaf42d11d64ef56 was published before the implementation, but run 34424727022 / native job 102707407636 remained queued at the observed reads. Its assertion was not observed failing before implementation. This is not a completed RED→GREEN cycle.

Actual independent local verification: the installed libsodium 1.0.18 C API encrypted/decrypted public unit-test root/data fixtures, rejected all 52 one-bit-per-byte data ciphertext/tag mutations and rejected changed associated data. The Rust interoperability case consumes those exact fixtures but has not executed. This validates the test oracle only, not this new Rust composition. Local new-file whitespace checks passed, and source/test/README Git blob hashes match the published objects.

Detailed chronology, input values and SHA-256 receipts are in docs/doctoring/key_custody_barrier.md. The product gap baseline adds this delta while preserving the historical identity/MCP obligations.

Current CI and dependency-lock gate

Fresh exact-head CI run 34426740038 is queued at the latest read. The native job runs on Draft with contents-read only, exact-head checkout and no credential/deployment/publication step. It is in the existing product CI rather than a duplicate review/security workflow.

The manifest pins dependency versions, but a real committed Cargo.lock is still missing. The temporary candidate-resolution step prints the generated public lock for review. The final git ls-files --error-unmatch Cargo.lock and clean-lock gate must fail until it is captured and committed. Remove candidate generation and rerun locked verification before promotion. Do not invent checksums or call unlocked resolution immutable acceptance.

A passing historical Python test, a skipped Draft job, a queued native job or an inspected source file is not native GREEN evidence.

Preserved transport work — not accepted final deployment

The earlier source deletes .env.example, mounts three /run/keyverse-bootstrap/* files, uses POSTGRES_PASSWORD_FILE, and exports mounted values immediately before Keycloak starts. That hardening is retained, but its producer still has no Keyverse issuance/rotation/revocation lifecycle. It remains a staged compatibility proposal, not the independent standalone architecture or proof of organization migration.

The native library is not yet wired into Compose or a consumer. A real service boundary must authenticate enrollment/workloads, authorize operations, durably audit, persist atomically, handle recovery/rotation and publish immutable contracts before cutover. Existing static transport must then be confined or replaced without losing deployed-data recovery.

Remaining release and integration gates

• Authenticated custodian enrollment and workload identity, narrow authorization, transactional durable audit, atomic persistence and monotonic rollback protection.
• Key catalogue/versioning/rotation/rekey, non-exportable key-operation service contracts, credential lease issuance/revocation and real PostgreSQL driver/session/pool acceptance.
• Complete native test/coverage/security/memory review. Clearing owned buffers does not prove erasure of third-party RNG/interpolation copies, registers, swap or dumps; software custody is not physical-HSM or FIPS validation.
• Current test(ci): remove stale local PR steward contract after centralization #154 prerequisite and older superset cleanup fix(ci): remove stale hourly-pr-steward test left behind by #140 #143 must be reconciled without losing valid delta; this PR was retargeted but no completed ancestry restack is claimed.
• feat(keyvault): add namespaced encrypted-at-rest secrets store #129 owns existing encrypted-vault compatibility; fix(keyvault): protect root bootstrap and define CWL credential-authority migration #151 owns protected root-file compatibility; feat(authorization): hierarchical PDP, start-login helper, and PATs #103 owns authorization. No sibling implementation is copied into this component.
• ADR-0017 also appears in fix(auth): disable ROPC and propose product-rendered passkey ceremonies #128's passkey proposal; the numbering collision must be repaired before protected integration. This increment allocates no new ADR number.
• Independent exact-head review, all current required Checks, protected integration and immutable release before any consumer adoption.

No real credentials were read, migrated, rotated or deleted. No force push, self-approval, status fabrication, gate weakening, merge, release or deployment occurred.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, add credits to your account and enable them for code reviews in your settings.

[seonghobae]

@coderabbitai review

Please review exact head cf8498dd33b7d64363a8359d76cab4cb47577ba9, focusing on the self-bootstrap trust boundary: Compose secret mounts, upstream PostgreSQL _FILE semantics, the Keycloak file-to-native-environment entrypoint, accidental dotenv fallback, exposure through process/log/argument surfaces, and the distinction between root bootstrap and ordinary Keyverse workload secrets. Hosted exact-head CI/security checks are now running; this is not an approval or merge request.

[seonghobae]

2026-09-10 owner correction: Keyverse must itself be usable as an independent KMS/cryptographic trust service; an external KMS/HSM is optional, not a production prerequisite. Moving the same static password from .env into POSTGRES_PASSWORD_FILE does not satisfy the migration.

I am correcting this PR's ADR-0017, ADR index and doctoring only, from cf8498dd33b7d64363a8359d76cab4cb47577ba9. The existing transport hardening delta is preserved, but remains unaccepted compatibility work, not a standalone Keyverse release or a completed consumer migration. Current source/default Compose still requires repair before adoption. No deployment, credential rotation/deletion, force push, Ready transition, merge or release is performed. Keep this PR Draft while native custody, independent initialization/unseal, workload authorization and database credential lifecycle remain unimplemented.

[seonghobae]

Continuing the independent-custody correction on this existing owner branch; no second vault owner or consumer cutover. Source scope: new services/key_custody Rust internal library, executable quorum/seal/context-tamper tests, and a non-secret native verification job in the existing repository CI. Existing #129/#151/#154 source deltas remain untouched. The full open-PR inventory showed no native custody implementation; #128 also proposes ADR-0017, so this increment uses a uniquely named specification/plan rather than allocating another conflicting ADR number.

First deliverable is the internal custody barrier: OS-random root, threshold recovery shares via an existing Shamir implementation, authenticated encrypted root record, sealed-by-default recovery, and context-bound record protection without a root-key export API. It is not a remote KMS, workload authenticator, durable audit service, database credential issuer, or production rollout. External KMS and static credential files are not required by this library.

The local container has no Rust toolchain and cannot resolve download hosts. Rust execution must therefore be obtained from actual hosted CI; no compile/test success will be inferred from source inspection. The initial dependency lock and RED fixture execution are preparation only. Keep Draft; do not merge a lock-bootstrap or deliberately RED revision. No existing credentials, deployments, protections or other writers' refs are modified.

[seonghobae]

@coderabbitai review

Please review exact head 8418d8bde90ad65a3c4b98aeccee830426f34f14 as unverified internal custody source, not a deployable KMS. Focus on the actual Rust dependency APIs, Shamir share indexing/metadata and recovery failure atomicity, AEAD header/context framing, sealed-state invariants, allocation bounds, secret-copy/zeroization limits, and the independent C ciphertext fixture. Confirm the native job cannot pass while Cargo.lock is untracked.

There is no native compilation/test result yet and no claim of a completed RED→GREEN cycle. Workload authentication, authorization, durable audit, anti-rollback and lifecycle are not implemented; do not treat cryptographic context binding as authorization. Keep Draft and the existing owner/predecessor deltas. This is a review request, not an approval or merge authorization.

[coderabbitai]

Oops, something went wrong! Please try again later. 🐰 💔