From 76e07be290892ed8453bbed942855c1e7f673232 Mon Sep 17 00:00:00 2001 From: rcourtman Date: Sat, 8 Aug 2026 17:50:04 +0100 Subject: [PATCH] chore(security): complete Cloudflare token replacement --- ...dential-containment-execution-2026-08-08.md | 18 ++++++++++++++---- docs/release-control/v6/internal/status.json | 16 +++++++++++++++- 2 files changed, 29 insertions(+), 5 deletions(-) diff --git a/docs/release-control/v6/internal/records/historical-credential-containment-execution-2026-08-08.md b/docs/release-control/v6/internal/records/historical-credential-containment-execution-2026-08-08.md index 2ea7d99fd..29e9fee43 100644 --- a/docs/release-control/v6/internal/records/historical-credential-containment-execution-2026-08-08.md +++ b/docs/release-control/v6/internal/records/historical-credential-containment-execution-2026-08-08.md @@ -128,10 +128,20 @@ uses the scoped token. The scoped token passed the provider's active-token verification and successfully read the current Pages project inventory. The invalidated global key was removed from the protected local credential source, which now retains only the scoped-token path and non-secret account metadata. -No replacement global key was retrieved or persisted. A later local diagnostic -rendered the scoped token outside its protected source, so that replacement is -being rotated before the prerelease gate can close. +No replacement global key was retrieved or persisted. -Disposition: provider `revoked`; replacement pending scoped-token rotation. +A later local diagnostic rendered the scoped token outside its protected +source. That token was capability-matched to its provider record, revoked in +the provider dashboard, and then rejected by the provider verification API +with HTTP 401. Its exact dashboard row is absent. A fresh single-account token +grants only `Cloudflare Pages: Edit`; it was installed atomically in the +protected local credential source with mode `0600`, and verified active. The +replacement also successfully read the Pages project inventory and located the +current landing project. Neither repository has a GitHub Actions secret or +current-tree credential consumer for this role; the only active consumer is +the protected local landing deployment path. + +Disposition: provider `revoked`; replacement `validated` after scoped-token +re-rotation. No history rewrite was performed or is required for provider containment. diff --git a/docs/release-control/v6/internal/status.json b/docs/release-control/v6/internal/status.json index 76270e364..5d8f2b7ce 100644 --- a/docs/release-control/v6/internal/status.json +++ b/docs/release-control/v6/internal/status.json @@ -8045,7 +8045,7 @@ "owner": "release-owner-and-provider-owners", "blocking_level": "rc-ready", "minimum_evidence_tier": "production-observed", - "status": "owner-action", + "status": "passed", "verification_doc": "docs/release-control/v6/internal/HIGH_RISK_RELEASE_VERIFICATION_MATRIX.md", "lane_ids": [ "L1", @@ -8320,6 +8320,20 @@ } ] }, + { + "subject_id": "PRO-CLOUDFLARE-01", + "disposition": "validated", + "recorded_at": "2026-08-08T16:48:18Z", + "verifier": "credential-containment-audit", + "evidence": [ + { + "repo": "pulse", + "path": "docs/release-control/v6/internal/records/historical-credential-containment-execution-2026-08-08.md", + "kind": "file", + "evidence_tier": "production-observed" + } + ] + }, { "subject_id": "PRO-DIGITALOCEAN-01", "disposition": "validated",