feat: secure organization provider credentials

2026-07-10 22:04:43 +08:00
parent e049cb6880
commit 848f913597
51 changed files with 3280 additions and 230 deletions
@@ -1,7 +1,7 @@
 # Design the org-scoped secret and connection control plane

 Type: grilling
-Status: open
+Status: resolved

 ## Question

@@ -11,3 +11,14 @@ provider credentials; support one customer-owned Feishu app per Organization;
 support Organization-managed BYOK and a distinct platform-managed provider
 connection per Organization; and ensure plaintext credentials never reach
 business records, logs, or agent tools?
+
+## Answer
+
+Use the local master-key envelope, immutable connection-secret versions,
+writer-authority split, explicit Organization/Project resolver, staged KEK
+rotation, and separately protected keyring recovery contract accepted in
+ADR-0024. Production receives the root-owned keyring only through systemd
+`LoadCredential`; it has no process-global credential fallback. Agent runs use
+a loopback proxy capability rather than the Organization Provider credential;
+the offline rotation command atomically retains old/new KEKs, rewraps stored
+DEKs, audits the changes, and authenticates the complete envelope set.
@@ -2,7 +2,7 @@

 Type: task
 Status: open
-Blocked by: 19
+Blocked by: none

 ## Question