fix(config): the rotation watcher now fingerprints SOAP body_secret_value_<i> (BACKLOG #1009) - #246
Open
wshallwshall wants to merge 2 commits into
Open
fix(config): the rotation watcher now fingerprints SOAP body_secret_value_<i> (BACKLOG #1009)#246wshallwshall wants to merge 2 commits into
wshallwshall wants to merge 2 commits into
Conversation
…_value class (BACKLOG #1009) connector_secret_env_values, the ASVS 13.3.4 runtime rotation fingerprinter, filtered connector settings on bare _SECRET_SETTING_KEYS membership. The SOAP body_secret_value_<i> settings reach secrecy only through the prefix branch of _is_secret_setting, so they fell through the filter: a rotation of a SOAP injected body secret would not be fingerprinted on first deployment, while every sibling connector credential is tracked. Fix (config/wiring.py): filter through _is_secret_setting, not the bare frozenset, so the prefix-only body_secret_value_<i> class is covered. The change is additive -- body_secret_value_<i> is not in _NON_ROTATABLE_SECRET_SETTING_KEYS and each is a bare EnvRef the isinstance guard already accepts -- so it enrols the class and moves nothing else. Reverse gate (tests/test_secret_rotation_inventory.py): the forward gate (test_secret_setting_keys_are_registered) proves every _SECRET_SETTING_KEYS member is registered but is blind to the other direction -- a registered connector secret that does not resolve through the fingerprinter. body_secret_value entered CRITICAL_SECRETS by hand without passing through _SECRET_SETTING_KEYS, exactly the direction the old comment wrongly promised "can never disagree". The new test_registered_connector_secrets_are_reachable_by_the_fingerprinter builds a probe outbound per registered connector secret and asserts its env key is returned, so a future hand-added registry entry cannot silently fall through again. Regression test (tests/test_secret_rotation_watcher.py): a real Soap(body_secrets=...) outbound exercising factory -> _hoist_body_secrets -> body_secret_value_0 -> fingerprint end to end. It fails on the pre-fix predicate and passes after. Deliberately out of scope, flagged for a separate follow-up item: the JWS signing-key passphrase is emitted as the connector setting sign_private_key_password (transports/signing.py), which is in neither _SECRET_SETTING_KEYS nor _is_secret_setting, so it falls through the same way. CRITICAL_SECRETS registers it under the SigningConfig field names private_key / private_key_password instead of the emitted sign_-prefixed names. That is a separate redaction-plus-fingerprint gap, not folded into this one-predicate fix; private_key_password is excused in the reverse gate with that reason. ASVS 13.3.4 stays partial. Cites ADR 0015 for the body-secret class (the wiring citation to an internal-ledger #236 does not resolve in public docs/BACKLOG.md).
The body_secret_value rotation-fingerprint fix landed (config/wiring.py filters through _is_secret_setting, plus the reverse gate and the SOAP regression test), so #1009's banner flips from not-started to built. Banner line only. The ranked table, the four census distribution lines, and every other item's banner are untouched. The census was NOT recomputed.
wshallwshall
enabled auto-merge (squash)
August 6, 2026 14:16
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes BACKLOG #1009. config/wiring.py.
SOAP
body_secret_value_<i>settings were not recognised by_is_secret_setting, so the rotationwatcher did not fingerprint them -- a rotated SOAP body secret would not be detected as changed.
They are now fingerprinted like every other secret setting.
Verified in-lane: plan -> build -> 3-lens adversarial verify -> remediate. Banner gate OK.