amadan
Align maintenance private streams with operator consumer
1 file changed,
+1
−1
implementation/maintenance-exec.md+1 −1
CI passed — run details
diff --git a/implementation/maintenance-exec.md b/implementation/maintenance-exec.md| index c8ec3ba1b..7d0d4c236 100644 |
| --- a/implementation/maintenance-exec.md |
| +++ b/implementation/maintenance-exec.md |
| @@ -18,7 +18,7 @@ An ordinary CLI principal has no authentication-time proof (svcprincipal.Princip |
| Prepare is inert until this browser approval. Approval is one-time and expires before a queued request can start indefinitely: five minutes from the actual owner gesture, checked before accepting the fence request. Once a matching accepted fence exists, recovery may continue stopping/checkpointing safely without another gesture; starting a new command attempt, changed inputs, retry and resume each require their own current-owner fresh approval. A lost CLI connection does not cancel, rerun or resume anything. Status polls immutable receipts; command attempts have separate IDs and never arise from GET or polling. |
| -The public request record holds random request/attempt IDs, binding digests, bounded operation label, timestamps and state only. Encrypt argv and private input immediately using the existing deployment secret infrastructure with a NEW purpose-separated authenticated envelope bound to account/app/host/request/attempt/direction and envelope version. Do not reuse an existing config envelope with different semantics. Public binding hashes cover randomized ciphertext, not low-entropy plaintext. Reject absent/decrypt-failed keys; do not log decrypted fields. Input is capped at64KiB, argv at32 entries/8KiB total, execution at five minutes by default with a hard ten-minute ceiling. Private result is capped at64KiB. App output on stdout/stderr is discarded (not teeStd); a dedicated private result FD carries the bounded response and is encrypted before durable publication. Result retrieval requires current human-owner authority and writes only to an explicit exclusive0600 local output file, never stdout. No retrieval capability is exposed in a public receipt. Expired private payloads are deleted after24h; nonsecret receipts and ciphertext hashes remain for audit. A result lost before durable publication is ambiguous, not a success with an invented empty response. |
| +The public request record holds random request/attempt IDs, binding digests, bounded operation label, timestamps and state only. Encrypt argv and private input immediately using the existing deployment secret infrastructure with a NEW purpose-separated authenticated envelope bound to account/app/host/request/attempt/direction and envelope version. Do not reuse an existing config envelope with different semantics. Public binding hashes cover randomized ciphertext, not low-entropy plaintext. Reject absent/decrypt-failed keys; do not log decrypted fields. Input is capped at64KiB, argv at32 entries/8KiB total, execution at five minutes by default with a hard ten-minute ceiling. Private result is capped at64KiB. Stdout is the private result channel, captured into a bounded private buffer and encrypted before durable publication; stderr is discarded. Neither stream uses teeStd, journald or app logs. The command gets the private JSON request only on stdin. Result retrieval requires current human-owner authority and writes only to an explicit exclusive0600 local output file, never stdout. No retrieval capability is exposed in a public receipt. Expired private payloads are deleted after24h; nonsecret receipts and ciphertext hashes remain for audit. A result lost before durable publication is ambiguous, not a success with an invented empty response. |
| ## Durable state and all consumers |