Neil af554dd1ab feat(cloud): KEK rotation re-wraps stored secrets (SEC-3) ...

Operator routes GET /v1/internal/secrets/kek and POST /v1/internal/secrets/rewrap
move every envelope-encrypted row (secrets, agent_credentials, github_user_tokens)
from a retired KEK to the active one: idempotent, resumable, conditional writes,
counts-only logs. A v2 row format behind SECRETS_SEAL_FORMAT=v2 (default v1)
keeps the KEK id out of the value layer's AAD so rotation re-wraps data keys
without decrypting values. Adds the KMS design doc.

2026-11-12 19:06:23 -08:00

..

accounts-billing-design.md

feat(billing): overage $1.00 per sandbox hour (interim); plans.ts is the single source (setup script, e2e and spend-cap math read it); new Stripe TEST price

2026-11-10 01:26:39 -08:00

relay-security-2026-10-21.md

Update cloud relay runtimes, providers and security checks (#31753)

2026-10-21 19:43:26 -07:00

sec-kms-design.md

feat(cloud): KEK rotation re-wraps stored secrets (SEC-3)

2026-11-12 19:06:23 -08:00

vercel-driver-design.md

feat(cloud): KEK rotation re-wraps stored secrets (SEC-3)

2026-11-12 19:06:23 -08:00

version-skew.md

feat(cloud): orcad reports its build; desktop flags out-of-range version skew with a cloud workspace (#254)

2026-11-10 05:27:55 -08:00