Fleet changelogs · dev.ecs0.net
rdmpw3275m-changelog-20260905-0610-xentropy-rotation-adapters-sequencer-and-exposure-scanner

rdmpw3275m-changelog-20260905-0610-xentropy-rotation-adapters-sequencer-and-exposure-scanner

Resolved XEntropy tickets FEAT-20260901-18, FEAT-20260901-19, FEAT-20260901-20, FEAT-20260901-21, and FEAT-20260901-22 with Swift 6 strict concurrency, zero compiler warnings, values-free design, atomic rollback safety, and comprehensive unit tests.

Scope

Exact Files Touched

  1. app/Sources/XEntropyCore/ProviderAdapter.swift:
    • Added HTTPTransport protocol and URLSessionHTTPTransport implementation.
    • Added discardReplacement(plan:) and verifyOldRejected(plan:) to ProviderAdapter.
  2. app/Sources/XEntropyCore/ProviderAdapters/CloudflareProviderAdapter.swift:
    • Created Cloudflare provider adapter conforming to ProviderAdapter.
    • Implemented scoped API token creation (POST /user/tokens), read-only canary verification (GET /user/tokens/verify), candidate discard (DELETE /user/tokens/:id), and owner-gated revocation.
    • Documented vendor nuance regarding legacy Global API Key un-scopability vs. modern Scoped API Tokens.
  3. app/Sources/XEntropyCore/ProviderAdapters/GoDaddyProviderAdapter.swift:
    • Created GoDaddy provider adapter conforming to ProviderAdapter.
    • Documented vendor nuance: GoDaddy developer portal requires interactive owner MFA generation; surfaces .manualConsoleGenerationRequired when unstaged; read-only minimal canary via GET /v1/domains with sso-key auth; mandatory owner confirmation before revocation.
  4. app/Sources/XEntropyCore/CredentialEnvironmentWriter.swift:
    • Created atomic single-key environment file writer with POSIX rename(2).
    • Enforces regular file, owner UID match, and mode 0600 verification (mode & 0o077 == 0). Refuses symlinks.
    • Creates pre-write timestamped backup copy with mode 0600 in same directory.
    • Preserves comments, ordering, blank lines, and original quote/export formatting.
    • Provides dry-run preview mode with redacted diffs and local fleet scoping notice.
  5. app/Sources/XEntropyCore/RotationPlanning.swift:
    • Added .canaryValidationFailed and .revocationVerificationFailed cases to RotationPlanBlockerKind.
  6. app/Sources/XEntropyCore/RotationExecutionSequencer.swift:
    • Created rotation execution sequencer enforcing strict step ordering: prepareReplacement -> storeSecurely -> canaryExactScope before updateMappedConsumers or revokeOld.
    • On canary failure: automatically discards candidate at provider, leaves old credential untouched, and surfaces .canaryValidationFailed blocker.
    • On canary success: establishes bounded rollback retention window before revocation.
    • Enforces owner confirmation before revokeOld for elevated risk tiers.
    • Verifies old rejected post-revocation, surfacing high-severity .revocationVerificationFailed blocker if prior key remains active.
  7. app/Sources/XEntropyCore/CredentialLifecycleCoordinator.swift:
    • Extended executeMutation to integrate with RotationExecutionSequencer and added executeSequencedRotation.
  8. app/Sources/XEntropyCore/GitExposureScanner.swift:
    • Created values-free git-history exposure enumeration scanner.
    • Operates strictly on pre-computed SHA-256 digests; never receives or logs plaintext secrets.
    • Enumerates ALL remotes (git config --get-regexp ^remote\..*\.url) and ALL refs (git for-each-ref).
    • Classifies branches into .trackedLive, .historicalOnly, and .unexposed.
  9. Unit Tests Added:
    • app/Tests/XEntropyCoreTests/CloudflareProviderAdapterTests.swift (8 tests)
    • app/Tests/XEntropyCoreTests/GoDaddyProviderAdapterTests.swift (9 tests)
    • app/Tests/XEntropyCoreTests/CredentialEnvironmentWriterTests.swift (10 tests)
    • app/Tests/XEntropyCoreTests/RotationExecutionSequencerTests.swift (6 tests)
    • app/Tests/XEntropyCoreTests/GitExposureScannerTests.swift (5 tests)

Verification Evidence

  1. Unit Test Pass Rates on rdmsm4x:
    • CloudflareProviderAdapterTests: 8/8 passed (100%)
    • GoDaddyProviderAdapterTests: 9/9 passed (100%)
    • CredentialEnvironmentWriterTests: 10/10 passed (100%)
    • RotationExecutionSequencerTests: 6/6 passed (100%)
    • GitExposureScannerTests: 5/5 passed (100%)
    • Full suite across all targets (XEntropyCoreTests, XEntropyTests, XEntropyGatewayTests, XEntropyCLITests): 100% green pass with 0 failures and 0 compiler warnings.
  2. Git Commits on rdmsm4x:~/dev/apps/Xentropy:
    • ebd80e6: feat(rotation): implement Cloudflare provider adapter with scoped API token lifecycle (FEAT-20260901-18)
    • a24769a: feat(rotation): implement GoDaddy provider adapter with registrar canary and owner gating (FEAT-20260901-19)
    • a1d9895: feat(rotation): implement atomic environment writer with backup and preview (FEAT-20260901-20)
    • 966e83d: feat(rotation): implement rotation execution sequencer with canary-before-commit and rollback (FEAT-20260901-21)
    • d5366d3: feat(exposure): implement git-history exposure enumeration scanner (FEAT-20260901-22)
  3. Formally Resolved Tickets:
    • FEAT-20260901-18: Resolved via ticket resolve with evidence
    • FEAT-20260901-19: Resolved via ticket resolve with evidence
    • FEAT-20260901-20: Resolved via ticket resolve with evidence
    • FEAT-20260901-21: Resolved via ticket resolve with evidence
    • FEAT-20260901-22: Resolved via ticket resolve with evidence

Backup Locations & Undo

Outstanding Owner Actions