Skip to content

Credential rotation broadcasts the new credential value to all subscribers (§14) #52

@nficano

Description

@nficano

Category: spec-conformance Severity: blocker
Location: lib/arcp/runtime/job_context.rb:58-68
Spec: ARCP v1.1 §14

What

Spec §14 states credential value MUST NOT be echoed to subscribers. rotate_credential emits a status event whose fields include the raw new_value, and status events go through publish_event -> SubscriptionManager#fanout to every attached subscriber, leaking the secret to non-submitters.

Evidence

def rotate_credential(id:, new_value:)
  new_id = @sink.runtime.credential_registry&.rotate(...)
  status(
    phase: 'credential_rotated',
    fields: { 'id' => new_id || id, 'value' => new_value }
  )
end

Proposed fix

Deliver the rotated value only to the submitter (out-of-band of the fanned-out event stream), or redact value from the broadcast status event.

Acceptance criteria

  • A subscriber that did not submit the job never receives the credential value on rotation.

Metadata

Metadata

Assignees

No one assigned

    Labels

    Type

    No type
    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions