Edit Issue - .issue.db

Title *

Description

EARS SPEC:
- The Highway platform shall source the JSONB encryption master key from Vault only; if Vault is unreachable, then it shall fail closed rather than falling back to an on-host environment variable.
- The Highway deployment shall not place HIGHWAY_ENCRYPTION_KEY on the same host as the PostgreSQL data directory.
- While encryption is enabled, if the master key cannot be obtained from Vault, then the Highway platform shall refuse to hand out database connections rather than writing plaintext into encrypted columns.
- The Highway platform shall be able to demonstrate a completed key rotation (v1 -> v2) on a non-production deployment before rotation is claimed as a supported operation.

EVIDENCE (verified 2026-08-03):
- engine/security/encryption.py get_encryption_key() fetches from Vault highway/shared/encryption_keys WITH FALLBACK to environment variables.
- Vault does hold the key (confirmed present).
- HIGHWAY_ENCRYPTION_KEY is ALSO set in docker/.env, on the same host as the postgres data directory. An attacker with root on this host obtains ciphertext and key together, which defeats the point of encrypting at rest.
- Encryption itself IS working: workflow_run.inputs read raw as postgres returns {"data": "v1:X6G2jQt7xh7Lis2v:tg_wO8JEfv9bzxhiXN4PifVy", "_encrypted": true}.
- CURRENT_KEY_VERSION is v1 and Vault holds a single key. rotate_encrypted_value() is implemented but NO live rotation has ever been performed on this deployment - the rotation path is code, not exercised behaviour. Do not claim rotation works until a v1->v2 rotation has actually been run.

CONTEXT: found while answering mail-api on the agent-mail bus (thread thr-04ba424de6704a848c8d). Their operator cited Highway as the model for encryption-at-rest. We told them plainly that our design is off-host but our DEPLOYMENT is not, and that we were filing it. This ticket is that filing - it exists because we said it would.

WHAT IS GOOD ALREADY (do not regress):
- Transparent per-connection JSONB encryption at the psycopg3 adapter layer; application code never calls encrypt/decrypt.
- Ciphertext carries its key version (version:nonce:ciphertext:tag), so rotation can be gradual and per-row.
- The connection configure hook FAILS CLOSED - it logs CRITICAL and raises if adapter registration fails, rather than returning an unencrypted connection.
- The RBAC master key is a separate key from the application data key.

Priority

Status

Due Date (YYYY-MM-DD)

Tags (comma separated)

Related Issues (IDs)

Enter IDs of issues related to this one. They will be linked as 'related'.

Cancel

Edit Issue #847