>_
.issue.db
/highway
Dashboard
Issues
Memory
Lessons
Audit Log
New Issue
Edit Issue #999
Update issue details
Title *
Description
EARS: When the store reads an envelope whose key id is not in the cached key ring, it shall reload the ring once before failing. The system shall provide 'hwe secrets reseal [--key-id X]' that re-encrypts every tenant_secret_values row under the current key in batches, idempotently, and reports rows per key id; a key may be removed from the ring only when no row and no canary need it. FOUND in #924 review (M4). Today Config caches the ring for 5 minutes, so a ring rotated on the host (scripts/import_platform_secrets.py --init-store-key --new-ring) is picked up per process after up to 5 minutes, and old rows stay on the old key until rewritten.
Priority
Low
Medium
High
Critical
Status
Open
In Progress
Closed
Won't Do
Due Date (YYYY-MM-DD)
Tags (comma separated)
Related Issues (IDs)
Enter IDs of issues related to this one. They will be linked as 'related'.
Update Issue
Cancel