Security playbook: what to do if the operator PC is compromised and the fleet SSH key is exposed #31

Merged

john merged 4 commits from fm/fm-ssh-key-compromise-playbook into main

2026-09-24 10:17:08 +00:00

john commented

2026-09-24 06:03:27 +00:00

Owner

What this adds

docs/operator-pc-compromise.md is an operational playbook for the case where the operator's PC is compromised and the fleet SSH key is exposed. It is written for someone following it under stress, possibly from another machine, while an attacker may still hold a valid key. It is grounded in this fleet's real hosts, key paths and trust paths, which were read from the pyr0-dev-infra repo. It cites secret names only, never values.

It covers:

a first-ten-minutes action list
ordered containment with abort conditions
rotation across every host, including the bootstrap problem
what else shares the compromised machine's trust (forge, CI runners, service tokens, backups)
establishing what the attacker actually reached
the partial-rotation failure state

It follows the standing rule: build and verify the replacement access before destroying the old.

How it was validated

The no-mistakes pipeline passed. Its review round fixed the key-handling order in two paths, the restic rotation order, the web2 token re-seed, and the age-key prerequisite, and its test round now proves the age key against the committed ops.sops.env. Those are the three no-mistakes(...) commits. The run was made on a head that still carried an unrelated unpushed local commit. The worker replayed the fix commits onto a clean base and checked that the result is content-identical except for that commit's removal. The documentation audience check is green.

Author's commit message

Add the operator PC compromise playbook for an exposed fleet SSH key

Ground every host, key, trust path, and command in the pyr0-dev-infra
facts: the john identity bucket, the prove-before-destroy rotation
loop with three bootstrap paths (CI converge key, provider console,
trusted old-key copy), presumptive-vs-evidence-gated rotation rings,
the Loki/journald evidence trail with its integrity limits, and the
honest gaps that need captain decisions. Registered in the audience
inventory as operator-current and routed from the README.

Files

README.md                         |   1 +
 docs/documentation-audiences.json |   4 +
 docs/operator-pc-compromise.md    | 380 ++++++++++++++++++++++++++++++++++++++
 3 files changed, 385 insertions(+)

Open

Nothing. This is the firstmate repo, so there is no Plane story.

## What this adds `docs/operator-pc-compromise.md` is an operational playbook for the case where the operator's PC is compromised and the fleet SSH key is exposed. It is written for someone following it under stress, possibly from another machine, while an attacker may still hold a valid key. It is grounded in this fleet's real hosts, key paths and trust paths, which were read from the pyr0-dev-infra repo. It cites secret names only, never values. It covers: - a first-ten-minutes action list - ordered containment with abort conditions - rotation across every host, including the bootstrap problem - what else shares the compromised machine's trust (forge, CI runners, service tokens, backups) - establishing what the attacker actually reached - the partial-rotation failure state It follows the standing rule: build and verify the replacement access before destroying the old. ## How it was validated The no-mistakes pipeline passed. Its review round fixed the key-handling order in two paths, the restic rotation order, the web2 token re-seed, and the age-key prerequisite, and its test round now proves the age key against the committed `ops.sops.env`. Those are the three `no-mistakes(...)` commits. The run was made on a head that still carried an unrelated unpushed local commit. The worker replayed the fix commits onto a clean base and checked that the result is content-identical except for that commit's removal. The documentation audience check is green. ## Author's commit message Add the operator PC compromise playbook for an exposed fleet SSH key Ground every host, key, trust path, and command in the pyr0-dev-infra facts: the john identity bucket, the prove-before-destroy rotation loop with three bootstrap paths (CI converge key, provider console, trusted old-key copy), presumptive-vs-evidence-gated rotation rings, the Loki/journald evidence trail with its integrity limits, and the honest gaps that need captain decisions. Registered in the audience inventory as operator-current and routed from the README. ## Files ``` README.md | 1 + docs/documentation-audiences.json | 4 + docs/operator-pc-compromise.md | 380 ++++++++++++++++++++++++++++++++++++++ 3 files changed, 385 insertions(+) ``` ## Open Nothing. This is the firstmate repo, so there is no Plane story.

john added 4 commits

2026-09-24 06:03:27 +00:00

Add the operator PC compromise playbook for an exposed fleet SSH key d091c75c51

Ground every host, key, trust path, and command in the pyr0-dev-infra
facts: the john identity bucket, the prove-before-destroy rotation
loop with three bootstrap paths (CI converge key, provider console,
trusted old-key copy), presumptive-vs-evidence-gated rotation rings,
the Loki/journald evidence trail with its integrity limits, and the
honest gaps that need captain decisions. Registered in the audience
inventory as operator-current and routed from the README.

no-mistakes(review): Fix Path A/C key handling, age-key prerequisite, restic ordering 07fd6249de

no-mistakes(review): Reorder restic rotation, fix web2 token re-seed, IP ssh 662ea7d26e

no-mistakes(test): Prove age key against committed ops.sops.env, not bootstrap

CI / Test coverage guard (pull_request) Successful in 1m12s

Details

CI / Behavior portable parallel 1 (pull_request) Successful in 3m59s

Details

CI / Behavior portable parallel 2 (pull_request) Successful in 3m13s

Details

CI / Lint shell scripts (pull_request) Successful in 5m43s

Details

CI / Behavior portable serial 4 (pull_request) Successful in 9m14s