Remote-MCP: credential rotation, revocation, and emergency client/session invalidation #960

New Issue

2026-07-28T02:54:25-05:00

jcwalker3 commented

2026-07-28 02:54:25 -05:00

Parent epic: #929.
Cross-link: #700, #955 (certification umbrella).
Depends on: #933, #934, #938.

Goal supported: secure isolation.

Problem

#933 introduces a credential provider and #938 documents rotation in a runbook. Neither makes rotation, revocation, or emergency invalidation an operation the system supports. #700 records a real incident in which every implicated credential had to be revoked and reinstalled by hand, and names the absence of a sanctioned credential-incident escalation path as an open defect. A remote endpoint holding all five role credentials makes this mandatory, not optional.

Current evidence

#933's acceptance criteria cover selection, resolution, failure, and redaction — not lifecycle.
#938 lists rotation under documentation only.
#700 AC2 requires a sanctioned STOP and escalation path, and remains open.

Scope

Rotate a role credential without downtime.
Revoke a client or session identity immediately.
A single emergency action invalidating all active sessions and forcing re-authentication.
A credential-incident escalation entry point that fails closed and preserves evidence before redaction.

Non-goals

Choosing the secret store.
Implementing the incident response process itself.
Changing which Gitea account backs each role.

Security and concurrency boundaries

Rotation and revocation must be safe under concurrent in-flight requests. A revoked identity must not survive in any cached principal or session.

Acceptance criteria

Rotation completes with no failed in-flight request and no restart.
A revoked session's next request is refused and audited.
Emergency invalidation terminates every active session within a bounded, stated interval.
A revoked credential cannot be reused after rotation.
Escalation records sanitized evidence before any redaction step runs.

Required positive tests

Rotate each role credential under live load.
Revoke one session while others continue.

Required negative and adversarial tests

A request replaying a revoked session identity.
A request using a rotated-out credential.
Emergency invalidation asserted to leave no session alive.
An escalation invoked mid-mutation, asserted to leave no partial durable state.

Deployment and migration requirements

The rotation runbook is executed once on purpose and recorded.

Rollback and recovery requirements

The prior credential remains valid for a bounded, stated overlap, then hard-expires.

Observability and audit requirements

Every rotation, revocation, and invalidation is audited without credential material.

Definition of done

#700 AC2 is satisfied for the remote deployment.

Parent epic: #929. Cross-link: #700, #955 (certification umbrella). Depends on: #933, #934, #938. **Goal supported:** secure isolation. ## Problem #933 introduces a credential provider and #938 documents rotation in a runbook. Neither makes rotation, revocation, or emergency invalidation an **operation** the system supports. #700 records a real incident in which every implicated credential had to be revoked and reinstalled by hand, and names the absence of a sanctioned credential-incident escalation path as an open defect. A remote endpoint holding all five role credentials makes this mandatory, not optional. ## Current evidence - #933's acceptance criteria cover selection, resolution, failure, and redaction — not lifecycle. - #938 lists rotation under documentation only. - #700 AC2 requires a sanctioned STOP and escalation path, and remains open. ## Scope - Rotate a role credential without downtime. - Revoke a client or session identity immediately. - A single emergency action invalidating all active sessions and forcing re-authentication. - A credential-incident escalation entry point that fails closed and preserves evidence before redaction. ## Non-goals - Choosing the secret store. - Implementing the incident response process itself. - Changing which Gitea account backs each role. ## Security and concurrency boundaries Rotation and revocation must be safe under concurrent in-flight requests. A revoked identity must not survive in any cached principal or session. ## Acceptance criteria - Rotation completes with no failed in-flight request and no restart. - A revoked session's next request is refused and audited. - Emergency invalidation terminates every active session within a bounded, stated interval. - A revoked credential cannot be reused after rotation. - Escalation records sanitized evidence before any redaction step runs. ## Required positive tests - Rotate each role credential under live load. - Revoke one session while others continue. ## Required negative and adversarial tests - A request replaying a revoked session identity. - A request using a rotated-out credential. - Emergency invalidation asserted to leave no session alive. - An escalation invoked mid-mutation, asserted to leave no partial durable state. ## Deployment and migration requirements The rotation runbook is executed once on purpose and recorded. ## Rollback and recovery requirements The prior credential remains valid for a bounded, stated overlap, then hard-expires. ## Observability and audit requirements Every rotation, revocation, and invalidation is audited without credential material. ## Definition of done #700 AC2 is satisfied for the remote deployment.