AWS KMS keyring example, request-scoped root-key caching, and rotate --from - #3

Merged

ericmann merged 65 commits into

mainfrom

build/kms-keyring

Sep 25, 2026

Commits on Sep 24, 2026

Record the AWS provider and the thread's silence in the journal tracking pages
ericmann
committed
c7b78fe
Add ADR 0008: the Trac ticket replaces thread confirmation
ericmann
committed
e494b49
Spec the KMS keyring, Vault provider, and WP-CLI smoke test
ericmann
committed
1209b50
Add the Foundry spec for this flight
ericmann
committed
3f9cdfb
plan: derive build plan from SPEC
ericmann
committed
69ab537
chore: start implementation run
ericmann
committed
02500e6
P0-01: Add the keyring conformance suite and make Mock_Keyring pass it
ericmann
committed
62ec7e7
progress: P0-01 done
ericmann
committed
79a27c6
P0-02: State the non-determinism requirement in the keyring interface docblock
ericmann
committed
90c4d53
progress: P0-02 done
ericmann
committed
0a1af7b
P0-03: Push phase 0
ericmann
committed
54972f8
progress: P0-03 done
ericmann
committed
336a2fe
P1-01: Cache the unwrapped root key in WP_Secrets_Key_Manager for the request
ericmann
committed
9458df6
progress: P1-01 done
ericmann
committed
0ab008d
P1-02: Document root-key caching: examples README, spec page, ADR 0009
ericmann
committed
f666293
progress: P1-02 done
ericmann
committed
2290349
P1-03: Push phase 1
ericmann
committed
e8ed503
progress: P1-03 done
ericmann
committed
9e29952
P2-01: Generalise wp secret rotate with --from and re-wrap under the active keyring
ericmann
committed
72afe57
progress: P2-01 done
ericmann
committed
01577a0
P2-02: Push phase 2
ericmann
committed
565e4d2
progress: P2-02 done
ericmann
committed
298c235
P3-01: Add the examples PHPUnit harness, Moto, and the AWS Secrets Manager conformance run
ericmann
committed
3b8fba6
progress: P3-01 done
ericmann
committed
ad9a198
P3-02: Add the examples CI job with a pinned Moto service container
ericmann
committed
95c54fb
progress: P3-02 done
ericmann
committed
50a9e86
P3-03: Push phase 3
ericmann
committed
747d8c8
progress: P3-03 done
ericmann
committed
4a875a4
P4-01: Write the AWS KMS keyring example and run the keyring conformance suite against Moto
ericmann
committed
f60fbd2
progress: P4-01 done
ericmann
committed
b2972ca
P4-02: Prove the KMS keyring end to end: round trip, one Decrypt per request, the adoption error, and adoption via rotate --from=config
ericmann
committed
534c455
progress: P4-02 done
ericmann
committed
a5e7945
P4-03: Write the AWS KMS keyring README with the adoption walkthrough
ericmann
committed
01fed46
progress: P4-03 done
ericmann
committed
48a082a
P4-04: Push phase 4
ericmann
committed
38f06eb
progress: P4-04 done
ericmann
committed
acdea10
P5-01: Bring the spec pages in line with the code
ericmann
committed
33994e1
progress: P5-01 done
ericmann
committed
5101524
P5-02: Update the journal tracking pages, the READMEs, and the index
ericmann
committed
3d72861
progress: P5-02 done
ericmann
committed
298e0bc
P5-03: Write the dev journal entry
ericmann
committed
d9729c0
progress: P5-03 done
ericmann
committed
20355dd
P5-04: Push phase 5, remove the Moto container, record the live-KMS check as not verified
ericmann
committed
f4801c8
progress: P5-04 done
ericmann
committed
770baa7
chore: handoff for review
ericmann
committed
4dd2440
chore: round 0 implemented
ericmann
committed
80a3c94
chore: pipeline friction (review)
ericmann
committed
af86980
review: round 1
ericmann
committed
c763b8c
chore: start review-fix round 1
ericmann
committed
cbbded7
R1-01: Restore the misconfigured-WP_SECRETS_KEY scenario in the three-state contract test
ericmann
committed
387d21d
progress: R1-01 done
ericmann
committed
73cb6b5
R1-02: Correct the published docs: journal finding, worktree-specific wp-env path, ci.md, KMS README CI sentence
ericmann
committed
936d773
progress: R1-02 done
ericmann
committed
0ceb68b
chore: handoff for review
ericmann
committed
dab7098
chore: round 1 implemented
ericmann
committed
7ffc9b7
review: round 2
ericmann
committed
1482e4a
chore: start review-fix round 2
ericmann
committed
47e73f4
R2-01: Correct the Secrets Manager README CI claim and remove Foundry task IDs from published docs
ericmann
committed
19be872
progress: R2-01 done
ericmann
committed
e294735
chore: handoff for review
ericmann
committed
1ce6550
chore: round 2 implemented
ericmann
committed
3c690b0
review: round 3 approved
ericmann
committed
e174011
chore: build summary
ericmann
committed
a117e26

Commits on Sep 25, 2026

Remove the Foundry build bookkeeping
ericmann
committed
7276e2f
Date the journal tracking pages this branch changed
ericmann
committed
5e8be79