ADR 0026 §3 ("Emergency Rotation and Signing Key Compromise") describes a
fallback path for emergency signing-key rotation:
As a fallback, an out-of-band emergency rotation can be triggered locally
on any node via UDS + loopback, without Raft quorum coordination, when the
cluster is compromised and dual-control is impossible.
This is not built. The emergency rotation shipped in #1017/#1020 (keystone-manage oauth2 rotate-signing-key --emergency + confirm-rotate-signing-key) only
covers the normal path: SystemAdmin over admin-UDS + SPIFFE mTLS, dual-control
confirmation, committed through Raft. That path requires Raft quorum to
commit the new keypair — it has no answer for the overlap case ADR §3
describes: the cluster has lost quorum (majority of nodes down or
partitioned) at the same moment a signing key is suspected compromised, so
waiting for quorum to return is not acceptable and dual-control across nodes
may not even be reachable.
This was explicitly scoped out of the July 2026 post-Phase-6 follow-up pass
(alongside #1214, the audit-log JTI backfill) because it isn't a
feature-sized change — there's no comparable "quorum-bypass write" mechanism
anywhere in the codebase to model it on, not even for the DEK emergency
rotation this section is explicitly mirroring (ADR 0016 §6.2, also
Raft-committed only).
What building this actually requires
- A local-only write path on a single node (reachable via UDS + loopback,
not the admin mTLS listener) that can stage/commit an emergency key
rotation without a Raft quorum round — and a decision on whether that
write is later reconciled into Raft once quorum returns, or treated as
node-local-authoritative until a human intervenes.
- A UDS-only auth boundary for this path. It cannot reuse SPIFFE mTLS to
a control plane that may itself be partitioned; needs its own local-root-only
authorization story so it doesn't become an unauthenticated escalation path.
- Reconciliation semantics for the split-brain case: when the node rejoins
quorum, does its local emergency key win over what other nodes already
did in the meantime, get merged, or conflict?
This is closer to a standalone distributed-systems design than an
incremental feature — it likely needs its own ADR amendment rather than a
direct implementation PR.
Sub-issue of #939.
ADR 0026 §3 ("Emergency Rotation and Signing Key Compromise") describes a
fallback path for emergency signing-key rotation:
This is not built. The emergency rotation shipped in #1017/#1020 (
keystone-manage oauth2 rotate-signing-key --emergency+confirm-rotate-signing-key) onlycovers the normal path:
SystemAdminover admin-UDS + SPIFFE mTLS, dual-controlconfirmation, committed through Raft. That path requires Raft quorum to
commit the new keypair — it has no answer for the overlap case ADR §3
describes: the cluster has lost quorum (majority of nodes down or
partitioned) at the same moment a signing key is suspected compromised, so
waiting for quorum to return is not acceptable and dual-control across nodes
may not even be reachable.
This was explicitly scoped out of the July 2026 post-Phase-6 follow-up pass
(alongside #1214, the audit-log JTI backfill) because it isn't a
feature-sized change — there's no comparable "quorum-bypass write" mechanism
anywhere in the codebase to model it on, not even for the DEK emergency
rotation this section is explicitly mirroring (ADR 0016 §6.2, also
Raft-committed only).
What building this actually requires
not the admin mTLS listener) that can stage/commit an emergency key
rotation without a Raft quorum round — and a decision on whether that
write is later reconciled into Raft once quorum returns, or treated as
node-local-authoritative until a human intervenes.
a control plane that may itself be partitioned; needs its own local-root-only
authorization story so it doesn't become an unauthenticated escalation path.
quorum, does its local emergency key win over what other nodes already
did in the meantime, get merged, or conflict?
This is closer to a standalone distributed-systems design than an
incremental feature — it likely needs its own ADR amendment rather than a
direct implementation PR.
Sub-issue of #939.