stackchain/stackchain-dashboard
1
0
Fork 0
Code Issues 9 Pull Requests 1 Actions Packages Projects Releases 713 Wiki Activity

Encrypt worker-shared dashboard snapshots at rest #1106

New Issue
Closed
opened 2026-08-19 01:52:49 +00:00 by timmy · 0 comments
timmy commented 2026-08-19 01:52:49 +00:00
Owner
Copy Link

Problem

The worker-shared live snapshot and Find Work catalog persist issue bodies, titles, notification metadata, and repository context as plaintext JSON in SQLite. File mode hardening does not protect copied volumes or backups. The synchronized Draft store already establishes AES-256-GCM as the product standard, but these two retained snapshots remain outside that boundary.

Vertical slice

Introduce a reusable authenticated private-state envelope and apply it to both live_snapshot.value_json and available_issue_snapshot.items_json. Require an independently injected 256-bit key in application wiring, bind ciphertext to store identity and stable row metadata with AAD, and lazily migrate readable legacy plaintext without changing snapshot behavior. Authentication/key failures must fail closed with sanitized errors.

Acceptance tests

  • Publishing either snapshot writes a versioned AES-256-GCM envelope; unique title/body canaries are absent from SQLite after checkpoint.
  • Fresh store instances with the same key retain all existing live revision, notification filtering, Find Work claim filtering, and lease behavior.
  • Existing plaintext rows migrate atomically on first read without changing logical data or freshness metadata.
  • Wrong key, modified ciphertext, and cross-store substitution fail with a sanitized private-state encryption error and return no retained content.
  • Application startup requires a valid STACKCHAIN_PRIVATE_STATE_ENCRYPTION_KEY; release configuration and documentation identify the isolated secret injection point.
  • Focused tests and the full suite pass.

Non-duplication evidence

All 555 historical issue titles and recent commits were checked. #1098/#1100 cover synchronized Draft encryption and rotation only; snapshot issues #131/#139/#383/#433/#519 cover pooling, freshness, revisions, and decoding performance, not encryption. No open issue or PR covers worker-shared snapshot encryption.

## Problem The worker-shared live snapshot and Find Work catalog persist issue bodies, titles, notification metadata, and repository context as plaintext JSON in SQLite. File mode hardening does not protect copied volumes or backups. The synchronized Draft store already establishes AES-256-GCM as the product standard, but these two retained snapshots remain outside that boundary. ## Vertical slice Introduce a reusable authenticated private-state envelope and apply it to both `live_snapshot.value_json` and `available_issue_snapshot.items_json`. Require an independently injected 256-bit key in application wiring, bind ciphertext to store identity and stable row metadata with AAD, and lazily migrate readable legacy plaintext without changing snapshot behavior. Authentication/key failures must fail closed with sanitized errors. ## Acceptance tests - Publishing either snapshot writes a versioned AES-256-GCM envelope; unique title/body canaries are absent from SQLite after checkpoint. - Fresh store instances with the same key retain all existing live revision, notification filtering, Find Work claim filtering, and lease behavior. - Existing plaintext rows migrate atomically on first read without changing logical data or freshness metadata. - Wrong key, modified ciphertext, and cross-store substitution fail with a sanitized private-state encryption error and return no retained content. - Application startup requires a valid `STACKCHAIN_PRIVATE_STATE_ENCRYPTION_KEY`; release configuration and documentation identify the isolated secret injection point. - Focused tests and the full suite pass. ## Non-duplication evidence All 555 historical issue titles and recent commits were checked. #1098/#1100 cover synchronized Draft encryption and rotation only; snapshot issues #131/#139/#383/#433/#519 cover pooling, freshness, revisions, and decoding performance, not encryption. No open issue or PR covers worker-shared snapshot encryption.
timmy self-assigned this 2026-08-19 01:52:49 +00:00
timmy closed this issue 2026-08-19 02:04:53 +00:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels   
P0

Drop everything

  
P1

High priority

  
P2

Medium priority

  
agent:nightprowl

Assignments routed to the LongCat NightProwl evaluation worker

  
backend

Backend service

  
ci

Continuous integration / actions

  
frontend

Frontend / UI

  
meta

Meta / planning

  
pages

Gitea Pages

  
template

Repo template / standards

No Label
P0
P1
P2
agent:nightprowl
backend
ci
frontend
meta
pages
template
Milestone
Clear milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
No Assignees
timmy
1 Participants
Notifications
Due Date
The due date is invalid or out of range. Please use the format 'yyyy-mm-dd'.

No due date set.

Dependencies

No dependencies set.

Reference: stackchain/stackchain-dashboard#1106
No description provided.
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?