FACTUAL ACTIVITY RECORD · An activity record based on work that took place
Safely rotating the public origin credential
Showing the raw token once while storing only its digest in the database
Purpose
The credential connecting Public Web to the database needed human-admin-only generation and replacement without persisting the raw token.
Implementation
The Control Center deployment screen now generates a token from 32 bytes of secure randomness. The raw token is displayed only once immediately after creation and is discarded when the screen closes. Only its SHA-256 digest and generation are stored, and management RPCs reject non-human principals.
Rendering diagram…
What was confirmed
Verification results
The full verification passed, including 248 database tests, 31 Swift tests, 88 TypeScript tests, and 30 Web tests.
At the cutoff, the production migration, token generation, and encrypted-secret registration had not been performed.
Basis for completion
The work was complete when administrator-only rotation and digest storage were implemented and verified without persisting the raw token.