legionio 1.7.25 → 1.7.26

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: d65ff77ca667361b558a97d1da1c3d5d2b1090bb4aad5559532406cd18e781a7
-  data.tar.gz: 7583822cc4cf804703b8a733be36bb711d1cae70724a49dc98cafea6583268ab
+  metadata.gz: 010545b8c47b9d866f1f5da8597e82f2e94bcd7c2a065f8aa97a9383f34325df
+  data.tar.gz: 7e75584a9fdf08247ec2e8834584a25499f1150814d6888701adea1689a85c37
 SHA512:
-  metadata.gz: 06f7712d8c9c6e944890ba2c55efbdf3463a6c39e906017cede6d3401215de9144e7c916c39c8b981e8f6ea6646a5439bcc10a399443fe7642b3ab06e3ef2c7a
-  data.tar.gz: 5e5819fc7973e9cb6de4b64e88c40b74d033fd666c4b9585726a3b1e87b9468f6cf4759fed226a9c3a7bc755a10b9267403dcd001d2c10f08b7aaf36e6264812
+  metadata.gz: 582fd272567d6bcca36b3d9fa8eff39b123f8c664f557a3a26d832bde3756e9c5d32d94693533d31d6231ff9d3f77201d067c3b8e26c9fd416888245993c0dc7
+  data.tar.gz: fc1f7f556c6f7cb5c4a24b8733fc23032a3cc54561ccb0d40fba8189190a424e58c84412824d5e195c870b05015ecc93f398fd74948f8fce837f842a63641e41

data/CHANGELOG.md

@@ -1,5 +1,15 @@
 # Legion Changelog
 
+## [1.7.26] - 2026-04-07
+
+### Added
+- Phase 5 Credential Scoping — service.rb integration (§8 of `docs/plans/2026-04-07-credential-scoping-design.md`)
+- Boot: call `Legion::Crypt.fetch_bootstrap_rmq_creds` after `Crypt.start` to acquire short-lived bootstrap RMQ credentials from Vault before transport connects (no-op when `dynamic_rmq_creds: false`)
+- `setup_identity`: after identity resolves, call `Legion::Crypt.swap_to_identity_creds(mode:)` to swap from bootstrap to identity-scoped RMQ credentials — gated on `vault_connected? && dynamic_rmq_creds? && !lite?`; fallback identity still gets scoped creds
+- `shutdown`: call `Legion::Crypt.revoke_bootstrap_lease` before Crypt shutdown for defense-in-depth lease cleanup
+- `reload`: call `fetch_bootstrap_rmq_creds` after Crypt.start, `resolve_secrets!` after settings reload, and `setup_identity` (replacing static `mark_ready(:identity)`) so reloaded processes acquire identity-scoped credentials
+- Specs for all Phase 5 service.rb integration paths: boot credential fetch, identity swap per mode, vault/flag/lite guards, swap failure recovery, shutdown revocation, reload credential flow
+
 ## [1.7.25] - 2026-04-06
 
 ### Added

data/lib/legion/service.rb

@@ -56,6 +56,9 @@ module Legion
         Legion::Crypt.start
         Legion::Readiness.mark_ready(:crypt)
         setup_mtls_rotation
+        # Phase 5: fetch short-lived bootstrap RMQ creds from Vault before transport connects.
+        # Service is the authoritative gate (vault_connected? + dynamic_rmq_creds?).
+        fetch_phase5_bootstrap_creds unless Legion::Mode.respond_to?(:lite?) && Legion::Mode.lite?
       end
 
       Legion::Settings.resolve_secrets!
@@ -480,7 +483,7 @@ module Legion
       log.info 'Legion::Transport connected'
     end
 
-    def setup_identity
+    def setup_identity # rubocop:disable Metrics/CyclomaticComplexity, Metrics/PerceivedComplexity
       require_relative 'identity/process'
       require_relative 'identity/broker'
       require_relative 'identity/lease'
@@ -495,6 +498,18 @@ module Legion
         log.info "[Identity] fallback identity: #{Legion::Identity::Process.canonical_name}"
       end
 
+      # Phase 5: Swap from bootstrap RMQ credentials to identity-scoped credentials.
+      # Gate on vault_connected? + dynamic_rmq_creds? — NOT on resolved? (fallback identity
+      # still needs scoped creds via the mode-based role).
+      if defined?(Legion::Crypt) &&
+         Legion::Crypt.respond_to?(:vault_connected?) && Legion::Crypt.vault_connected? &&
+         Legion::Crypt.respond_to?(:dynamic_rmq_creds?) && Legion::Crypt.dynamic_rmq_creds? &&
+         Legion::Crypt.respond_to?(:swap_to_identity_creds) &&
+         !Legion::Mode.lite?
+        log.info '[Identity] swapping to identity-scoped RMQ credentials'
+        Legion::Crypt.swap_to_identity_creds(mode: Legion::Mode.current)
+      end
+
       # Re-resolve secrets for any identity-scoped lease:// refs (task 2.25)
       Legion::Settings.resolve_secrets! if Legion::Settings.respond_to?(:resolve_secrets!)
 
@@ -702,7 +717,7 @@ module Legion
       handle_exception(e, level: :warn, operation: 'service.shutdown_api')
     end
 
-    def shutdown # rubocop:disable Metrics/CyclomaticComplexity, Metrics/PerceivedComplexity
+    def shutdown # rubocop:disable Metrics/CyclomaticComplexity, Metrics/PerceivedComplexity, Metrics/AbcSize, Metrics/MethodLength
       log.info('Legion::Service.shutdown was called')
       @shutdown = true
       Legion::Settings[:client][:shutting_down] = true
@@ -767,7 +782,12 @@ module Legion
       Legion::Readiness.mark_not_ready(:transport)
 
       shutdown_mtls_rotation
-      shutdown_component('Crypt') { Legion::Crypt.shutdown }
+      # Phase 5: Revoke bootstrap RMQ lease on clean shutdown (defense-in-depth;
+      # lease expires naturally if process crashes before identity swap).
+      shutdown_component('Crypt bootstrap lease') do
+        Legion::Crypt.revoke_bootstrap_lease if defined?(Legion::Crypt) && Legion::Crypt.respond_to?(:revoke_bootstrap_lease)
+      end
+      shutdown_component('Crypt') { Legion::Crypt.shutdown if defined?(Legion::Crypt) }
       Legion::Readiness.mark_not_ready(:crypt)
 
       Legion::Settings[:client][:ready] = false
@@ -807,7 +827,7 @@ module Legion
       shutdown_component('Transport') { Legion::Transport::Connection.shutdown }
       Legion::Readiness.mark_not_ready(:transport)
 
-      shutdown_component('Crypt') { Legion::Crypt.shutdown }
+      shutdown_component('Crypt') { Legion::Crypt.shutdown if defined?(Legion::Crypt) }
       Legion::Readiness.mark_not_ready(:crypt)
 
       Legion::Readiness.wait_until_not_ready(:transport, :data, :cache, :crypt)
@@ -816,7 +836,12 @@ module Legion
       Legion::Readiness.mark_ready(:settings)
 
       Legion::Crypt.start if defined?(Legion::Crypt)
-      Legion::Readiness.mark_ready(:crypt)
+      Legion::Readiness.mark_ready(:crypt) if defined?(Legion::Crypt)
+      # Phase 5: fetch bootstrap RMQ creds after Vault reconnects on reload.
+      fetch_phase5_bootstrap_creds unless Legion::Mode.lite?
+
+      # Resolve lease:// URIs with freshly loaded settings + new Vault token.
+      Legion::Settings.resolve_secrets! if Legion::Settings.respond_to?(:resolve_secrets!)
 
       setup_transport
       Legion::Readiness.mark_ready(:transport)
@@ -858,7 +883,9 @@ module Legion
         Legion::Readiness.mark_skipped(:gaia)
       end
 
-      Legion::Readiness.mark_ready(:identity)
+      # Phase 5: re-run identity resolution + credential swap so the reloaded
+      # process gets identity-scoped RMQ creds (not stale bootstrap creds).
+      setup_identity
 
       setup_supervision
       load_extensions
@@ -868,7 +895,7 @@ module Legion
 
       register_core_tools
 
-      Legion::Crypt.cs
+      Legion::Crypt.cs if defined?(Legion::Crypt)
       setup_apm if @api_enabled
       setup_api if @api_enabled
 
@@ -1027,6 +1054,18 @@ module Legion
 
     private
 
+    # Phase 5: fetch short-lived bootstrap RMQ credentials from Vault.
+    # Called after Crypt.start (boot) and after Crypt.start (reload).
+    # Service owns the gate so Crypt.fetch_bootstrap_rmq_creds can be unconditional.
+    def fetch_phase5_bootstrap_creds
+      return unless defined?(Legion::Crypt)
+      return unless Legion::Crypt.respond_to?(:fetch_bootstrap_rmq_creds)
+      return unless Legion::Crypt.respond_to?(:vault_connected?) && Legion::Crypt.vault_connected?
+      return unless Legion::Crypt.respond_to?(:dynamic_rmq_creds?) && Legion::Crypt.dynamic_rmq_creds?
+
+      Legion::Crypt.fetch_bootstrap_rmq_creds
+    end
+
     def resolve_identity_providers
       # Phase 4 adds lex-identity-* providers. For now, check if any are loaded.
       return false unless defined?(Legion::Extensions)

data/lib/legion/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Legion
-  VERSION = '1.7.25'
+  VERSION = '1.7.26'
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: legionio
 version: !ruby/object:Gem::Version
-  version: 1.7.25
+  version: 1.7.26
 platform: ruby
 authors:
 - Esity