Key and credential ages
State, schema, secrets · key ages. On a deployment this row is a control; the demo shows the row with the reading its source supports.
Evidence
- Running
- key pair kept out of the repository (.gitignore:4:*.pem); JWKS kid phi-ai-dev-2026 (RSA RS384)
- Built
- JWKS published 2026-08-21; key files kept out of the repository by .gitignore:4:*.pem
- Latest known
- every age within 365 days, checked 14 days ago; values never shown
- Source
- deploy/aws/epic_jwks_nonprod.json
- Checked
- 14 days ago
- Cadence
- every 365 days
- Mode
- guided
- State
- current
- Backup unit
- The previous key, retained until the vendor confirms the new one.
- Recovery
- Re-publish the previous JWKS.
The five steps
Plan, back up, apply, verify, recover — in guided mode. On a deployment each step runs, is verified and lands on the audit trail; every component on the demo is current, so every step reads done.
- ✓ done Plan Which key is due, the JWKS it is published in and the vendor that must confirm it; the admin confirms.
- ✓ done Back up The previous key pair is retained and the screen records the JWKS it is in; nothing is deleted before the vendor confirms.
- ✓ done Apply The admin generates the new pair with scripts/generate_epic_keypair.sh, publishes the JWKS with both kids, and registers it with the vendor per the runbook.
- ✓ done Verify The screen fetches the JWKS URL and finds the new kid; a token request with the new key succeeds against the vendor's sandbox.
- ✓ done Recover Re-publish the previous JWKS and verify a token request with the previous key.
Every row behind this reading (4)
| Credential | Age fact | Source |
|---|---|---|
| EMR signing key pair (epic_private_key.pem, epic_public_key.pem) | kept out of the repository by .gitignore:4:*.pem; presence never recorded; rotation every 365 days | git check-ignore -v epic_private_key.pem epic_public_key.pem |
| JWKS phi-ai-dev-2026 (RSA RS384, use sig) | published 2026-08-21 | git log -1 --format=%cs -- deploy/aws/epic_jwks_nonprod.json |
| Key pair generator | scripts/generate_epic_keypair.sh | git ls-files scripts/generate_epic_keypair.sh |
| API key set date | not recorded in the repository today: the key is a file named by PHI_AI_ASSISTANT_API_KEY_PATH in .env, never copied; the set date is a platform_state ledger fact of slice 1 | .env.example |
History
Applies and recoveries of this row, from the update journal. On a deployment every apply and every recovery lands here as it completes.
No apply or recovery recorded for this row. The demo's journal holds one completed update, of Running image.
Acknowledge: keep as is until <date> because <reason> — on a deployment this line is a form, audited as system.component_acknowledged; the demo shows the words.