identity-control-plane — Ephemeral Machine Credentials + Tamper-Evident Log

What it is

Workloads authenticate with static secrets that leak, linger, and cannot be revoked granularly — while the audit trail of what those workloads did is a mutable log file. This toolkit replaces both: short-lived HMAC-signed workload tokens that die after 300 seconds with their memory wiped, and an append-only daglog where each entry’s hash chains to its predecessor and carries an HMAC signature, so forgery, reordering, or truncation is detected at the exact sequence number.

Core ideas

Open full viewer

Idea	How
Ephemeral credential	`issue-token` mints `base64url(payload).base64url(HMAC-SHA256)` for `{:workload :aud}`, `:exp = :iat + 300`; never returns interned `String`s (which the JVM cannot wipe)
Strict validation	`validate-token` checks signature (constant-time compare) then strict TTL (`now == exp` = already expired), mandates `:expected-aud`, returns `{:valid false :reason ...}`, never throws
Immediate purge	Validating an expired token zeroes and drops its material; `purge-expired!` sweeps the store; keys shorter than 16 bytes refused at issue and verify time
Tamper-evident record	Each entry seals `{:seq :ts :actor :action :details :prev-hash}` with `:hash = SHA-256(canonical-body)` and `:hmac = HMAC-SHA-256(hash)`; genesis links to `"GENESIS"`
Streaming verify	`verify-chain` recomputes sequence, link, hash, and HMAC per entry in constant memory; reports `{:valid false :reason :at}` at the first break
Determinism	Demos and tests inject fixed keys/timestamps; no wall-clock in any verified path

5-minute quickstart

git clone https://github.com/nurazhardotcom/identity-control-plane
cd identity-control-plane
bb test     # TTL + HMAC test suite
bb demo     # deterministic sidecar + daglog transcript

Then, with your own key (minimum 16 bytes):

export CONTROL_PLANE_HMAC_KEY='a-secret-of-16-bytes-minimum'
bb daglog append ./daglog.edn payments-api vault.read '{"path":"transit/sign"}'
bb daglog verify ./daglog.edn    # exit 0 valid, 1 tampered

CLI reference

Command	What it does
`bb test`	Full TTL + HMAC test suite
`bb demo`	Deterministic sidecar + daglog transcript
`bb daglog append <file> <actor> <action> <details-edn>`	Append one HMAC-sealed entry (exclusive file lock, EDN lines)
`bb daglog verify <file>`	Verify chain; exit 0 valid, 1 tampered

Recording keys come from $CONTROL_PLANE_HMAC_KEY — the recorder refuses to run without it.

File map

src/control_plane/sidecar.clj — ephemeral credential generator (issue / validate / purge).
src/control_plane/daglog.clj — tamper-evident record (entry->json renders entries as JSON).
AI_DISCLOSURE.md — built with AI assistance under human direction (read for the honesty policy all these repos follow).

Labs

When it gets messy — an attacker replays a stolen token after expiry:

Open full viewer

Lab 1 — watch expiry. Mint a token in a REPL, validate immediately (valid), advance past :exp, validate again (expired + purged).

Lab 2 — tamper the log. Append 3 entries, flip one character in entry 2, run verify — confirm it reports the exact :at sequence number.

Lab 3 — missing key. Unset CONTROL_PLANE_HMAC_KEY, run append — confirm refusal.

What it demonstrates

Non-human identity done right: short-lived credentials, zero retained material, and an audit trail that detects its own tampering — the control plane behind the idira-audit-clj detective and the identity-policy-as-code gate.