Give the release harnesses the pairing vault's own key

Give the release harnesses the pairing vault's own key

The vault-separation check from #253 refuses a staging or production boot
when two vaults share a key, and the relup proof, the install proof, and the
release smoke each set no `MACHINE_TOKEN_ENCRYPTION_KEY` at all. The bridge
in `config/runtime.exs` then handed the pairing vault the GitHub vault's key
and the release refused to start, so `version_chain` failed on a synthetic
configuration rather than on anything the release does wrong.

Each harness now generates a distinct key, the way it already does for the
content vault. Weakening the check to let the harness pass would have made
the gate agree with a configuration production is forbidden to run.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01SoZMfWRSGnf6FZX2Ar9rQ2

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01SoZMfWRSGnf6FZX2Ar9rQ2

Deploy story

What this commit did to the running system — joined from the forge receipt chain, the part a commit page elsewhere cannot show.

pushed: by user · WAL seq 419 · 2026-08-25T20:39:33.946414Z
built: 7 modules in 35.3 s
deployed: live · 7 modules on 3 nodes · push→live —
deployed: needs_rolling_replace · 7 modules on 0 nodes · push→live —

Changed files

modified ops/ci/release-smoke.sh
modified ops/relup-proof/common.sh
modified ops/relup-proof/install-proof.sh

Diff

3 files changed, +16 -0

# issue #193). There is no bridge to the GitHub key, so the smoke provides
# its own or the release refuses to boot.
content_key=$(openssl rand -base64 32 | tr -d '\n')
# The pairing vault's own key (VAULT-001, issue #253). The bridge in
# `config/runtime.exs` would hand it the GitHub vault's key, and a release
# refuses to serve on a borrowed one, so the smoke provides a distinct key.
machine_key=$(openssl rand -base64 32 | tr -d '\n')

echo "Checking the release configuration profile"
readiness_report=$(env \

  GITHUB_TOKEN_ENCRYPTION_KEY="$github_token_key" \
  GITHUB_TOKEN_ENCRYPTION_KEY_ID="staging-release-smoke-2026-08" \
  CONTENT_ENCRYPTION_KEY="$content_key" \
  MACHINE_TOKEN_ENCRYPTION_KEY="$machine_key" \
  OPENAI_API_KEY="release-smoke-openai-key" \
  POOL_SIZE="2" \
  PORT="$port" \

  GITHUB_TOKEN_ENCRYPTION_KEY="$github_token_key" \
  GITHUB_TOKEN_ENCRYPTION_KEY_ID="staging-release-smoke-2026-08" \
  CONTENT_ENCRYPTION_KEY="$content_key" \
  MACHINE_TOKEN_ENCRYPTION_KEY="$machine_key" \
  OPENAI_API_KEY="release-smoke-openai-key" \
  PHX_SERVER="true" \
  POOL_SIZE="2" \

  # The content vault's own key (VAULT-001, issue #193). Nothing bridges
  # to it, so the proof supplies one or the release refuses to boot.
  proof_content_key=$(openssl rand -base64 32 | tr -d '\n')
  # The pairing vault's own key (VAULT-001, issue #253). `config/runtime.exs`
  # still bridges an unset one to the GitHub key, and a staging or production
  # release now refuses to serve on a borrowed key, so the proof supplies a
  # distinct one rather than exercising the bridge it is not here to test.
  proof_machine_key=$(openssl rand -base64 32 | tr -d '\n')
}

profile() {

    GITHUB_TOKEN_ENCRYPTION_KEY="$proof_token_key" \
    GITHUB_TOKEN_ENCRYPTION_KEY_ID="staging-relup-proof-2026-08" \
    CONTENT_ENCRYPTION_KEY="$proof_content_key" \
    MACHINE_TOKEN_ENCRYPTION_KEY="$proof_machine_key" \
    OPENAI_API_KEY="relup-proof-openai-key" \
    OPENAGENTS_RELUP_INSTALL_BARRIER_MS="${OPENAGENTS_RELUP_INSTALL_BARRIER_MS:-0}" \
    OPENAGENTS_RELUP_INSTALL_BARRIER_PATH="${OPENAGENTS_RELUP_INSTALL_BARRIER_PATH:-}" \


secret=$(openssl rand -base64 64 | tr -d '\n')
token_key=$(openssl rand -base64 32 | tr -d '\n')
# The pairing vault's own key (VAULT-001, issue #253): distinct, because a
# release refuses to serve on a key borrowed from another vault.
machine_key=$(openssl rand -base64 32 | tr -d '\n')

profile() {
  env \

    GITHUB_CLIENT_SECRET="relup-proof-secret" \
    GITHUB_TOKEN_ENCRYPTION_KEY="$token_key" \
    GITHUB_TOKEN_ENCRYPTION_KEY_ID="staging-relup-proof-2026-08" \
    MACHINE_TOKEN_ENCRYPTION_KEY="$machine_key" \
    OPENAI_API_KEY="relup-proof-openai-key" \
    PHX_SERVER="true" \
    POOL_SIZE="2" \

64	64		`# issue #193). There is no bridge to the GitHub key, so the smoke provides`
65	65		`# its own or the release refuses to boot.`
66	66		`content_key=$(openssl rand -base64 32 \| tr -d '\n')`
	67	+	`# The pairing vault's own key (VAULT-001, issue #253). The bridge in`
	68	+	# `config/runtime.exs` would hand it the GitHub vault's key, and a release
	69	+	`# refuses to serve on a borrowed one, so the smoke provides a distinct key.`
	70	+	`machine_key=$(openssl rand -base64 32 \| tr -d '\n')`
67	71
68	72		`echo "Checking the release configuration profile"`
69	73		`readiness_report=$(env \`

73	77		`GITHUB_TOKEN_ENCRYPTION_KEY="$github_token_key" \`
74	78		`GITHUB_TOKEN_ENCRYPTION_KEY_ID="staging-release-smoke-2026-08" \`
75	79		`CONTENT_ENCRYPTION_KEY="$content_key" \`
	80	+	`MACHINE_TOKEN_ENCRYPTION_KEY="$machine_key" \`
76	81		`OPENAI_API_KEY="release-smoke-openai-key" \`
77	82		`POOL_SIZE="2" \`
78	83		`PORT="$port" \`

94	99		`GITHUB_TOKEN_ENCRYPTION_KEY="$github_token_key" \`
95	100		`GITHUB_TOKEN_ENCRYPTION_KEY_ID="staging-release-smoke-2026-08" \`
96	101		`CONTENT_ENCRYPTION_KEY="$content_key" \`
	102	+	`MACHINE_TOKEN_ENCRYPTION_KEY="$machine_key" \`
97	103		`OPENAI_API_KEY="release-smoke-openai-key" \`
98	104		`PHX_SERVER="true" \`
99	105		`POOL_SIZE="2" \`

77	77		`# The content vault's own key (VAULT-001, issue #193). Nothing bridges`
78	78		`# to it, so the proof supplies one or the release refuses to boot.`
79	79		`proof_content_key=$(openssl rand -base64 32 \| tr -d '\n')`
	80	+	# The pairing vault's own key (VAULT-001, issue #253). `config/runtime.exs`
	81	+	`# still bridges an unset one to the GitHub key, and a staging or production`
	82	+	`# release now refuses to serve on a borrowed key, so the proof supplies a`
	83	+	`# distinct one rather than exercising the bridge it is not here to test.`
	84	+	`proof_machine_key=$(openssl rand -base64 32 \| tr -d '\n')`
80	85		`}`
81	86
82	87		`profile() {`

87	92		`GITHUB_TOKEN_ENCRYPTION_KEY="$proof_token_key" \`
88	93		`GITHUB_TOKEN_ENCRYPTION_KEY_ID="staging-relup-proof-2026-08" \`
89	94		`CONTENT_ENCRYPTION_KEY="$proof_content_key" \`
	95	+	`MACHINE_TOKEN_ENCRYPTION_KEY="$proof_machine_key" \`
90	96		`OPENAI_API_KEY="relup-proof-openai-key" \`
91	97		`OPENAGENTS_RELUP_INSTALL_BARRIER_MS="${OPENAGENTS_RELUP_INSTALL_BARRIER_MS:-0}" \`
92	98		`OPENAGENTS_RELUP_INSTALL_BARRIER_PATH="${OPENAGENTS_RELUP_INSTALL_BARRIER_PATH:-}" \`

115	115
116	116		`secret=$(openssl rand -base64 64 \| tr -d '\n')`
117	117		`token_key=$(openssl rand -base64 32 \| tr -d '\n')`
	118	+	`# The pairing vault's own key (VAULT-001, issue #253): distinct, because a`
	119	+	`# release refuses to serve on a key borrowed from another vault.`
	120	+	`machine_key=$(openssl rand -base64 32 \| tr -d '\n')`
118	121
119	122		`profile() {`
120	123		`env \`

123	126		`GITHUB_CLIENT_SECRET="relup-proof-secret" \`
124	127		`GITHUB_TOKEN_ENCRYPTION_KEY="$token_key" \`
125	128		`GITHUB_TOKEN_ENCRYPTION_KEY_ID="staging-relup-proof-2026-08" \`
	129	+	`MACHINE_TOKEN_ENCRYPTION_KEY="$machine_key" \`
126	130		`OPENAI_API_KEY="relup-proof-openai-key" \`
127	131		`PHX_SERVER="true" \`
128	132		`POOL_SIZE="2" \`