Provision and rotate production credentials for the Cloudflare site API

[chubes4]

Parent: #1970

Goal

Turn the merged provisioning API authentication contract into an operable multi-principal production control plane with auditable issuance, rotation, revocation, and least-privilege policy.

Current limitation

Bearer token definitions are static JSON in WORDPRESS_API_TOKENS, and production provisioning lacks the required API token, administrator-claim, and site-fleet configuration. The request contract works locally but is not an operable production credential lifecycle.

Scope

• generic issuer-backed principal identity or service-account API keys stored only as digests
• scoped grants for artifact staging, site create/read/import, operation read, renewal, and deletion
• per-principal quotas, expiration, revocation, rotation overlap, and optional site restrictions
• administrator-claim and persistent site credential root rotation with generation/version evidence
• redacted audit events for authentication, authorization, allocation, claims, and revocation
• Homeboy-managed secret/binding preflight without exposing plaintext values

Acceptance criteria

• A principal can be issued, rotated, and revoked without Worker source changes or redeployment where the Cloudflare binding model permits.
• Revocation is effective for new API calls while previously committed operations follow explicit policy.
• Scope, quota, expiry, site ownership, and cross-principal denial are deterministic.
• Secret rotation preserves or intentionally invalidates administrator claims and credentials according to versioned policy.
• Logs and deployment evidence contain no bearer, claim, password, or derived secret values.
• Local and isolated remote gates cover malformed tokens, replay, rotation overlap, revocation races, and least privilege.
• Production mutation remains a separately authorized operator step.

AI assistance

OpenAI GPT-5.6 Sol via OpenCode reviewed the static token and claim configuration and drafted this production credential lifecycle with Chris Huber.

[chubes4]

Merged control-plane integration evidence

The generic private-stdin primitive and digest-only credential operator now work together end to end:

• Homeboy Extensions primitive: Cloudflare: allow private stdin for predeploy commands Extra-Chill/homeboy-extensions#2447
• WP Codebox operator: Add durable principal credential operator #2121

Reproduction shape

1. Use homeboy/cloudflare-worker-deploy-contract/v1 with one secret_inputs environment descriptor.
2. Bind that ID to a predeploy command through stdin_secret_input.
3. Execute node_modules/.bin/tsx scripts/operator-cloudflare-principal-credential.ts issue --config packages/runtime-cloudflare/wrangler.d1.jsonc --credential-id homeboy-proof --version v1 --principal ci:homeboy-proof --scopes sites:create,sites:read --expires-at 2027-01-01T00:00:00.000Z --max-sites 2 --local --persist-to <isolated-state>.
4. Follow it with an intentional failing predeploy command so the deployment controller stops before Worker mutation.
5. Repeat with revoke and then replay the same revoke.

Observed

• Homeboy preflight succeeded and declared only the secret-input ID.
• Issue succeeded through private stdin; evidence contained neither bearer nor digest.
• Local D1 held one active digest-only homeboy-proof/v1 credential and one redacted registered audit event.
• Revoke succeeded; exact replay converged without a second revocation event.
• Final D1 state had revoked_at set and exactly registered, revoked audit events.
• The deliberate next predeploy failure stopped all three runs before mutation.
• Wrangler call evidence contained only whoami, deploy --dry-run, and deployments list; no secret write, Worker deploy, rollback, or production operation occurred.
• Both repository worktrees remained clean.

This closes the local merged-path gap. The remaining acceptance evidence is an explicitly authorized isolated remote D1 batch/rollback/concurrency gate and separately authorized production credential issuance.