hanzo-dev 00c5b6b6c6 feat(oidc): derive KMS SSO client id+secret from brand (zero env, matches IAM) ...

loadOIDCConfig now DERIVES the confidential SSO client from KMS_IAM_OWNER:
client_id=<owner>-kms, client_secret=HMAC-SHA256("hanzo-kms-oidc/v1",<owner>-kms),
state_secret=HMAC("hanzo-kms-state/v1",<owner>-kms). Same derivation hanzoai/iam
init_apps.go uses, so IAM provisions and KMS consumes the identical secret with
ZERO coordination — no KMS_OIDC_CLIENT_SECRET/KMS_STATE_SECRET env, no stored
secret, no manual copy. Env still overrides each (escape hatch). Only the
non-secret IAM_ENDPOINT remains required. Closes the deterministic KMS-admin
loop: reboot IAM+KMS -> SSO works -> admins mint scoped identities.

Note: full repo build is blocked by the pre-existing luxfi/* go.sum re-publish
mismatch (luxfi/age, luxfi/keys); oidc.go itself is gofmt-clean and the
derivation is parity-verified against the IAM side.

2026-06-28 13:45:06 -07:00

..

casibase-import

lux/kms: orphan history at f2e793bf8 (was: kms: wire luxfi/mpc as REK backend)

2026-06-07 14:28:09 -07:00

kms

feat(oidc): derive KMS SSO client id+secret from brand (zero env, matches IAM)

2026-06-28 13:45:06 -07:00

kms-operator

rebrand: neutralize legacy upstream brand across UI, backend, docs; add NOTICE

2026-06-24 11:19:41 -07:00

smoke-replay

lux/kms: orphan history at f2e793bf8 (was: kms: wire luxfi/mpc as REK backend)

2026-06-07 14:28:09 -07:00