ADR-0004: Private Key Separation

Status: Accepted
Date: 2026-08-18
Author: SNAPKITTYWEST PAX-Coder Security Team

Context

The Sovereign Node private key is the most sensitive cryptographic material in the system. It signs official releases, establishes prior-art timestamps, and proves PAX-Coder provenance.

If the private key is distributed to the public clone, assume it can eventually be extracted:

Reversed from binaries
Dumped from memory
Recovered from CUDA/.so/.pyd files
Extracted from encrypted constants

Decision

The private Sovereign Node key MUST:

Never be committed to git — .gitignore enforces this
Never be distributed in releases — Only public key is published
Never be embedded in binaries — No compiled constants
Never be in encrypted secrets — No key-derivation in code
Never be in environment variables — Except for signing operations in secure environments

The public clone must contain ONLY:

node ID
public key (PEM)
public key fingerprint
release signatures
verification metadata
prior-art timestamps

The private key is held ONLY by the release signer and protected by access controls.

Rules

rules:
  - private Sovereign Node key MUST NOT be committed to git
  - private key MUST NOT appear in releases
  - private key MUST NOT be distributed in source tarballs
  - private key MUST NOT be embedded in binaries
  - private key MUST NOT be derived from environment configuration
  - private key MUST NOT be recoverable from public cryptographic material
  - .gitignore MUST explicitly block all private-key patterns
  - CI MUST scan for accidentally committed private keys
  - CI MUST reject commits containing private-key patterns

Protected Patterns

CI MUST reject commits matching:

-----BEGIN.*PRIVATE
-----END.*PRIVATE
-----BEGIN.*KEY
-----BEGIN.*RSA
-----BEGIN.*EC
-----BEGIN.*OPENSSH
private_key.*=
secret_key.*=
PRIVATE_KEY.*=
AWS_SECRET_ACCESS_KEY
AZURE_CLIENT_SECRET
api_key.*secret

Public Material Only

The clone MUST contain:

sovereign/node.json
  ├─ node_id
  ├─ algorithm
  ├─ public_key_hex
  ├─ created_at_utc
  ├─ repository
  ├─ git_commit
  └─ version

sovereign/node_pk.pem
  └─ [Public key in PEM format]

sovereign/release.json
  ├─ node_id
  ├─ node_public_key_hex
  ├─ signature_hex (signed by private key, but signature is public)
  ├─ git_commit
  ├─ release_version
  ├─ manifest_sha256
  └─ timestamp_utc

sovereign/manifest-*.json
  └─ [File hashes and release metadata]

MUST NOT contain:

.node_sk (private key binary)
node_sk.pem (private key PEM)
Any file with private key material
Any encrypted constants used to recover the key

Key Storage & Management

Release signing happens in a secure environment:

Offline Environment
  ├─ private_key.pem
  ├─ git clone
  ├─ sovereign/generate_release.sh
  └─ Sign release
       ├─ Hash manifest
       ├─ Sign hash with private key
       └─ Generate release.json

The public release artifact contains:

release.json (public)
  ├─ public key
  ├─ signature (hex)
  ├─ manifest hash
  └─ timestamp

The private key is NOT transmitted or stored in the public repository.

Key Rotation

When rotating to a new private key:

Generate new Sovereign Node key
Create rotation record with old public key signature
Document reason and timestamp
Do NOT delete old public key (preserve release history)
Mark old key as superseded

rotation:
  old_node_id: pax-coder-1787047913
  new_node_id: pax-coder-1787048999
  rotation_reason: scheduled rotation
  rotation_timestamp: 2026-12-18T00:00:00Z
  signature_by_old_key: ...

Tests Required

test_no_private_keys_in_repo: Scan for accidentally committed keys
test_no_embedded_secrets: Scan binaries for hardcoded keys
test_public_key_only_distribution: Verify releases contain only public material
test_gitignore_coverage: Verify all private-key patterns are ignored
test_ci_rejects_private_keys: Verify CI blocks key commits

CI Gate

#!/bin/bash
# Pre-commit hook
git diff --cached --name-only | xargs -I {} bash -c '
  if grep -l "PRIVATE\|BEGIN.*KEY\|secret_key" {} 2>/dev/null; then
    echo "ERROR: Private key material detected in: {}"
    exit 1
  fi
'

Consequences

Private key never leaks through version control
Public clone contains only verifiable public material
Key rotation does not break release history
Compromise of one key does not affect other releases
Private key management is manual and external to the repository

Related ADRs:

ADR-0001: Public Clone Integrity
ADR-0002: Authorization Boundary
ADR-0006: Server Challenge Protocol