Evidence record / openhands
A dated record of one change, kept so the writing that cites it can be checked. Compiled from the sources listed below by the research run, not written for reading. The judgment lives in the issues that cite it, below.
2026-10-24-openhands-cipher-key-rotation-gains-a-migration-path-and-refuses-destructive-writes-under-a-lost-key
Cipher-key rotation gains a migration path and refuses destructive writes under a lost key. OH_PREVIOUS_SECRET_KEYS supplies old decryption keys while OH_SECRET_KEY supplies the new encryption key. Settings and secret stores are re-encrypted at startup; other encrypted records migrate when saved. If encrypted settings or secrets cannot be decrypted, writes refuse with HTTP 409 instead of overwriting the unreadable data. Without an explicit encryption key the first session API key is a fallback, so rotating an authentication key can also change decryption behavior.
Channel: tagged-release. Half: both. Date: 2026-10-21.
Operator consequence: Upgrade, back up encrypted state, retain old keys until all relevant stores are migrated, and distinguish authentication rotation from encryption rotation. This gives operators a supported recovery mechanism instead of a destructive trial-and-error sequence. It does not itself migrate the separate automation key-value store or revoke exported provider keys; those remain separate responsibilities.
Receipt
Finding metadata
Run: 2026-10-24-weekly-digest-2026-10-13_2026-10-24-frontier-v0
Finding ID: 2026-10-24-openhands-cipher-key-rotation-gains-a-migration-path-and-refuses-destructive-writes-under-a-lost-key
Source links
Primary links, including exact changelog lines when available.
- commit2026-10-24-openhands-cipher-key-rotation-gains-a-migration-path-and-refuses-destructive-writes-under-a-lost-keygithub.com/OpenHands/software-agent-sdk/commit/53757a33283d8d412189421b852640b83a8868cftagged commit file2026-10-24-openhands-cipher-key-rotation-gains-a-migration-path-and-refuses-destructive-writes-under-a-lost-keyOpenHands/software-agent-sdk / openhands-agent-server/openhands/agent_server/README.md#L273-L286tagged commit file2026-10-24-openhands-cipher-key-rotation-gains-a-migration-path-and-refuses-destructive-writes-under-a-lost-keyOpenHands/OpenHands / config/defaults.json
Versioned source: run artifact