[Module Proposal] ZYRQUEN Ω∞ Sovereign Audit & PQC Telemetry Sidecar Module for Coder #29610

For the proposed module, I would keep the Coder Module focused on orchestration rather than making the workspace responsible for long-lived cryptographic secrets.

For the PQC sidecar:

• Publish the module with explicit versioning and document the supported Coder/OTel/PQC dependencies.
• Treat the sidecar as a separate trust boundary and avoid baking private keys or HSM credentials into images, Terraform variables, or state.
• Terraform should provision references/configuration needed to access the HSM or external key service, not the secret key material itself.
• Prefer short-lived credentials/workload identity where the infrastructure supports it.
• If hardware-backed attestation is required, the signing/attestation operation should happen through the HSM/KMS interface rather than exposing the private key to the workspace.
• Be careful with Terraform state: sensitive variables are not sufficient protection if the underlying value is still persisted in state.

For the OTel component, mTLS certificates should similarly be issued and rotated through the platform's secret/identity mechanism rather than stored directly in the module configuration.

I would also recommend documenting the exact trust model: which component can access the key, which component performs attestation, what happens when attestation fails, and whether telemetry can continue without successful attestation.

That separation would make the module considerably easier to audit and safer to reuse across different Coder deployments.