coulomb/flex-auth
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Publish secrets-engine.catalog-lane.lifecycle v1 (FLEX-WP-0021 T01, T02)
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details
Build and Publish Container Image / build-and-push (push) Successful in 52s
Details

Browse source 
secrets-engine delivered the action vocabulary T01 asked for: twelve
actions read out of cli.py, not the example vocabulary. The gate earned
its keep -- four would have been inferred wrongly, and revoke, the
obvious thirteenth, does not exist as an action at all. It gates as
deactivate, which is also reached from lifecycle deactivate.

docs/secrets-engine-action-vocabulary.md records the list and the four
traps. examples/secrets-engine/ carries the package, both manifests, a
loadable registry snapshot, 26 fixtures, five check requests, and a
README. validate -kind policy is valid with 22/22 Rego tests and 26/26
fixtures.

allow_ttl is 15m, stated in the package rather than inherited from the
engine default: these decisions authorize live secret operations, so the
reliance window belongs where a reviewer sees it. Per FLEX-DEC-2026-004
it is authority to issue, not authority to keep using what the operation
produced.

destroy is the dual-control case, gated on a context.approval claim
marked approved with two distinct approvers, repeated entries counting
once. flex-auth checks what the claim says and deliberately does not
re-derive its temporal validity, signature, or supersession -- those are
approval-engine's to assert and the PEP's to verify against the live
claim, per the split accepted in FLEX-DEC-2026-006. It stays in the
package though its handler raises before the gate, so the rule is
reviewed and fixtured before SECRETS-WP-0007-T04 opens the path.

Following the FLEX-WP-0010-T02 precedent the denial ladder has no
action_not_granted branch: one subject holding all twelve actions could
never reach it, and a rule that cannot fail reads as control that is not
there. Registering a second calling identity is the revisit trigger.

Not deployed. No flex-auth-secrets-engine pin exists yet (T04), so their
policy pin stays unset and fail-closed until T05.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01JTbVXpEiXA7mNJVpDnEPcB

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 412054@bnt-lap001
Assistant-Session: 3968fae1-8d59-4209-9bd6-c22594b8ab19
This commit is contained in:
tegwick 2026-09-06 08:02:52 +02:00
parent b9e6d2d52b
commit f75db59a8c
13 changed files with 1861 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

25
workplans/FLEX-WP-0021-secrets-engine-consumer-policy-gate.md
View file

@ -4,7 +4,7 @@ type: workplan
title: "secrets-engine consumer policy package and cluster-local pin"
domain: infotech
repo: flex-auth
status: proposed
status: active
owner: claude
topic_slug: netkingdom
planning_priority: P1
@ -60,7 +60,7 @@ weaken, or supply a fallback for the consumer's package pin.
```task
id: FLEX-WP-0021-T01
status: todo
status: done
priority: high
state_hub_task_id: "3c191808-6fe5-5a9b-9a68-a4ce4a672dbd"
```
@ -78,11 +78,19 @@ Owner: `flex-auth` to request and document; `secrets-engine` owns the answer.
Gate: every action in the vocabulary is named by secrets-engine, not inferred
here. An inferred action is a blocker, not a default.
**Done 2026-09-06.** secrets-engine delivered twelve actions in their
`docs/gated-actions.md`, read out of `cli.py`: `apply`, `provision`, `rotate`,
`verify`, `handoff`, `wrap`, `exec`, `deactivate`, `suspend`, `destroy`,
`compromise`, `reactivate`. Recorded in
`docs/secrets-engine-action-vocabulary.md`. The gate earned its keep: four
would have been inferred wrongly, and `revoke` — the obvious thirteenth — does
not exist as an action at all.
## 2. Publish `secrets-engine.catalog-lane.lifecycle` v1
```task
id: FLEX-WP-0021-T02
status: todo
status: done
priority: high
state_hub_task_id: "38770813-dfcc-5711-bba3-0db50d3af135"
```
@ -103,6 +111,17 @@ Owner: `flex-auth`.
Gate: `flex-auth validate` passes, the fixture tests pass, and the package
digest is stable across two runs.
**Done 2026-09-06.** `examples/secrets-engine/` carries the package
(`allow_ttl: 15m` stated explicitly), both manifests, a loadable
`registry_snapshot.json`, 26 fixtures, five standalone check requests, and a
README. `validate -kind policy` reports valid with 22/22 Rego tests and 26/26
fixtures passing. `destroy` is the dual-control case, gated on a
`context.approval` claim marked approved with two distinct approvers; flex-auth
checks what the claim says and does not re-derive its validity, signature, or
supersession (`FLEX-DEC-2026-006`). Per the `FLEX-WP-0010-T02` precedent the
denial ladder has no `action_not_granted` branch, because one subject holding
all twelve actions could never reach it.
## 3. Confirm the digest join against a real decision record
```task