coulomb/flex-auth
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
flex-auth/examples/secrets-engine
History
tegwick 9e10d1cec1
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details
Build and Publish Container Image / build-and-push (push) Successful in 37s
Details
Emit T03 replay fixtures from the published package 
Two real DecisionEnvelopes in examples/secrets-engine/replay/ for
secrets-engine to verify its digest join unchanged: a plain allow
(rotate, empty context) and the dual-control allow (destroy with a valid
approval-claim).

Both are included deliberately. input_claim_digests.context appears only
when the request carries a non-empty context, so a consumer asserting the
field is always present would pass on destroy and fail on rotate. One
fixture would have hidden that.

request_digest, policy_package_digest, registry_snapshot_digest and the
context claim digest are verified identical across two runs and are the
fields to pin. id, decision_time and the lifetime bounds move with the
clock; the README says so rather than leaving a consumer to discover it
by flake. lifetime.ttl is 15m from the package allow_ttl.

Emitted from flex-auth/local in standalone mode, not from a cluster pin.
T03 is progress, not done -- it closes when secrets-engine confirms their
validator accepts the records unchanged.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01JTbVXpEiXA7mNJVpDnEPcB

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 412054@bnt-lap001
Assistant-Session: 3968fae1-8d59-4209-9bd6-c22594b8ab19
2026-09-06 08:14:14 +02:00
..
replay Emit T03 replay fixtures from the published package 2026-09-06 08:14:14 +02:00
check_request_allow_destroy_dual_control.json Fix the destroy rule: it was written against an invented claim shape 2026-09-06 08:11:14 +02:00
check_request_allow_rotate.json Publish secrets-engine.catalog-lane.lifecycle v1 (FLEX-WP-0021 T01, T02) 2026-09-06 08:02:52 +02:00
check_request_deny_destroy_without_claim.json Publish secrets-engine.catalog-lane.lifecycle v1 (FLEX-WP-0021 T01, T02) 2026-09-06 08:02:52 +02:00
check_request_deny_revoke_not_an_action.json Publish secrets-engine.catalog-lane.lifecycle v1 (FLEX-WP-0021 T01, T02) 2026-09-06 08:02:52 +02:00
check_request_deny_unknown_subject.json Publish secrets-engine.catalog-lane.lifecycle v1 (FLEX-WP-0021 T01, T02) 2026-09-06 08:02:52 +02:00
policy_fixtures.yaml Fix the destroy rule: it was written against an invented claim shape 2026-09-06 08:11:14 +02:00
policy_package.md Fix the destroy rule: it was written against an invented claim shape 2026-09-06 08:11:14 +02:00
protected_system_manifest.yaml Publish secrets-engine.catalog-lane.lifecycle v1 (FLEX-WP-0021 T01, T02) 2026-09-06 08:02:52 +02:00
README.md Fix the destroy rule: it was written against an invented claim shape 2026-09-06 08:11:14 +02:00
registry_snapshot.json Publish secrets-engine.catalog-lane.lifecycle v1 (FLEX-WP-0021 T01, T02) 2026-09-06 08:02:52 +02:00
subject_manifest.yaml Publish secrets-engine.catalog-lane.lifecycle v1 (FLEX-WP-0021 T01, T02) 2026-09-06 08:02:52 +02:00

README.md

secrets-engine example

Policy package, manifests, and fixtures for secrets-engine's gated catalog-lane operations. Opened by FLEX-DEC-2026-005, carried by FLEX-WP-0021.

File What it is
policy_package.md secrets-engine.catalog-lane.lifecycle v1, allow_ttl: 15m
protected_system_manifest.yaml the secret-catalog-lane resource type and twelve actions
subject_manifest.yaml the single secrets-engine service identity
registry_snapshot.json loadable snapshot combining both manifests
policy_fixtures.yaml 29 fixtures — 11 allows, dual control both ways, and every denial branch
check_request_*.json standalone requests for POST /v1/check

The action vocabulary is secrets-engine's, delivered under FLEX-WP-0021-T01 and recorded in ../../docs/secrets-engine-action-vocabulary.md. Read that before changing any action string here.

Verify

go run ./cmd/flex-auth validate -kind policy -file examples/secrets-engine/policy_package.md
go run ./cmd/flex-auth load-registry -file examples/secrets-engine/registry_snapshot.json

25 Rego tests and 29 fixtures.

Not yet deployed

There is no flex-auth-secrets-engine pin yet (FLEX-WP-0021-T04), so secrets-engine has no address to call. Their policy pin (SECRETS_ENGINE_AUTHORIZATION_POLICY_PACKAGE / _VERSION) stays unset and fail-closed until FLEX-WP-0021-T05 hands them the published package and the Service DNS. Do not configure it from this directory.