gate-house/docs/conformance/2026-09-02-secrets-engine-t06-candidate.md

Conformance candidate — secrets-engine approval consumption

Repository: gate-house Status: candidate; not executed by whitehat-security Date: 2026-09-02 Canon target: T-06 — Approval Replay Test Implementer: secrets-engine Implementation revision: 3cd9955 (observed at repository revision 465c0d7) Source: State Hub message 99bf84bf-18d2-4e63-a7ac-25078e1c72d5 Workplan: GH-WP-0001-T06

Why this is a candidate

secrets-engine reports that every privileged production OpenBao handler now passes through one shared consume-before-effect function. The implementation is at src/secrets_engine/approval_consume.py; its consumer contract is at docs/approval-consumption.md.

The surface exercises the Gate House T-06 invariant without requiring a live secret, credential, approval service, or OpenBao mutation:

• an exact same-digest retry is idempotent success;
• a different digest produces a conflict and no OpenBao call;
• missing binding, authorization failure, unavailability, and unreachable approval-engine all fail closed before OpenBao;
• a failed effect does not unconsume the approval;
• the evidence shape contains identifiers and digests, not secret values.

Gate House ran the implementer's focused unit suite as a target-suitability check:

uv run --project /home/worsch/secrets-engine \
  pytest -p no:cacheprovider tests/test_approval_consume.py
17 passed in 0.36s

This confirms that a bounded fixture surface exists. It is not an offensive probe, a known-bad calibration, or a conformance verdict.

What whitehat-security must still supply

Whitehat-security owns the probe design and outcome. A conforming return still requires all of the following under conformance-reporting.v1:

1. independently identify the exact target revision and fixture boundary;
2. author a known-bad fixture that disables at least one replay protection, such as different-digest conflict or atomic single-use consumption;
3. demonstrate that the known-bad fixture accepts a prohibited replay or loses the T-06 oracle;
4. run the same probe against the unmodified candidate;
5. return pass, fail, blocked, or not_run with safe evidence references.

The existing implementer tests may be reused as setup evidence but must not be reported as independent Whitehat evidence.

Authorization boundary

This candidate authorizes no live probe and no production OpenBao, credential, approval, packet, or side effect. Whitehat may accept, revise, reject, or split the candidate under its own rules of engagement. Gate House specifies only the invariant, target, oracle, and report shape.