tegwick
c0c25e7056
Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a05e30-2884-71b0-98d7-7edd16ae737b
66 lines
2.8 KiB
Markdown
66 lines
2.8 KiB
Markdown
# Conformance candidate — secrets-engine approval consumption
|
|
|
|
**Repository:** gate-house
|
|
**Status:** promoted into Whitehat fixture calibration; live target pending
|
|
**Date:** 2026-09-02
|
|
**Canon target:** T-06 — Approval Replay Test
|
|
**Implementer:** secrets-engine
|
|
**Implementation revision:** `4b4d556`
|
|
**Initial observation:** uncommitted working tree at repository revision `465c0d7`
|
|
**Source:** State Hub message `99bf84bf-18d2-4e63-a7ac-25078e1c72d5`
|
|
**Workplan:** GH-WP-0001-T06
|
|
|
|
## Why this is a candidate
|
|
|
|
secrets-engine reports that every privileged production OpenBao handler now
|
|
passes through one shared consume-before-effect function. The implementation
|
|
is at `src/secrets_engine/approval_consume.py`; its consumer contract is at
|
|
`docs/approval-consumption.md`.
|
|
|
|
The surface exercises the Gate House T-06 invariant without requiring a live
|
|
secret, credential, approval service, or OpenBao mutation:
|
|
|
|
- an exact same-digest retry is idempotent success;
|
|
- a different digest produces a conflict and no OpenBao call;
|
|
- missing binding, authorization failure, unavailability, and unreachable
|
|
approval-engine all fail closed before OpenBao;
|
|
- a failed effect does not unconsume the approval;
|
|
- the evidence shape contains identifiers and digests, not secret values.
|
|
|
|
Gate House initially ran the implementer's focused unit suite against the
|
|
then-current working tree at revision `465c0d7` as a target-suitability check:
|
|
|
|
```text
|
|
uv run --project /home/worsch/secrets-engine \
|
|
pytest -p no:cacheprovider tests/test_approval_consume.py
|
|
17 passed in 0.36s
|
|
```
|
|
|
|
This confirms that a bounded fixture surface exists. It is not an offensive
|
|
probe, a known-bad calibration, or a conformance verdict.
|
|
|
|
Whitehat-security later established that `approval_consume.py` first appears
|
|
in committed history at `4b4d556`, not at `3cd9955` as Gate House initially
|
|
inferred from the surrounding workplan history. Gate House accepts that
|
|
correction. The initial test count remains a working-tree suitability check;
|
|
the immutable candidate revision is `4b4d556`.
|
|
|
|
## Whitehat return
|
|
|
|
Whitehat-security supplied the fixture-only probe, known-bad calibration, and
|
|
contract-complete return under `conformance-reporting.v1`:
|
|
|
|
- Whitehat evidence revision `75deaf0`;
|
|
- return message `a1ebf012-bd1e-43d2-843c-ba3ddecb8c82`;
|
|
- final Gate House review
|
|
`docs/conformance/2026-09-02-whitehat-t06-fixture-return.md`.
|
|
|
|
The existing implementer tests may be reused as setup evidence but must not be
|
|
reported as independent Whitehat evidence.
|
|
|
|
## Authorization boundary
|
|
|
|
This candidate authorizes no live probe and no production OpenBao, credential,
|
|
approval, packet, or side effect. Whitehat may accept, revise, reject, or split
|
|
the candidate under its own rules of engagement. Gate House specifies only the
|
|
invariant, target, oracle, and report shape.
|