coulomb/key-cape
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Record the approved OpenBao custody boundary.

Browse source 
The founder resolved 632a8893 as the custody boundary only. T02 is done.
T03 waits on the still-open live registration decision caafe4be.

Assistant: grok
Assistant-Session: 01a10938-ab49-7280-877a-c06f64c06ddd
This commit is contained in:
tegwick 2026-10-05 09:30:49 +02:00
parent 7e4c76998d
commit 5e431eccc5
1 changed files with 11 additions and 8 deletions
Download patch file Download diff file Expand all files Collapse all files

19
workplans/KEY-WP-0037-secrets-engine-openbao-registration-custody.md
View file

@ -42,12 +42,8 @@ it does not approve or provision this different service client.
```task
id: KEY-WP-0037-T02
status: wait
status: done
priority: high
needs_human: true
decision_id: 632a8893-0d6a-4591-a50b-40bbdb798f32
blocking_reason: "The secrets-engine-openbao custody boundary needs the founder's separate approval. The owner packet is coordinates, not a live claim. Opening decision 632a8893 is not that approval."
intervention_note: "Approve the exact separate secrets-engine-openbao custody boundary only after platform and consumer owners complete the proposed coordinates and reviewed execution packet. Informed-decision reader approval does not cover this client."
state_hub_task_id: "ac798fb4-ed77-5e45-83ab-f56eea92be34"
```
@ -60,15 +56,21 @@ policy/roles, two target bindings, exact attended child and rollback before
seeking the founder's separate concrete approval. Values stay out of Hub/Git/chat,
argv and logs. Existing verifier/requester values must not be reused.
**Done 2026-10-05.** The founder resolved `632a8893-0d6a-4591-a50b-40bbdb798f32`.
The custody boundary is approved: platform owns OpenBao client-secret custody
and issuer-side delivery, and secrets-engine owns the mode-0600 file outside
every worktree. The owner packet is still coordinates. This approval does not
register the client, generate a secret, or deploy.
## Prepare and approve the deployment-owned registration operation
```task
id: KEY-WP-0037-T03
status: wait
priority: high
depends_on:
- KEY-WP-0037-T02
blocking_reason: "Registration merge waits on the custody approval (T02) and still needs an exact reviewed revision plus a founder live go."
needs_human: true
decision_id: caafe4be-4f68-47b4-9567-316d47b94992
blocking_reason: "Custody boundary 632a8893 is approved. Registration merge and rollout still need an exact reviewed revision and a separate live go. Opening caafe4be does not deploy."
state_hub_task_id: "52f03e39-d05b-5da5-85df-e28c059430e4"
```
@ -89,6 +91,7 @@ status: wait
priority: high
depends_on:
- KEY-WP-0037-T03
blocking_reason: "Live issuance proof waits on the registration operation (T03)."
state_hub_task_id: "40b80bcd-243d-5bf8-ba18-b992e3c5f8f7"
```