coulomb/key-cape
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Record managed registration and custody work identities

Browse source 
Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a1046b-5629-7f52-badd-f718eadb6042
This commit is contained in:
tegwick 2026-10-04 11:17:19 +02:00
parent 31ed8bb686
commit f485d6fe9c
2 changed files with 10 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

5
WORK-RECORDS.md
View file

@ -47,6 +47,7 @@
| workplan | KEY-WP-0034 | finished | — | workplans/KEY-WP-0034-account-recovery.md |
| workplan | KEY-WP-0035 | finished | — | workplans/KEY-WP-0035-optional-mfa.md |
| workplan | KEY-WP-0036 | finished | — | workplans/KEY-WP-0036-platform-factor-recovery.md |
| workplan | KEY-WP-0037 | active | — | workplans/KEY-WP-0037-secrets-engine-openbao-registration-custody.md |
| task | ADHOC-2026-09-05-T01 | done | — | workplans/ADHOC-2026-09-05.md |
| task | ADHOC-2026-09-07-T01 | done | — | workplans/ADHOC-2026-09-07.md |
| task | ADHOC-2026-09-27-T01 | done | — | workplans/ADHOC-2026-09-27.md |
@ -201,4 +202,8 @@
| task | KEY-WP-0036-T01 | done | — | workplans/KEY-WP-0036-platform-factor-recovery.md |
| task | KEY-WP-0036-T02 | cancel | — | workplans/KEY-WP-0036-platform-factor-recovery.md |
| task | KEY-WP-0036-T03 | done | — | workplans/KEY-WP-0036-platform-factor-recovery.md |
| task | KEY-WP-0037-T01 | done | — | workplans/KEY-WP-0037-secrets-engine-openbao-registration-custody.md |
| task | KEY-WP-0037-T02 | wait | — | workplans/KEY-WP-0037-secrets-engine-openbao-registration-custody.md |
| task | KEY-WP-0037-T03 | wait | — | workplans/KEY-WP-0037-secrets-engine-openbao-registration-custody.md |
| task | KEY-WP-0037-T04 | wait | — | workplans/KEY-WP-0037-secrets-engine-openbao-registration-custody.md |
| intake | KEY-IN-0001 | closed | — | intakes/intakes.md |

5
workplans/KEY-WP-0037-secrets-engine-openbao-registration-custody.md
View file

@ -9,6 +9,7 @@ owner: codex
topic_slug: netkingdom
created: "2026-10-04"
updated: "2026-10-04"
state_hub_workstream_id: "62800ecf-064b-5546-a1e4-4521b5932973"
---
KeyCape's accepted provider contract (KEY-WP-0009) does not establish actual
@ -22,6 +23,7 @@ not live registration, credential generation, rotation, fetching or deployment.
id: KEY-WP-0037-T01
status: done
priority: high
state_hub_task_id: "0409f656-65fb-5ee2-a934-a687a3e139f1"
```
Reviewed KeyCape base 672e1faf4b3401ff7bf68bb0b29f8dc50ca51ac6:
@ -44,6 +46,7 @@ status: wait
priority: high
needs_human: true
intervention_note: "Approve the exact separate secrets-engine-openbao custody boundary only after platform and consumer owners complete the proposed coordinates and reviewed execution packet. Informed-decision reader approval does not cover this client."
state_hub_task_id: "ac798fb4-ed77-5e45-83ab-f56eea92be34"
```
Platform owns the authoritative OpenBao client-secret custody and least-privilege
@ -63,6 +66,7 @@ status: wait
priority: high
depends_on:
- KEY-WP-0037-T02
state_hub_task_id: "52f03e39-d05b-5da5-85df-e28c059430e4"
```
Coordinate source registration merge and the single new env secretKeyRef with
@ -82,6 +86,7 @@ status: wait
priority: high
depends_on:
- KEY-WP-0037-T03
state_hub_task_id: "40b80bcd-243d-5bf8-ba18-b992e3c5f8f7"
```
After authorized registration and custody, verify issuer/JWKS signature, subject,