From f485d6fe9c7389b7f29d97e5da51b14eb0692eb3 Mon Sep 17 00:00:00 2001 From: tegwick Date: Sun, 4 Oct 2026 11:17:19 +0200 Subject: [PATCH] Record managed registration and custody work identities Assistant: codex Assistant-Model: gpt-6.1-sol Assistant-Session: 01a1046b-5629-7f52-badd-f718eadb6042 --- WORK-RECORDS.md | 5 +++++ ...EY-WP-0037-secrets-engine-openbao-registration-custody.md | 5 +++++ 2 files changed, 10 insertions(+) diff --git a/WORK-RECORDS.md b/WORK-RECORDS.md index 74e5dd4..8d4cb6a 100644 --- a/WORK-RECORDS.md +++ b/WORK-RECORDS.md @@ -47,6 +47,7 @@ | workplan | KEY-WP-0034 | finished | — | workplans/KEY-WP-0034-account-recovery.md | | workplan | KEY-WP-0035 | finished | — | workplans/KEY-WP-0035-optional-mfa.md | | workplan | KEY-WP-0036 | finished | — | workplans/KEY-WP-0036-platform-factor-recovery.md | +| workplan | KEY-WP-0037 | active | — | workplans/KEY-WP-0037-secrets-engine-openbao-registration-custody.md | | task | ADHOC-2026-09-05-T01 | done | — | workplans/ADHOC-2026-09-05.md | | task | ADHOC-2026-09-07-T01 | done | — | workplans/ADHOC-2026-09-07.md | | task | ADHOC-2026-09-27-T01 | done | — | workplans/ADHOC-2026-09-27.md | @@ -201,4 +202,8 @@ | task | KEY-WP-0036-T01 | done | — | workplans/KEY-WP-0036-platform-factor-recovery.md | | task | KEY-WP-0036-T02 | cancel | — | workplans/KEY-WP-0036-platform-factor-recovery.md | | task | KEY-WP-0036-T03 | done | — | workplans/KEY-WP-0036-platform-factor-recovery.md | +| task | KEY-WP-0037-T01 | done | — | workplans/KEY-WP-0037-secrets-engine-openbao-registration-custody.md | +| task | KEY-WP-0037-T02 | wait | — | workplans/KEY-WP-0037-secrets-engine-openbao-registration-custody.md | +| task | KEY-WP-0037-T03 | wait | — | workplans/KEY-WP-0037-secrets-engine-openbao-registration-custody.md | +| task | KEY-WP-0037-T04 | wait | — | workplans/KEY-WP-0037-secrets-engine-openbao-registration-custody.md | | intake | KEY-IN-0001 | closed | — | intakes/intakes.md | diff --git a/workplans/KEY-WP-0037-secrets-engine-openbao-registration-custody.md b/workplans/KEY-WP-0037-secrets-engine-openbao-registration-custody.md index 505ed49..bc87610 100644 --- a/workplans/KEY-WP-0037-secrets-engine-openbao-registration-custody.md +++ b/workplans/KEY-WP-0037-secrets-engine-openbao-registration-custody.md @@ -9,6 +9,7 @@ owner: codex topic_slug: netkingdom created: "2026-10-04" updated: "2026-10-04" +state_hub_workstream_id: "62800ecf-064b-5546-a1e4-4521b5932973" --- KeyCape's accepted provider contract (KEY-WP-0009) does not establish actual @@ -22,6 +23,7 @@ not live registration, credential generation, rotation, fetching or deployment. id: KEY-WP-0037-T01 status: done priority: high +state_hub_task_id: "0409f656-65fb-5ee2-a934-a687a3e139f1" ``` Reviewed KeyCape base 672e1faf4b3401ff7bf68bb0b29f8dc50ca51ac6: @@ -44,6 +46,7 @@ status: wait priority: high needs_human: true intervention_note: "Approve the exact separate secrets-engine-openbao custody boundary only after platform and consumer owners complete the proposed coordinates and reviewed execution packet. Informed-decision reader approval does not cover this client." +state_hub_task_id: "ac798fb4-ed77-5e45-83ab-f56eea92be34" ``` Platform owns the authoritative OpenBao client-secret custody and least-privilege @@ -63,6 +66,7 @@ status: wait priority: high depends_on: - KEY-WP-0037-T02 +state_hub_task_id: "52f03e39-d05b-5da5-85df-e28c059430e4" ``` Coordinate source registration merge and the single new env secretKeyRef with @@ -82,6 +86,7 @@ status: wait priority: high depends_on: - KEY-WP-0037-T03 +state_hub_task_id: "40b80bcd-243d-5bf8-ba18-b992e3c5f8f7" ``` After authorized registration and custody, verify issuer/JWKS signature, subject,