coulomb/secrets-engine
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Manifest the lifecycle engine as a library, a one-stage CLI, and an in-process service.
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
Planning stays off the store client. The process binds one stage credential at start, serve runs the same lifecycle library, and a local allow flag does not authorize a protected call.

Assistant: grok
Assistant-Session: 01a1609f-72b8-7222-9dff-fae300115e42
This commit is contained in:
tegwick 2026-10-22 18:02:21 +02:00
parent 3e3f8fc629
commit 06dfe12c18
8 changed files with 530 additions and 26 deletions
Download patch file Download diff file Expand all files Collapse all files

25
workplans/SECRETS-WP-0016-engine-manifestations.md
View file

@ -4,7 +4,7 @@ type: workplan
title: "Manifest the lifecycle engine as one library, a CLI, and a single-stage service"
domain: infotech
repo: secrets-engine
status: ready
status: finished
owner: secrets-engine
topic_slug: custodian
created: "2026-10-22"
@ -24,12 +24,13 @@ Implements the engine shape in `INTENT.md` after gate-house ADR-015
(accepted 2026-10-22) and `ArchitectureBlueprint.md` §2.2.
Reviewed against the tree on 2026-10-22. `secrets_engine.plan.build_plan`
already renders a plan without an OpenBao client. `secrets_engine.cli` is the
process. `SCOPE.md` records that service delivery is absent, and that a
service API or daemon is not implemented. `service-jwt` can log in and cannot
yet carry engine actions. Accepted security-layer-model v0.8 still governs
PEP behavior. Proposed v0.9 §3.3 carries the same engine wording and does not
yet govern.
renders a plan without an OpenBao client. `secrets_engine.cli` is the process,
bound to one stage credential at start. `serve` keeps that same library
running for the bound stage. `SCOPE.md` records the library, the one-stage
CLI, and that in-process manifestation. Exec-time delivery remains the default
for a one-task caller. `service-jwt` can log in and cannot yet carry engine
actions. Accepted security-layer-model v0.8 still governs PEP behavior.
Proposed v0.9 §3.3 carries the same engine wording and does not yet govern.
This workplan does not add a release-unit declaration, does not deploy a
workload, and does not make this engine the only client of OpenBao or a
@ -39,7 +40,7 @@ decider of who may use it.
```task
id: SECRETS-WP-0016-T01
status: todo
status: done
priority: high
state_hub_task_id: "4319d9c6-f7e1-500c-9011-a58c216d555d"
```
@ -56,7 +57,7 @@ path still performs the OpenBao calls.
```task
id: SECRETS-WP-0016-T02
status: todo
status: done
priority: high
depends_on: [SECRETS-WP-0016-T01]
state_hub_task_id: "f5d5e9ba-ba56-56cc-8920-1417d70beb1d"
@ -75,7 +76,7 @@ stderr, and shows startup failure when two stage credentials are present.
```task
id: SECRETS-WP-0016-T03
status: todo
status: done
priority: medium
depends_on: [SECRETS-WP-0016-T02]
state_hub_task_id: "c37280f3-e9d0-5cdd-ba15-a95ec5f9aa0c"
@ -92,7 +93,7 @@ lifecycle call goes through the shipped library functions used by the CLI.
```task
id: SECRETS-WP-0016-T04
status: todo
status: done
priority: medium
depends_on: [SECRETS-WP-0016-T03]
state_hub_task_id: "89b71b5b-a2ce-57d6-b16b-0f94d76e0104"
@ -111,7 +112,7 @@ and the claim shape is written in `docs/` without storing a credential.
```task
id: SECRETS-WP-0016-T05
status: todo
status: done
priority: low
depends_on: [SECRETS-WP-0016-T03, SECRETS-WP-0016-T04]
state_hub_task_id: "6b013ea1-4a04-57e8-bab2-acb196303e0a"