coulomb/secrets-engine
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Bind wrapped issuance to native metadata and preserve immutable recipient attempts
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a126e1-76f8-7643-8cf3-e93336539ade
This commit is contained in:
tegwick 2026-10-12 00:11:49 +02:00
parent 58129de8f1
commit 0db6adef69
8 changed files with 288 additions and 46 deletions
Download patch file Download diff file Expand all files Collapse all files

9
docs/cli.md
View file

@ -235,3 +235,12 @@ secrets-engine verify whynot-design-npm-publish --field npm_token --positive --n
# 6. publish with the token injected into the child only
secrets-engine exec --catalog whynot-design-npm-publish -- npm publish
```
Wrapped handoff files must be fresh and inside an owned private directory outside
Git. Existing files, symlinks and shared directories refuse before minting. A
failed or uncertain mint leaves its private reservation for owner reconciliation;
never delete it merely to retry. The backend must return the exact native KV-v2
data/AppRole creation path, requested bounded TTL and an accessor. Handoff-file
creation verifies those native fields; a requested path alone is not evidence.
These checks do not enable production wrapping or the separate execute-ccr
metadata entitlement.