coulomb/secrets-engine
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Reflect the published service-JWT login contract and proven login
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
SCOPE, layer.yaml and the custody doc said the platform JWT role was
unpublished. The role is applied, its consumer contract is published
(railiance-platform 21b8af3) and login was proven on 2026-10-10. The role
is login-only, so engine actions still use the named providers.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 544698@bnt-lap001
Assistant-Session: 279b8520-335f-4041-ba2a-9491335473db
This commit is contained in:
tegwick 2026-10-10 12:41:16 +02:00
parent 17da408ea3
commit 1732c419d2
4 changed files with 24 additions and 13 deletions
Download patch file Download diff file Expand all files Collapse all files

5
layer.yaml
View file

@ -164,8 +164,9 @@ non_tooling_clients:
key-cape is catalogued Tooling. The consumer exchanges a service JWT and
logs in only when SECRETS_ENGINE_OPENBAO_JWT_LOGIN names a published
mount/role contract. Failure never falls back to bootstrap or BAO_TOKEN.
The platform-owned role remains unpublished, so auto still uses the
named bootstrap/env providers.
The platform role is applied and its contract is published (CCR-2026-0038,
railiance-platform 21b8af3). Login was proven on 2026-10-10, but the role
is login-only, so engine actions still use the named bootstrap/env providers.
- id: audit-core-outbox-drain
target: audit-core