coulomb/secrets-engine
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Declare Engine/Lifecycle against security layer model v0.7
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
Replace the gate-house review note with this repository's own declaration:
INTENT.md frontmatter, layer.yaml, and a published PEP stance map. SCOPE.md
and agent boundary docs now match that layer. The review under history/
identifies the implementation remainder; SECRETS-WP-0008 is the follow-on
workplan. SECRETS-IN-0001 is closed.

The layer is not contested. Catalog "custody" is a finding: OpenBao owns
custody, this engine owns the lifecycle API over it. SSH-CA signing is
accepted as a proposed engine API and declined as a Staff lane.

Assistant: grok
Assistant-Session: 01a04cea-cb33-7c63-bad7-c1b0f9f0076b
This commit is contained in:
tegwick 2026-08-29 11:57:47 +02:00
parent b1f0f7b666
commit 1945e16685
14 changed files with 1177 additions and 108 deletions
Download patch file Download diff file Expand all files Collapse all files

11
.claude/rules/repo-boundary.md
View file

@ -1,12 +1,15 @@
## Repo boundary
This repo owns the **secrets-engine** workflow/interaction layer only. It does
not own:
This repo owns the **secrets-engine** Lifecycle engine only (NetKingdom
security layer model v0.7: Engine / Lifecycle). It does not own:
- Secret custody, policy, lease, and audit backend → OpenBao / railiance-platform
- SSH certificate issuance → ops-warden (`warden sign`)
- SSH certificate issuance (Staff PEP) → ops-warden (`warden sign`)
- Tunnels and remote transport → ops-bridge
- Authorization decisions → flex-auth
- Authorization decisions → access-engine (`flex-auth`)
- Approval objects → approval-engine
- Evidence custody and integrity → audit-core
- Identity and claim lifecycle → user-engine / key-cape
- Security doctrine and the layer model → gate-house / net-kingdom canon
- Cross-system security boundary doc → net-kingdom/docs/
- Request history and progress index → State Hub (read model)

2
.claude/rules/repo-identity.md
View file

@ -1,4 +1,4 @@
**Purpose:** secrets-engine is a headless, multi-application, multi-tenant secrets workflow and automation layer that orchestrates approved secret custody, delivery, and lifecycle work across build, test, and production stages, with OpenBao as the initial enforcement backend.
**Purpose:** secrets-engine is the Lifecycle engine for approved credential work: a deterministic API over OpenBao that orchestrates cataloged custody, delivery, and lifecycle actions across build, test, and production. It does not render authorization decisions.
**Domain:** infotech
**Repo slug:** secrets-engine