coulomb/secrets-engine
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Declare Engine/Lifecycle against security layer model v0.7
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
Replace the gate-house review note with this repository's own declaration:
INTENT.md frontmatter, layer.yaml, and a published PEP stance map. SCOPE.md
and agent boundary docs now match that layer. The review under history/
identifies the implementation remainder; SECRETS-WP-0008 is the follow-on
workplan. SECRETS-IN-0001 is closed.

The layer is not contested. Catalog "custody" is a finding: OpenBao owns
custody, this engine owns the lifecycle API over it. SSH-CA signing is
accepted as a proposed engine API and declined as a Staff lane.

Assistant: grok
Assistant-Session: 01a04cea-cb33-7c63-bad7-c1b0f9f0076b
This commit is contained in:
tegwick 2026-08-29 11:57:47 +02:00
parent b1f0f7b666
commit 1945e16685
14 changed files with 1177 additions and 108 deletions
Download patch file Download diff file Expand all files Collapse all files

19
AGENTS.md
View file

@ -2,7 +2,7 @@
## Repo Identity
**Purpose:** secrets-engine is a headless, multi-application, multi-tenant secrets workflow and automation layer that orchestrates approved secret custody, delivery, and lifecycle work across build, test, and production stages, with OpenBao as the initial enforcement backend.
**Purpose:** secrets-engine is the Lifecycle engine for approved credential work: a deterministic API over OpenBao that orchestrates cataloged custody, delivery, and lifecycle actions across build, test, and production. It does not render authorization decisions.
**Domain:** infotech
**Repo slug:** secrets-engine
@ -166,17 +166,24 @@ Read `docs/netkingdom-security-infrastructure.md` before changing secret
catalogs, OpenBao policies, auth roles, delivery modes, or ops-warden routing.
Core rules:
- OpenBao is the custody, policy, lease, and audit backend.
- secrets-engine owns workflow, catalog, decision checks, safe delivery, and
non-secret evidence.
- flex-auth decides authorization; user-engine/key-cape own identity and claims.
- Layer: Engine / Lifecycle (`INTENT.md`, `layer.yaml`). PEP stance:
`pep-stance.yaml`.
- OpenBao is the custody, policy, lease, and audit backend (Tooling).
- secrets-engine is the Lifecycle API over that backend: catalog, decision
consumption, safe delivery, and non-secret evidence. It does not render
authorization decisions.
- `access-engine` (`flex-auth`) decides authorization; user-engine/key-cape own
identity and claims; `audit-core` owns evidence custody.
- ops-warden routes non-SSH credential requests here and must not vend secrets.
SSH certificate issuance remains ops-warden's Staff PEP.
- ops-bridge may consume scoped delivery for remote execution but must not store
secret material.
- info-tech-canon is the source for canonical terminology and stage/policy
concepts as they harden.
concepts as they harden. gate-house owns the layer model.
- Never write raw secret values to Git, State Hub, chat, prompts, workplans, or
normal logs.
- Never claim local evidence or a missing record proves occurrence or
non-occurrence.
<!-- Append repo-specific agent instructions below this marker.
The state-hub template sync preserves content after this line. -->