coulomb/secrets-engine
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Ship secret-use snapshot surface for kings-guard
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
Add secrets-engine secret-use snapshot: catalog plus local evidence only,
contracted non-secret fields, declared 1d heartbeat cadence. Never contacts
OpenBao. Completeness is not claimed. owner_status stays proposed until
kings-guard admits the snapshot as an observation input.

Assistant: grok
Assistant-Session: 01a05f07-ae72-7781-9fcb-19efd61add00
This commit is contained in:
tegwick 2026-09-02 01:31:23 +02:00
parent 3abee434df
commit 2278cefbb3
8 changed files with 374 additions and 13 deletions
Download patch file Download diff file Expand all files Collapse all files

40
src/secrets_engine/cli.py
View file

@ -15,6 +15,7 @@ Command surface (FR7):
session revoke --accessor-file F [--stage stage]
lifecycle suspend|deactivate|destroy <catalog-id>
audit <catalog-id> [--json]
secret-use snapshot [--catalog-id ID] [--json]
evidence heartbeat|drain|classify
Every privileged action is decision-gated and writes non-secret evidence.
@ -617,6 +618,35 @@ def cmd_lifecycle(cfg: Config, args) -> int:
return 0
def cmd_secret_use_snapshot(cfg: Config, args) -> int:
"""Read-only secret-use evidence snapshot. Never contacts OpenBao."""
import json
from secrets_engine.secret_use import snapshot
payload = snapshot(
cfg.catalog_dir,
cfg.evidence_dir,
catalog_id=getattr(args, "catalog_id", "") or "",
)
if args.json:
print(json.dumps(payload, indent=2, sort_keys=True))
else:
print(
f"secret-use {payload['as_of']} lanes={len(payload['lanes'])} "
f"completeness_claimed={payload['completeness_claimed']} "
f"cadence={payload['cadence'].get('form')}/{payload['cadence'].get('interval')}"
)
for lane in payload["lanes"]:
ready = lane.get("ready")
ready_s = "unknown" if ready is None else str(ready).lower()
print(
f" {lane['catalog_id']:32s} stage={lane['stage']:5s} "
f"ready={ready_s} kind={lane.get('evidence_kind', '-')}"
)
return 0
def cmd_audit(cfg: Config, args) -> int:
"""Summarize allowlisted non-secret evidence for one cataloged lane."""
import json
@ -828,6 +858,16 @@ def build_parser() -> argparse.ArgumentParser:
add_token_arg(lp)
lp.set_defaults(func=cmd_lifecycle)
su = sub.add_parser("secret-use", help="read-only secret-use evidence surface")
susub = su.add_subparsers(dest="subcmd", required=True)
snap = susub.add_parser(
"snapshot",
help="non-secret lane metadata for kings-guard; never contacts OpenBao",
)
snap.add_argument("--catalog-id", default="", help="limit to one catalog id")
snap.add_argument("--json", action="store_true")
snap.set_defaults(func=cmd_secret_use_snapshot)
au = sub.add_parser("audit", help="summarize non-secret local lane evidence")
au.add_argument("catalog_id")
au.add_argument("--json", action="store_true")