coulomb/secrets-engine
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

SECRETS-WP-0017: approved by the founder (proposed -> ready), NK-WP-0056-T02 follow-up
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 994874@bnt-lap001
Assistant-Session: 6017c416-d619-47eb-bd1a-f670a02d7d87
This commit is contained in:
tegwick 2026-10-31 15:35:13 +01:00
parent bad922df17
commit 27071f4641
2 changed files with 10 additions and 10 deletions
Download patch file Download diff file Expand all files Collapse all files

6
WORK-RECORDS.md
View file

@ -25,7 +25,7 @@
| workplan | SECRETS-WP-0014 | active | — | workplans/SECRETS-WP-0014-pdp-transport-and-responder-authentication.md |
| workplan | SECRETS-WP-0015 | active | — | workplans/SECRETS-WP-0015-original-keycape-recovery-selector.md |
| workplan | SECRETS-WP-0016 | finished | — | workplans/SECRETS-WP-0016-engine-manifestations.md |
| workplan | SECRETS-WP-0017 | proposed | — | workplans/SECRETS-WP-0017-bounded-executor-lanes.md |
| workplan | SECRETS-WP-0017 | ready | — | workplans/SECRETS-WP-0017-bounded-executor-lanes.md |
| task | SECRETS-WP-ADHOC-2026-08-21-T01 | done | — | workplans/ADHOC-2026-08-21.md |
| task | SECRETS-WP-ADHOC-2026-08-23-T01 | done | — | workplans/ADHOC-2026-08-23.md |
| task | SECRETS-WP-0001-T01 | done | — | workplans/SECRETS-WP-0001-statehub-bootstrap.md |
@ -104,9 +104,9 @@
| task | SECRETS-WP-0016-T03 | done | — | workplans/SECRETS-WP-0016-engine-manifestations.md |
| task | SECRETS-WP-0016-T04 | done | — | workplans/SECRETS-WP-0016-engine-manifestations.md |
| task | SECRETS-WP-0016-T05 | done | — | workplans/SECRETS-WP-0016-engine-manifestations.md |
| task | SECRETS-WP-0017-T01 | wait | — | workplans/SECRETS-WP-0017-bounded-executor-lanes.md |
| task | SECRETS-WP-0017-T01 | todo | — | workplans/SECRETS-WP-0017-bounded-executor-lanes.md |
| task | SECRETS-WP-0017-T02 | todo | — | workplans/SECRETS-WP-0017-bounded-executor-lanes.md |
| task | SECRETS-WP-0017-T03 | wait | — | workplans/SECRETS-WP-0017-bounded-executor-lanes.md |
| task | SECRETS-WP-0017-T03 | todo | — | workplans/SECRETS-WP-0017-bounded-executor-lanes.md |
| intake | SECRETS-IN-0001 | closed | — | intakes/intakes.md |
| intake | SECRETS-IN-0002 | closed | — | intakes/intakes.md |
| intake | SECRETS-IN-0003 | closed | — | intakes/intakes.md |

14
workplans/SECRETS-WP-0017-bounded-executor-lanes.md
View file

@ -4,7 +4,7 @@ type: workplan
title: "Catalog and guard bounded-executor CAS rotation lanes (NK-WP-0056 pilot)"
domain: infotech
repo: secrets-engine
status: proposed
status: ready
flavor: implementation
owner: secrets-engine
topic_slug: custodian
@ -25,11 +25,9 @@ auth role and policy through its own CCR, and the executor holds only its own
```task
id: SECRETS-WP-0017-T01
status: wait
status: todo
needs_human: true
decision_id: c29c6eda-fa13-4d53-8293-17261eb437c1
blocked_on: human
blocking_reason: "founder approval of the Q1 lane shape (docs/bounded-executor-credential-lanes.md)"
priority: high
state_hub_task_id: "d921d92f-38ed-5da7-8820-8a9e614c84de"
```
@ -60,11 +58,9 @@ can run it on the CCR policy file before an attended apply. No OpenBao call.
```task
id: SECRETS-WP-0017-T03
status: wait
status: todo
needs_human: true
decision_id: 3d0c8f86-7b9c-456b-8951-5ae889829118
blocked_on: human
blocking_reason: "platform CCR for the executor role/policy, and founder choice of LLDAP credential shape"
priority: medium
state_hub_task_id: "2b751e4c-6cbc-54b9-8cb2-0e78d4a59739"
```
@ -74,3 +70,7 @@ as non-secret entries that reference the platform CCR and NK-WP-0056. If the
founder chooses the fallback LLDAP account, also add
`nk-bind-executor-lldap-credential` (high risk). Use `route` for readiness
pointers only.
## Founder decision 2026-10-31
Approved by the founder (`proposed` -> `ready`) after the NK-WP-0056-T02 owner answers (hub decision 19afd15e). Founder choices: the executor write role is window-scoped (hub c29c6eda; CCR-2026-0058 approved as amended) and the bind rotates its own password (hub 3d0c8f86), so no `lldap_password_manager` lane is needed; T01 and T03 are unblocked.