coulomb/secrets-engine
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Require declared human control in factory credential delivery
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a07ff8-19d0-7820-b4d0-1353833cb7fc
This commit is contained in:
tegwick 2026-09-10 20:16:55 +02:00
parent d1c13b5dd6
commit 2b0d04e8e1
11 changed files with 451 additions and 27 deletions
Download patch file Download diff file Expand all files Collapse all files

13
docs/catalog-admission.md
View file

@ -127,3 +127,16 @@ Before accepting an existing production lane:
lanes. Set `false` when the consumer needs only the KV data GET; generated
policy omits the metadata endpoint. Owner metadata verification then needs
separate operator authority, not broader consumer access.
## Explicit human-control requirement
`approval.human_control` is an optional boolean, defaulting to undeclared. Set it
to `true` only for a workflow whose existing contract requires human review. It
is not inferred from `approval.model`, stage or principal type. A declared lane
cannot use `bootstrap-only`; its live action requires an Approval Engine claim
explicitly declared human-controlled, current PDP ALLOW and CAS consumption.
Missing services cannot fall back to ordinary lane review or an unsafe demo.
See [the requester and consumer contract](approval-consumption.md#declared-human-control-workflow).
The HelixForge native-delivery catalog declares this requirement and remains
pending owner admission. No OpenBao policy, role, credential or readiness state
is activated by this source declaration.