coulomb/secrets-engine
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Record reproducible CLI release and exact native admission requirements
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 2s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a140c4-354a-7823-8f0d-8f717397f786
This commit is contained in:
tegwick 2026-10-16 18:44:05 +02:00
parent 4dd004a225
commit 3718e60d73
3 changed files with 104 additions and 23 deletions
Download patch file Download diff file Expand all files Collapse all files

17
workplans/SECRETS-WP-0014-pdp-transport-and-responder-authentication.md
View file

@ -117,7 +117,7 @@ T03 wait; task source/live obligations remain separately in SECRETS-WP-0013.
2026-10-16 trusted successor source preparation: refreshed exact API/sign source
from frozen Access B2/B3 R1 proposal (patch SHA-256
6079ed2ff40b131aa2c5efc8d33608ecb3475c8158f0486b44ec4469e9f222c1).
sha256:6079ed2ff40b131aa2c5efc8d33608ecb3475c8158f0486b44ec4469e9f222c1).
Producer DecodeEnvelope preserves signed numeric lexemes; strict CAS retains and
reauthenticates original producer JSON. Existing request/claim/native/caller joins
remain mandatory; signed source observation additionally binds the native digest
@ -175,3 +175,18 @@ bool/int/float substitution while allowing extra authoritative registry facts.
Actual provider proof preparation is separately waiting on frozen Access source
and Approval's timestamp/transaction-clock repair; source native/trust/custody and
actual task admission remain open. T02 remains progress and T03 wait; no native adoption is claimed.
2026-10-16 canonical native CLI release preparation: published4dd004a was built
twice offline from a clean isolated checkout, with identical artifacts/manifest
sha256:105dcebe6f03e9799f91ea75175e20500df2aa7f08b5e32d39c1c367593ca47e.
Disposable installation uses its fixed helper and empty native trust refuses
before caller access. Exact invocation/config/delivery candidates, public signer
provenance requirements, native lifecycle allow/deny capture, rotation/removal and
isolated-transport outage probes are reviewable in Custodian
`decision-native-preparation/r2/`. Real public kid/key/custody, candidate signed
producer/log/storage, native UID/prefix/config/caller/Approval delivery and each
actual handler/backend entitlement remain missing. No seed/token read, mint,
production installation/trust/policy change or effect occurred. Native effect
coverage remains0/11 across10handlers; T02 progress/T03 wait and task-native
WP13/WP8 gates remain open. Published Access receipt-tool2b064ee and verified
source APIs do not substitute for the separately reviewed hardened native image.