coulomb/secrets-engine
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Add named engine auth and accessor-file session revoke
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
Select service-jwt, bootstrap, or env exclusively: JWT login uses a JSON
file, self-revokes, and never falls back to bootstrap or BAO_TOKEN. The
platform JWT mount/role is still unpublished, so auto keeps named
bootstrap/env providers.

session revoke --accessor-file revokes an already-issued token with
fingerprint-only evidence. Production remains fail-closed.

Assistant: grok
Assistant-Session: 01a05f07-ae72-7781-9fcb-19efd61add00
This commit is contained in:
tegwick 2026-09-02 01:24:08 +02:00
parent a94003de4f
commit 3abee434df
18 changed files with 698 additions and 135 deletions
Download patch file Download diff file Expand all files Collapse all files

8
workplans/SECRETS-WP-0007-production-lifecycle-hardening.md
View file

@ -168,8 +168,8 @@ destroy stays fail-closed until T04's exact-action contract; that is the
designed containment, not unfinished T03 work. Issued delivery sessions
self-revoke in T05.
Residual, not this task: a general known-accessor operator command. Tracked in
`docs/hardening-backlog.md` H4a.
Residual from this task, now implemented: `secrets-engine session revoke
--accessor-file` (hardening H4a). Lease-id revoke remains outstanding.
Progress 2026-08-23. Added one lifecycle plan model shared by dry-run and live
execution. Ordinary `revoke` safely aliases native deactivation; suspend and
@ -177,8 +177,8 @@ deactivate preserve KV custody and externally managed workload delivery.
Destroy has an unmistakable dry-run plan and exact-id confirmation, but its live
handler is deliberately fail-closed before coarse lane approval or backend
access until T04 supplies distinct action authorization. Scoped issued-session
self-revocation is implemented in T05; a general known-accessor operator command
remains outstanding.
self-revocation is implemented in T05; a general known-accessor operator
command is `session revoke --accessor-file` (H4a).
Replace the overloaded `revoke` behavior with explicit lifecycle operations and
plans. Define at least:

15
workplans/SECRETS-WP-0008-layer-model-lifecycle-conformance.md
View file

@ -228,10 +228,17 @@ priority: medium
state_hub_task_id: "d7bc8bdc-a0f8-5058-a640-374ef9859148"
```
Blocked on the platform-owned OpenBao JWT mount/role (railiance-platform) and
on `SECRETS-WP-0007-T05` wiring. Companion §7 / statute §3.4: an agent holds
no long-lived credential of its own. Authority is per task, time-bounded, and
attributable to the principal it acts for.
Progress 2026-09-02. Named engine auth is shipped: `service-jwt`, `bootstrap`,
and `env` are exclusive providers. `--auth service-jwt` exchanges the KeyCape
service JWT and logs in through `OpenBaoClient.login_jwt` (JSON file, never
argv), then self-revokes. A JWT selection refuses `--bootstrap-token-file` and
does not read `BAO_TOKEN` on failure. `--bootstrap-token-file` is a named
break-glass provider with `auth_break_glass` evidence.
The platform-owned OpenBao JWT mount/role is still unpublished, so auto keeps
bootstrap/env and this task remains `wait`. Companion §7 / statute §3.4: an
agent holds no long-lived credential of its own. Authority is per task,
time-bounded, and attributable to the principal it acts for.
Bootstrap token files remain break-glass, heavily evidenced, never an implicit
fallback from service identity.