coulomb/secrets-engine
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Add named engine auth and accessor-file session revoke
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
Select service-jwt, bootstrap, or env exclusively: JWT login uses a JSON
file, self-revokes, and never falls back to bootstrap or BAO_TOKEN. The
platform JWT mount/role is still unpublished, so auto keeps named
bootstrap/env providers.

session revoke --accessor-file revokes an already-issued token with
fingerprint-only evidence. Production remains fail-closed.

Assistant: grok
Assistant-Session: 01a05f07-ae72-7781-9fcb-19efd61add00
This commit is contained in:
tegwick 2026-09-02 01:24:08 +02:00
parent a94003de4f
commit 3abee434df
18 changed files with 698 additions and 135 deletions
Download patch file Download diff file Expand all files Collapse all files

15
workplans/SECRETS-WP-0008-layer-model-lifecycle-conformance.md
View file

@ -228,10 +228,17 @@ priority: medium
state_hub_task_id: "d7bc8bdc-a0f8-5058-a640-374ef9859148"
```
Blocked on the platform-owned OpenBao JWT mount/role (railiance-platform) and
on `SECRETS-WP-0007-T05` wiring. Companion §7 / statute §3.4: an agent holds
no long-lived credential of its own. Authority is per task, time-bounded, and
attributable to the principal it acts for.
Progress 2026-09-02. Named engine auth is shipped: `service-jwt`, `bootstrap`,
and `env` are exclusive providers. `--auth service-jwt` exchanges the KeyCape
service JWT and logs in through `OpenBaoClient.login_jwt` (JSON file, never
argv), then self-revokes. A JWT selection refuses `--bootstrap-token-file` and
does not read `BAO_TOKEN` on failure. `--bootstrap-token-file` is a named
break-glass provider with `auth_break_glass` evidence.
The platform-owned OpenBao JWT mount/role is still unpublished, so auto keeps
bootstrap/env and this task remains `wait`. Companion §7 / statute §3.4: an
agent holds no long-lived credential of its own. Authority is per task,
time-bounded, and attributable to the principal it acts for.
Bootstrap token files remain break-glass, heavily evidenced, never an implicit
fallback from service identity.