coulomb/secrets-engine
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Bind credential exec to exact owner inputs and approval digest
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 2s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a07ff8-19d0-7820-b4d0-1353833cb7fc
This commit is contained in:
tegwick 2026-09-10 09:29:38 +02:00
parent 9eb07fd8fc
commit 42b48aa54f
13 changed files with 626 additions and 7 deletions
Download patch file Download diff file Expand all files Collapse all files

32
workplans/SECRETS-WP-0009-glas-claude-native-delivery.md
View file

@ -7,7 +7,7 @@ repo: secrets-engine
status: blocked
owner: codex
created: "2026-09-05"
updated: "2026-09-09"
updated: "2026-09-10"
state_hub_workstream_id: "40ccc3b4-d046-5a58-8649-e7935f45c974"
---
@ -49,6 +49,7 @@ synthetic exec-env transport proof passed; no real secret was read.
id: SECRETS-WP-0009-T03
status: wait
priority: high
blocking_reason: "Recipient binding now implemented and proved with the real local approval/PDP chain. Complete exact private owner configuration and native MessagesOwner holder admission, CCR-2026-0019 operator reader, human/audit/service path and scoped live delivery. CCR-2026-0020 was cancelled by its owner."
state_hub_task_id: "f8069c8a-ad6b-5d0b-9a36-c2326699437d"
```
@ -196,3 +197,32 @@ receipt: docs/evidence/2026-09-09-replay-contract-exercise.json. The former PDP
double limitation is resolved for component conformance. T03 remains wait for
current deployed PDP adoption, separately admitted client-side/audit custody,
actual Approval Engine deployment, and the scoped native OpenBao delivery proof.
### 2026-09-10 exact recipient enforcement
The factory runtime is now installed on workstation and Railiance at digest
`5371156d2027dde6e8f140cc0a1833c4e90b8c75b3bec862e05f06a957f5fd34`;
consume project evidence `2026-09-10-runtime-placement.json`. Native delivery
review exposed an unclosed local boundary: exec accepted any argv and inherited
all parent environment after catalog/action approval.
Implemented optional catalog exec_owner with exact command, private cwd, fixed
non-secret environment and file pins. The factory catalog is explicitly pending
and refuses before approval/backend. The complete binding digest travels in the
existing CheckRequest context and producer/approval join. Changes before or during
retrieval refuse launch; the actual child has closed stdin and receives no inherited
engine auth environment. Existing action/consume/state/backend gates remain.
361 tests passed. The extended disposable actual KeyCape/Approval Engine/Flex Auth
exercise passed all 18 checks, including changed-recipient replay refusal and
consume-before-synthetic-backend followed by actual child execution. Receipt:
`docs/evidence/2026-09-10-exec-owner-approval-exercise.json`; contract:
`docs/exec-owner-binding.md`. Synthetic backend/key/recipient and test operator
identity only; no native secret read, human approval or paid execution.
T03 remains wait for configured/pinned owner inputs and holder admission, wanted
CCR-2026-0019 operator-group/file-delivery return, INFD-WP-0001-T07/T08 real human
approval, audit custody and deployed services/PDP/native delivery. CCR-2026-0020
was cancelled on owner withdrawal; do not wait for or recreate its presenter.
No runtime artifact rebuild is needed for this credential-engine change.