coulomb/secrets-engine
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Prepare reviewed service JWT boundary verification and retain execution adoption gates

Browse source 
Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a126e1-76f8-7643-8cf3-e93336539ade
This commit is contained in:
tegwick 2026-10-11 14:11:59 +02:00
parent 443c2698c3
commit 4378ec1fc2
6 changed files with 551 additions and 7 deletions
Download patch file Download diff file Expand all files Collapse all files

6
docs/service-auth.md
View file

@ -36,8 +36,10 @@ policy, TTL/use limits, and cryptographic verification.
When `SECRETS_ENGINE_OPENBAO_JWT_LOGIN` names that contract, the CLI selects
`service-jwt` and logs in for one command, then self-revokes the OpenBao
token. Failure of that path never falls back to `--bootstrap-token-file`,
`BAO_TOKEN`, or AppRole. Until the contract is published, `--auth auto` keeps
those named providers and `--auth service-jwt` fail-closes. See
`BAO_TOKEN`, or AppRole. The platform contract was published 2026-10-10. Configured `--auth auto`
selects service-jwt; without that configuration it keeps bootstrap/env. The
current login-self-only token cannot perform protected lane operations;
functional adoption and task-scoped execution entitlement remain T06. See
[openbao-jwt-login.md](openbao-jwt-login.md).
Canonical provider contract: