coulomb/secrets-engine
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Prepare reviewed service JWT boundary verification and retain execution adoption gates

Browse source 
Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a126e1-76f8-7643-8cf3-e93336539ade
This commit is contained in:
tegwick 2026-10-11 14:11:59 +02:00
parent 443c2698c3
commit 4378ec1fc2
6 changed files with 551 additions and 7 deletions
Download patch file Download diff file Expand all files Collapse all files

25
workplans/SECRETS-WP-0008-layer-model-lifecycle-conformance.md
View file

@ -332,7 +332,7 @@ Acceptance:
id: SECRETS-WP-0008-T06
status: wait
depends_on: [RPF-WP-0035-T02]
blocking_reason: "Positive service-JWT login proof passed 2026-10-10 (SECRETS-WP-0012-T03, docs/evidence/2026-10-10-keycape-openbao-probe.json). Waits on railiance-platform closing RPF-WP-0035-T02 with the CCR-2026-0038 negative checks, then on routing live engine actions through service-jwt instead of bootstrap/env."
blocking_reason: "Published JWT contract and positive login/revocation are delivered. Native KEY-WP-0039-T02 claim negatives, CCR-2026-0038 effective-policy/capability/expiry/use checks and MASON-WP-0009-T05 remain. Login-self-only grants no protected-operation authority: agree and implement separately reviewed task-scoped backend execution entitlement, then prove functional steady-state service-identity adoption without bootstrap/env fallback."
priority: medium
state_hub_task_id: "d7bc8bdc-a0f8-5058-a640-374ef9859148"
```
@ -352,8 +352,10 @@ argv), then self-revokes. A JWT selection refuses `--bootstrap-token-file` and
does not read `BAO_TOKEN` on failure. `--bootstrap-token-file` is a named
break-glass provider with `auth_break_glass` evidence.
The platform-owned OpenBao JWT mount/role is still unpublished, so auto keeps
bootstrap/env and this task remains `wait`.
Historical 2026-09-02 state, superseded 2026-10-10: the platform-owned
OpenBao JWT mount/role was then unpublished. The consumer contract is now
published; native negative/capability checks and functional task-scoped backend
execution adoption remain open, so T06 remains `wait`.
Inbox triage 2026-09-21. railiance-platform `29cccf8a` (2026-09-09): status,
not a contract. Their side is RPF-WP-0035-T02 (design
@ -549,3 +551,20 @@ T06 still depends on RPF-WP-0035-T02, whose current file remains wait for live
platform service registration/custody and scoped JWT provisioning plus native
login, denial and revocation evidence. Source tenant corrections are complete.
The workplan is now blocked; no new task or workplan was created.
### 2026-10-11 final gate preparation
Completed preparation record: `docs/service-jwt-final-acceptance.md` and
`tools/verify_service_jwt_boundary.py`; synthetic acceptance tests cover added
identity policy, omitted deny, metadata failure, failed cleanup, redirects,
environment proxies, bounded transport, complete typed evidence, stale cleanup
claims and mutually exclusive backend error/data responses. The tool
default is backend-free and cannot claim native success. It prepares the exact
applied CCR capability batch and preserves the eight-use cleanup budget.
The actual CLI consumes approval before supplying its selected backend token.
The current service token grants self endpoints only, and no delegated backend
entitlement is implemented. Configuring auto now would not prove functional
protected-action adoption. T06 stays wait; no provider default, policy, secret,
live registration or owner acknowledgment changed. Existing live owner tasks
retain all remaining acceptance and execution entitlement work.