coulomb/secrets-engine
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Implement GH-DEC-2026-003 consume-before-OpenBao PEP gate
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
Every live privileged production handler CAS-consumes through
approval-engine before OpenBao. Conflict, unavailability, or a missing
binding fail closed. Live production remains disabled until the durable
decision record is served.

Record kings-guard assent on the secret-use evidence contract.

Assistant: grok
Assistant-Session: 01a05f07-ae72-7781-9fcb-19efd61add00
This commit is contained in:
tegwick 2026-09-02 01:06:50 +02:00
parent 465c0d7049
commit 4b4d556d62
14 changed files with 724 additions and 20 deletions
Download patch file Download diff file Expand all files Collapse all files

9
workplans/SECRETS-WP-0007-production-lifecycle-hardening.md
View file

@ -8,7 +8,7 @@ status: active
owner: codex
topic_slug: custodian
created: "2026-08-23"
updated: "2026-08-29"
updated: "2026-09-02"
state_hub_workstream_id: "68a39be1-bd9c-5133-ad64-e7bca892aaf3"
---
@ -223,6 +223,13 @@ must serve the durable ActionAuthorization object. Paired with
`SECRETS-WP-0008-T02`. Do not reopen live production on hub status or local
fixtures.
Progress 2026-09-02. `GH-DEC-2026-003` consume-before-OpenBao is now a
shared production gate: `_require_lane_approval` CAS-consumes through
approval-engine before any OpenBao client is resolved. Tests prove 409,
unreachable, and missing-binding paths never call OpenBao. Live production
stays fail-closed until the durable object is served; this task remains
`wait`.
Progress 2026-08-23. flex-auth revision `c473f19` now supplies execute-time
structured binding and the proposed durable `ActionAuthorization` schema. The
engine builds and fail-closed validates the exact secrets-engine profile,

16
workplans/SECRETS-WP-0008-layer-model-lifecycle-conformance.md
View file

@ -8,7 +8,7 @@ status: active
owner: grok
topic_slug: custodian
created: "2026-08-29"
updated: "2026-08-29"
updated: "2026-09-02"
state_hub_workstream_id: "9c9e5164-b2f5-5ea2-a557-5368d65e9fe0"
---
@ -94,6 +94,15 @@ priority: high
state_hub_task_id: "3eb9cff8-1441-5437-9e92-a2b655c82d04"
```
Progress 2026-09-02. Gate House notice `632bdad9` (`GH-DEC-2026-003`): this
engine is the PEP for FLEX-WP-0017-T05 / OpenBao writes. The shared consume
function now lives in `src/secrets_engine/approval_consume.py` and every live
privileged production handler reaches it through `_require_lane_approval`
before `OpenBaoClient.resolve`. Conflict, unavailability, or a missing
binding fail closed with no OpenBao call. Production still also fail-closes
on the unpublished durable ActionAuthorization / consume-binding serving
path, so this task remains `wait`.
Blocked on the durable ActionAuthorization serving path owned with
`SECRETS-WP-0007-T04` / State Hub / `access-engine`.
@ -190,6 +199,11 @@ Completed 2026-08-29. Contract published at
`docs/secret-use-evidence-contract.md`. `layer.yaml` owner_status remains
proposed. `route`/`audit` are still not this surface.
**2026-09-02:** kings-guard assented in its own voice (message
`75ebd2cc-a166-4676-94aa-deef2791c0c9`). It will not consume the surface as
an observation input until the surface ships and publishes its cadence
declaration. No Tooling contact will be opened to fill that wait.
kings-guard's secret-abuse posture is fixture-driven because no engine exposes
lease, revocation, mount, rotation, and delivery-session metadata. `route` and
`audit` are operator summaries over local JSONL and are not that surface.