coulomb/secrets-engine
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Verify normalized task approval facts and preserve signed source types
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a140c4-354a-7823-8f0d-8f717397f786
This commit is contained in:
tegwick 2026-10-16 17:28:03 +02:00
parent 5a2099f400
commit 4dd004a225
18 changed files with 756 additions and 60 deletions
Download patch file Download diff file Expand all files Collapse all files

20
docs/task-scoped-openbao-execution-contract.md
View file

@ -65,7 +65,7 @@ before observing the claim or calling Check. Its fields are:
| source_bundle | Absolute owner-resolved files and immutable SHA256 hashes for engine dispatcher, Platform mediator, typed CCR module and policy/auth source |
| backend_origin / cluster_uid | Exact reviewed estate OpenBao origin and railiance01 identity |
| operations | Ordered exact HTTP method, normalized path and canonical JSON/text payload hash for each read/write/readback; no user supplied body |
| operation_deadline | Upper bound no later than approval, PDP or task-token expiry |
| operation_deadline | Upper bound no later than approval, PDP, caller and original/fresh source validity; task-token expiry may be earlier |
| backend_budget | TTL at most 120s, at most twelve uses, no renew/child/wrap/unlimited uses |
| expected_before / expected_after | Owner-authenticated revision/state digests, never secret contents |
@ -158,10 +158,20 @@ validation while Platform owns its OpenBao credential and typed native primitive
Task-token use budget is declared before issuance: two before-state reads, two
writes, two readbacks and one self-revoke (seven uses), plus at most four explicit
metadata capability checks and one reserved cleanup use (twelve total). Failed
backend calls count; never retry to evade limits. Task TTL is
`min(120s, approval_remaining, decision_remaining, operation_remaining)` minus
the declared clock uncertainty/cleanup reserve. Reject if fewer than 30s remain
for planned requests. No renewal or remint extends the operation. CCR38 keeps its
backend calls count; never retry to evade limits. The immutable
`backend_budget.ttl_seconds` declares the requested task-token TTL (30–120s).
The native adapter does not dynamically recompute or shorten that declaration.
Before issuance, conservatively require at least the declared TTL plus the 5s
cleanup reserve within the remaining operation/approval/PDP authority, including
clock uncertainty. The requested and explicit maximum native token TTL equal
the declared budget; returned native TTL must be positive and at most that budget.
The token can expire before the operation deadline; failure or expiry stops work
without remint. The signed operation deadline remains no later than approval,
PDP, authenticated caller and both original/fresh source validity. Access's
trusted source path independently requires the same TTL-plus-5s fit after source
I/O and an operation interval no longer than 120s. Therefore a structural 120s
backend budget cannot fit inside a 120s authority interval with the reserve and
refuses. No renewal or remint extends the operation. CCR38 keeps its
own 300s/eight-use limit; login-self checks and revoke fit its separate budget.
## Failure, replay and recovery