coulomb/secrets-engine
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Answer the exec-path question: the front door reads the ungoverned duplicate.

Browse source 
ops-warden and railiance-platform asked, independently, which OpenBao location
`secrets-engine exec --catalog whynot-design-npm-publish` reads. Answered from
this repository's own code and catalog with no OpenBao read and no value.

It reads `secret/coulomb/whynot-design/npm/publish` — the legacy, ungoverned
duplicate. `_fetch_value` concatenates the catalog's `mount` and `path` with no
override or fallback, so the proven pilot published from the duplicate and the
lowercase `npm_token` field is the field there. ops-warden's front door names
this repository as exec_owner, so it currently routes callers at a path no CCR
covers.

Recorded in SECRETS-WP-0006 with what a move to the governed lane requires, and
flagged that the duplicate must not be destroyed until the lane moves. Whether
the two locations hold the same value is a value comparison and is not answered
here.

Also records GH-DEC-2026-017 against SECRETS-WP-0008: INTENT.md governs, the
sidecar is derived, the vocabulary is case-insensitive so nothing is re-spelled,
and standard_version comes out of layer.yaml once ops-warden updates the
reference form this repository copied.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 63291@bnt-lap001
Assistant-Session: 8bd77868-ca68-4f49-bb1e-d539ecc0d703
This commit is contained in:
tegwick 2026-09-21 02:36:31 +02:00
parent e5672846ab
commit 550ba95a67
3 changed files with 162 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

15
docs/whynot-design-real-publish-closeout.md
View file

@ -17,10 +17,23 @@ prompts, workplans, or normal logs.
| Org/repo | `coulomb/whynot-design` |
| npm package | `@whynot/design` |
| npm registry | `https://forgejo.coulomb.social/api/packages/coulomb/npm/` |
| Catalog mount/path | `secret/coulomb/whynot-design/npm/publish` |
| Catalog mount/path | `secret/coulomb/whynot-design/npm/publish` **(ungoverned legacy — see below)** |
| Catalog field | `npm_token` |
| Injected env var | `NPM_AUTH_TOKEN` |
> **Governance status, 2026-09-21.** The catalog mount/path above is the
> location `secrets-engine exec` actually reads — confirmed from
> `exec_delivery._fetch_value`, which concatenates `entry.mount` and
> `entry.path` with no override — and it is the **ungoverned duplicate**. The
> governed lane is `platform/workloads/coulomb/whynot-design/npm-publish` under
> CCR-2026-0001, field `NPM_AUTH_TOKEN`. The lowercase `npm_token` in the table
> above is the field at the legacy path, which is why the two records disagreed
> without either being wrong. Moving to the governed path is a reviewed lane
> change with its own approval; the steps are recorded in
> `workplans/SECRETS-WP-0006-catalog-lane-adoption.md` (2026-09-21). Until that
> move completes and re-verifies, the legacy path must not be destroyed or
> wrapped — it is the live publish path.
The decision UUID above is resolved from State Hub in normal operation. A
UUID-named local fixture exists only as an offline fallback for throwaway demos.