coulomb/secrets-engine
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

chore(registry,workplans): refresh reuse-surface entry; record WP14/WP15 upstream critical paths
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 3s
Details

Browse source 
Capability summary/artifacts now cover exec-file, wrap, rotate, lifecycle,
founder-signed trust admission and the service-JWT boundary verifier (maturity
unchanged). SCOPE exec block corrected. WP14/WP15 T04 notes name the upstream
decisions and owner tasks; NK49 pins confirmed unchanged at HEAD.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 17890@bnt-lap001
Assistant-Session: 7d96d43c-0154-4a22-af71-71c349ac6dc3
This commit is contained in:
tegwick 2026-10-21 08:41:59 +02:00
parent 0aeb5a29a9
commit 551dd76dc3
5 changed files with 50 additions and 9 deletions
Download patch file Download diff file Expand all files Collapse all files

4
SCOPE.md
View file

@ -386,8 +386,8 @@ type: security
title: AppRole-scoped exec delivery
description: Fetches one declared KV field through a lane AppRole and injects it into a child
process using exec-env or a temporary npm config, with output redaction, explicit scoped-token
self-revocation, and non-secret cleanup evidence. This is CLI-local delivery; exec-file, wrapping,
and service delivery are absent.
self-revocation, and non-secret cleanup evidence. Adapters: exec-env, npm-config, exec-file;
`wrap` provides response-wrapped operator handoff. This is CLI-local delivery; service delivery is absent.
keywords: [secrets, delivery, exec, npm, injection, redaction, openbao]
```