coulomb/secrets-engine
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

chore(registry,workplans): refresh reuse-surface entry; record WP14/WP15 upstream critical paths
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 3s
Details

Browse source 
Capability summary/artifacts now cover exec-file, wrap, rotate, lifecycle,
founder-signed trust admission and the service-JWT boundary verifier (maturity
unchanged). SCOPE exec block corrected. WP14/WP15 T04 notes name the upstream
decisions and owner tasks; NK49 pins confirmed unchanged at HEAD.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 17890@bnt-lap001
Assistant-Session: 7d96d43c-0154-4a22-af71-71c349ac6dc3
This commit is contained in:
tegwick 2026-10-21 08:41:59 +02:00
parent 0aeb5a29a9
commit 551dd76dc3
5 changed files with 50 additions and 9 deletions
Download patch file Download diff file Expand all files Collapse all files

14
workplans/SECRETS-WP-0014-pdp-transport-and-responder-authentication.md
View file

@ -134,6 +134,20 @@ work. A local signature test is not admission.
The approach is accepted. The remaining gate is the founder's actual signature over
the real trust file once FLEX-WP-0024-T06 delivers the key.
2026-10-21 upstream path (read-only survey; Access repo is `access-engine`). No key
exists yet. The order is:
1. Founder resolves decision 18731e84, the CCR-2026-0050 custody scope; that unblocks
RPF-WP-0035-T14. Access approved its side in railiance-platform b3f12b2.
2. Platform creates the key (CAS0, KV v1) and emits `signer-cas-receipt.v1`.
3. Founder gives the go on FLEX-WP-0024-T07 (decision 4fab263d) for the attended R2
signer window, kid `flex-auth-lifecycle-20261016-r1`.
4. Access runs `tools/prepare_signer_public_receipt.py`, which writes the exact
`pdp-trust.json` bytes.
5. This task: founder signature and root anchor install.
Access's trust-file projection matches `decision_signature.load_trust`: the same seven
keys, 32-byte base64url keys, and the same namespace. Its pin is
access-engine `docs/native-signer-public-pin.json`. No format work remains here.
## Verify the admitted native consumer and rotation path
```task

9
workplans/SECRETS-WP-0015-original-keycape-recovery-selector.md
View file

@ -159,3 +159,12 @@ new grant, live OpenBao read, backend write or retained-factor MFA is authorized
Return exact bounded evidence to NK49T36/T18; MFA remains NK49T19. Human gate is
never a worker wakeup. Cross-owner dependency is attached to derived case
secrets15-nk49-readiness in the packet; do not strand the wait or invent a driver.
2026-10-21 upstream path (read-only survey). NK-WP-0049-T33 waits on:
- T35 kc-tls owner metadata (railiance-cluster RCLUSTER-WP-0018-T02, todo).
- Founder decision 9f9d0d88 on T39 (ACME reissue vs. the original key).
- The attempt-host anchor (this task).
- NK49 attempt-assembly metadata: deadline, receipt location, verifier.
NK49-T40 carries the founder signature after T33. There is no pin drift: 0f44fbe..0aeb5a2
changed only this workplan, and the selector, service_auth.py and check tool hashes are
unchanged. Do not edit those files before the attempt, because any edit forces an NK49 re-pin.