coulomb/secrets-engine
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Document exact native signer and CLI admission requirements
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 2s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a140c4-354a-7823-8f0d-8f717397f786
This commit is contained in:
tegwick 2026-10-16 10:48:40 +02:00
parent ff1a13dabd
commit 5a2099f400
6 changed files with 351 additions and 36 deletions
Download patch file Download diff file Expand all files Collapse all files

13
src/secrets_engine/cli.py
View file

@ -119,13 +119,12 @@ def _require_lane_approval(
):
"""Apply published PEP stance, resolve lane approval, then CAS-consume.
Production ``fail_closed`` is read from ``pep-stance.yaml``. The durable
access-engine decision record is not served yet, so that row refuses live
production work. If that residue is ever bypassed, GH-DEC-2026-003 still
requires a successful approval-engine consume before any OpenBao call.
The three-factor unsafe-demo exception is not a stance row and is not a
consume path. Build/test ``fail_open`` still requires the existing
lane-approval check — a tracked gap until SECRETS-WP-0008-T02.
Production ``fail_closed`` is read from ``pep-stance.yaml``. A configured
serving path requires a fresh approval claim and independently authenticated
signed PDP envelope, then successful CAS before the backend. Missing runtime
trust/configuration still refuses production; source support is not native
admission. Build/test engine-unreachable residue retains the explicit legacy
lane check. The three-factor unsafe-demo exception grants no native adoption.
"""
# Steps 1 and 2 first: a validated claim and decision are what make the
# unreachable-engine residue inapplicable. Absent configuration returns