coulomb/secrets-engine
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Document exact native signer and CLI admission requirements
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 2s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a140c4-354a-7823-8f0d-8f717397f786
This commit is contained in:
tegwick 2026-10-16 10:48:40 +02:00
parent ff1a13dabd
commit 5a2099f400
6 changed files with 351 additions and 36 deletions
Download patch file Download diff file Expand all files Collapse all files

12
workplans/SECRETS-WP-0014-pdp-transport-and-responder-authentication.md
View file

@ -102,3 +102,15 @@ admitted signer, reject forgery/downgrade, rotate without accepting removed keys
and preserve request/approval binding, lifetime and single-use consumption.
Retain rollback and failure evidence. Update CUST-WP-0080 G13 only with these
native receipts; do not equate passing transport tests with closure.
2026-10-16 native preparation (no rollout): `docs/proposals/native-cli-admission/`
now scopes the existing CLI/lifecycle signer stage, exact delegated PEP denominator,
independent key/policy admission, owner-controlled bundle/config placement and
rotation/rollback refusal. Canonical ff1a13d (packaging plus strict handoff) was
rebuilt in an isolated clean checkout; artifact receipts are in Custodian
`decision-native-preparation/`. Production kid/public fingerprint/custody receipt,
producer candidate OCI and actual runtime/config placement remain missing. The
empty-key trust template deliberately refuses. No install, key read, caller mint,
protected effect, policy switch or trust admission occurred. T02 remains progress,
T03 wait; task source/live obligations remain separately in SECRETS-WP-0013.