coulomb/secrets-engine
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Enforce companion-only credential delivery and refresh activation handoff
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 7s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a0e324-abce-7e51-bb2b-496f097afdb0
This commit is contained in:
tegwick 2026-09-27 15:58:53 +02:00
parent 303cbf652b
commit 5c6f2b319d
8 changed files with 150 additions and 24 deletions
Download patch file Download diff file Expand all files Collapse all files

20
workplans/SECRETS-WP-0009-glas-claude-native-delivery.md
View file

@ -8,7 +8,7 @@ status: blocked
flavor: implementation
owner: codex
created: "2026-09-05"
updated: "2026-09-21"
updated: "2026-09-27"
state_hub_workstream_id: "40ccc3b4-d046-5a58-8649-e7935f45c974"
---
@ -50,7 +50,7 @@ synthetic exec-env transport proof passed; no real secret was read.
id: SECRETS-WP-0009-T03
status: wait
priority: high
blocking_reason: "Shared native chain proved by SECRETS-WP-0010-T03 (2026-09-16): Approval Engine, CCR-2026-0019 reader, requester client, Informed Decision human review, current PDP. Lane-specific residue: operator inputs (placement, spend envelope/model bounds, unrelated negative identity), private SpendPolicy/ledger and owner config (HFACT-WP-0001-T01/T04), configured exec_owner, three human approvals, attended apply/verify/exec/revoke."
blocking_reason: "Shared native chain proved by SECRETS-WP-0010-T03. Metered owner provisioned and binding drafted (2026-09-23); Activity Core reports identity live (2026-09-24). Remaining: current recipient/pin admission, unrelated negative identity, configured exec_owner, exact per-action/per-lane approvals and attended apply/verify/exec/revoke."
state_hub_task_id: "f8069c8a-ad6b-5d0b-9a36-c2326699437d"
```
@ -487,3 +487,19 @@ that it answers before the attended session.
Founder decision 2026-09-23, relayed to activity-core (thread `a5449d3f`): the claim-loop token is
minted fresh with a coordinated claim-loop restart, not moved (ACTIVITY-WP-0039-T03).
### 2026-09-27 Activity Core dependency resolved
Activity Core's 2026-09-24 handoff (`a2eae5f8`, `bfef619d`; source `54ab1e4`)
reports the metered identity live, HTTP 200 for its own no-match claim and HTTP
403 for a claim as the loop identity. SECRETS-WP-0011 records that return and
corrects its former wait reason. The drafted worker identity and label match.
This resolves the seed/rollout prerequisite in the 2026-09-23 note. It does not
activate the native lane. T03 still needs current recipient admission and file
pin validation, exact approvals for each protected action/lane, and attended
native apply, positive/negative verification, exec and session revocation.
The production catalog remains pending. The companion-only delivery guards
added under SECRETS-WP-0011-T05 must be included in the host checkout used for
activation. No credential read, queue claim or paid run occurred in this review.