coulomb/secrets-engine
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Enforce companion-only credential delivery and refresh activation handoff
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 7s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a0e324-abce-7e51-bb2b-496f097afdb0
This commit is contained in:
tegwick 2026-09-27 15:58:53 +02:00
parent 303cbf652b
commit 5c6f2b319d
8 changed files with 150 additions and 24 deletions
Download patch file Download diff file Expand all files Collapse all files

44
workplans/SECRETS-WP-0011-multi-lane-exec-owner-delivery.md
View file

@ -9,7 +9,7 @@ flavor: implementation
owner: claude-code
topic_slug: netkingdom
created: "2026-09-23"
updated: "2026-09-23"
updated: "2026-09-27"
related_workplans:
- SECRETS-WP-0009
- HFACT-WP-0001
@ -93,7 +93,7 @@ a throwaway OpenBao dev server.
id: SECRETS-WP-0011-T04
status: wait
priority: high
blocking_reason: "Lane cataloged; token seeded (ACTIVITY-WP-0039-T03 done 2026-09-23). Waits on T04 cutover: railiance-platform store policy and founder go-ahead. Do not apply or deliver until activity-core reports the metered identity authenticates."
blocking_reason: "Activity Core reports ACTIVITY-WP-0039 finished and metered identity authentication proved (2026-09-24). Remaining: admit the configured Glas owner, obtain exact per-lane approvals, and perform attended native apply/verify/delivery under SECRETS-WP-0009-T03."
state_hub_task_id: "cf465065-de7a-5d9c-bc80-fee16ffef70d"
```
@ -131,3 +131,43 @@ approval). Not applied. Suite: 467 passed.
Founder go-ahead for ACTIVITY-WP-0039-T04 (ExternalSecret, multi-identity rollout, claim-loop restart)
relayed 2026-09-24 on activity-core thread `7b51d9c3`. Store policy was done 2026-09-23T18:06Z
(CCR-2026-0029/0030).
## Enforce companion-only delivery at both entry points
```task
id: SECRETS-WP-0011-T05
status: done
priority: high
```
Review on 2026-09-27 found that `companion_of` consent was checked when resolving
companions, but a caller could select that lane directly as the primary `exec`
lane with an arbitrary child. The delivery helper also accepted a supplied
companion list without comparing it with the pinned owner declaration.
Refuse standalone companion delivery before approval/backend/read. Require the
helper's supplied lane/field/environment list to match the owner declaration,
and recheck companion consent and stage before any value is read. Preserve
ordinary lanes and the configured multi-lane child. Regression tests cover both
entry points, omissions, additions, substituted lane/field/environment, revoked
consent and stage mismatch.
Validation: 476 tests passed, including disposable OpenBao integration tests;
layer conformance and `git diff --check` passed. No production credential was
requested or delivered.
## Activity Core handoff reviewed — 2026-09-27
Owner messages `a2eae5f8-60cf-499b-8f52-dd04ac407924` and
`bfef619d-53e0-4b4c-8b92-ef092450e4a1` report ACTIVITY-WP-0039 finished at
activity-core `54ab1e4`. The founder-run check on 2026-09-24 returned HTTP 200
for the metered identity on a no-match label, and HTTP 403 when that token
claimed the loop identity. The existing loop continued to claim with its own
fresh token. This is the owner's reported evidence, not a new live check here.
The former token seeding/store-policy/identity-rollout blocker is resolved.
T04 remains wait for native lane activation with SECRETS-WP-0009-T03: current
owner admission/pins, exact per-lane approvals and attended apply/verify/exec.
The draft binds `rein-aharness-metered@railiance01` and `hfact-metered`, matching
the handoff. No production policy, role, catalog binding or credential changed.