coulomb/secrets-engine
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat: implement the PIP claim + validate authorization join
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 2s
Details

Browse source 
resolve_consume_binding was a `return None` stub, so protocol step 1 of
docs/approval-consumption.md (GET /v1/approvals/{id}/claim) and the
validation join never existed. validate_action_authorization had no caller
in src/ at all - it was reachable only from tests. Production fail-closed
was correct, but for an undocumented second reason, and WP-0007-T04's
"what remains is not local engine work" was wrong.

The join now reproduces the exact CheckRequest via build_action_request,
fetches the durable ActionAuthorization, and validates request binding,
digest, validity, authority, policy pin, and distinct-approver threshold
before offering a consume binding. _require_lane_approval threads the exact
field set for provision/rotate/verify/exec so the digest covers the real
proposed action.

Deliberate choices:
- The approval-engine object id is never inferred from a State Hub decision
  UUID; flex-auth stated GET /decisions/{uuid} is not the durable object.
- No default policy pin. flex-auth stated secrets-engine.lifecycle/v1 is
  example vocabulary, not a published package.
- A half-configured join raises rather than returning None, so a partial
  deployment cannot be mistaken for an unconfigured one.

Behavior is unchanged today: every new input is absent by default, so
production still fails closed and plan/--dry-run still work. 234 tests pass.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01M65ovP3eiiPHubibvWs9mD

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 393550@bnt-lap001
Assistant-Session: 4bb359f9-1f12-4410-9e76-079cf23c82e4
This commit is contained in:
tegwick 2026-09-06 01:01:55 +02:00
parent ebcc36ecab
commit 627810b478
10 changed files with 456 additions and 25 deletions
Download patch file Download diff file Expand all files Collapse all files

10
workplans/SECRETS-WP-0008-layer-model-lifecycle-conformance.md
View file

@ -8,7 +8,7 @@ status: active
owner: grok
topic_slug: custodian
created: "2026-08-29"
updated: "2026-09-02"
updated: "2026-09-06"
state_hub_workstream_id: "9c9e5164-b2f5-5ea2-a557-5368d65e9fe0"
---
@ -103,6 +103,14 @@ binding fail closed with no OpenBao call. Production still also fail-closes
on the unpublished durable ActionAuthorization / consume-binding serving
path, so this task remains `wait`.
Correction 2026-09-06. See `SECRETS-WP-0007-T04` for the full note. Summary: the
consume-before-OpenBao gate was real, but the PIP claim + validate join was a
`return None` stub and `validate_action_authorization` had no production caller,
so this task's "blocked on the durable serving path" framing hid an unimplemented
local seam. The join is now implemented and tested; the remaining blocker is
genuinely external (approval-engine claim endpoint and access-engine Check, both
unreachable as of 2026-09-06).
Blocked on the durable ActionAuthorization serving path owned with
`SECRETS-WP-0007-T04` / State Hub / `access-engine`.