coulomb/secrets-engine
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat: add auth-capability lanes and pilot closeout

Browse source 
Add the warden-sign auth-capability lane, AppRole handoff, verification guards, docs, and tests.

Point the whynot-design pilot at the canonical decision and add the real publish closeout preflight/runbook.
This commit is contained in:
tegwick 2026-06-29 16:58:16 +02:00
parent a621fbaffd
commit 6382139890
27 changed files with 1455 additions and 107 deletions
Download patch file Download diff file Expand all files Collapse all files

16
.decisions/e6381a56-6b04-4fd5-b2de-f3ef59cde888.yaml Normal file
View file

@ -0,0 +1,16 @@
# Offline fallback mirror for the canonical State Hub decision.
#
# Normal production use should resolve this UUID from State Hub with source: hub.
# This file exists only so throwaway offline demos can run when
# SECRETS_ENGINE_HUB_URL is empty or State Hub is unreachable. NON-SECRET:
# contains no token value.
id: e6381a56-6b04-4fd5-b2de-f3ef59cde888
title: "Review CCR-2026-0001 corrected whynot-design npm publish token lane"
status: resolved
superseded_by: null
decided_by: "human"
review_url: "http://127.0.0.1:8000/decisions/e6381a56-6b04-4fd5-b2de-f3ef59cde888"
rationale: >-
APPROVE: We fixed the path using coulomb as the org/tenant. Approval covers
establishing the whynot-design npm publish lane metadata; it does not expose or
store the package token value.