coulomb/secrets-engine
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

docs: record the end-to-end authorization proof in SECRETS-WP-0007-T04
Some checks are pending
CI Smoke / host-smoke (push) Waiting to run
Details
CI Smoke / container-smoke (push) Waiting to run
Details

Browse source 
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01M65ovP3eiiPHubibvWs9mD

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 393550@bnt-lap001
Assistant-Session: 4bb359f9-1f12-4410-9e76-079cf23c82e4
This commit is contained in:
tegwick 2026-09-06 14:56:21 +02:00
parent f62d3fe789
commit 64aeec921c
1 changed files with 36 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

36
workplans/SECRETS-WP-0007-production-lifecycle-hardening.md
View file

@ -453,6 +453,42 @@ class we had just been warning about.
one package covering all twelve actions. Do not build per-action pin
configuration for a distinction that does not exist.
Brought into practice 2026-09-06. The chain is complete in code and proven end
to end; what remains is deployment only.
- Step 2 is implemented (`decision_check.check_decision`, POST `/v1/check`) and
`approval_consume.authorize_action` coordinates steps 1 and 2. Both build the
same CheckRequest through one `_expected_request`, since two descriptions of
the proposed action cannot produce corresponding digests.
- `apply_unreachable_engine_stance` now takes `authorized=`. The published map
defines `fail_closed` as no protected side effect *without* a durable
access-engine decision record, so holding a validated one means the engine was
reachable and the residue does not apply. This is not a stance bypass: both
steps must have succeeded, CAS consume still precedes OpenBao, and with
nothing configured `authorize_action` returns `None` and production fails
closed exactly as before. Verified by CLI, not only by unit test.
- `tests/test_integration_authorization.py` drives the real gate through
claim -> check -> consume -> OpenBao against a live throwaway OpenBao, and
asserts PIP-before-PDP ordering, consume as the last step before the backend,
and that an unreachable PDP, a denied decision, an invalid claim, a missing
`pdp_digest`, a consume conflict, and an action mismatch each stop before the
backend. The stub serves transport and sequencing only; wire contracts stay
pinned to flex-auth's real fixtures.
- The end-to-end run found a third instance of the cross-vocabulary defect: a
leftover comparison of the claim's `binding.action` against ours. Real claims
say `secrets.kv.destroy` where we say `destroy`, so it would have failed
against every one of them. Removed; the tie is `pdp_digest`. Worth noting the
pattern: unit tests with self-consistent fakes hid all three, and each was
found only by a real artifact or a real chain.
Remaining to go live is configuration and deployment, not engine work:
`SECRETS_ENGINE_PDP_URL`/`_PDP_TOKEN_FILE` (awaiting the `flex-auth-secrets-engine`
pin, `FLEX-WP-0021-T04`/`T05`), `SECRETS_ENGINE_APPROVAL_URL`/`_TOKEN_FILE`
(awaiting `APPROVAL-WP-0002-T03`), the policy pin (published but not to be set
until T05), a KeyCape RS256 credential in place of the static Bearer token, and
`approval.authorization_id` on each lane. Destroy additionally needs the
vocabulary mapping or a `pdp_digest` guarantee.
Define and enforce the decision contract needed by production commands. A
resolved approval must bind at least: