coulomb/secrets-engine
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

docs(recovery): deliver isolated original consumer custody plan
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a1468b-63fa-7710-85dc-8f2e16b3ebfa
This commit is contained in:
tegwick 2026-10-17 04:23:03 +02:00
parent c59bbf568c
commit 691dc74236
2 changed files with 130 additions and 15 deletions
Download patch file Download diff file Expand all files Collapse all files

46
workplans/SECRETS-WP-0015-original-keycape-recovery-selector.md
View file

@ -4,7 +4,7 @@ type: workplan
title: "Prepare original KeyCape service selector and isolated consumer continuity"
domain: infotech
repo: secrets-engine
status: ready
status: active
owner: codex
topic_slug: custodian
created: "2026-10-17"
@ -17,8 +17,9 @@ state_hub_workstream_id: "68a0642e-4908-5260-89c9-3adce60e6a4d"
Needed source-owner work for NK-WP-0049-T36/T18. Reviewed against current
Lifecycle INTENT, explicit consumer constants/custody source and dated historical
proof. Ready means work can proceed, not native assent. Finished0012 remains
finished; functional adoption/backend entitlement stay0008T06/0013. No new grant,
proof. Active records the delivered source plan and remaining native owner wait;
it is not native assent. Finished0012 remains finished; functional adoption/backend
entitlement stay0008T06/0013. No new grant,
secret fetch, provider login, production redirect or external message occurred.
## Establish exact current intended source selector
@ -61,22 +62,37 @@ is source correspondence, not native acceptance or a new secret source.
```task
id: SECRETS-WP-0015-T03
status: todo
status: done
priority: high
assignee: codex
state_hub_task_id: "6262a915-7655-50be-b9f7-481f816d7335"
```
Next: map the exact original archive-delivered registration and producer-native
checker result to the intended consumer, then prepare a source-reviewed isolated
proof/custody plan. Current consumer source requires attended OpenBao memory read
and refuses files; ordinary OpenBao/KeyCape outage is therefore a real dependency.
Do not add a fallback, persistent consumer copy or unreviewed injection source.
Clarify which continuity claim can be proved offline and which requires an exact
accepted owner custody/provider path. Bind current original selectors, image/
source/TLS metadata, negative cases, timeout/abort and cleanup; retain protected
backend operation entitlement in existing0008/0013. Done when that exact plan and
remaining owner dependencies are reviewable, without retrieving any value.
Completed 2026-10-17 as source-plan preparation only. The reviewed owner plan
is [keycape-isolated-consumer-continuity-plan.md](../docs/keycape-isolated-consumer-continuity-plan.md),
bound to the frozen Custodian `consumer-outage-r1` packet. It distinguishes the
restored original issuer check, exact Secrets consumer claim compatibility and
actual original OpenBao consumer continuity, preserving the no-file/no-fallback
client-secret source contract. Offline founder authority, original TLS/private
admission, exact source/runtime/receipt interfaces, positive/negative/equality
oracles, timeout, abort and cleanup requirements are reviewable. The plan's done
criterion is met; no native or private custody dependency is represented as done.
The packet includes an unexecuted-on-real-input one-shot claim observer candidate;
it is not wired into recovery or ordinary service authentication. Five synthetic
tests pass, including seven explicitly noncryptographic claim-parser negatives
and source/input refusal checks. The existing exact-source selector preflight
passes. These source checks establish neither token signature/native provenance
nor client-secret acquisition, OpenBao login, backend entitlement or downstream
reconnect. No private archive, original token/key, OpenBao endpoint or native
approval was accessed. Source integration/publication/projection are separate
coordinator follow-through; the immutable packet retains source hashes and limits.
Remaining actual owner dependencies are explicit in the plan and T04: NK49T33
complete original TLS/archive/private admission; an independently recovered
original OpenBao and its custody/OIDC/MFA graph for full consumer continuity;
exact native action approval and resource-server negative/revocation receipts.
Protected backend operation entitlement stays in existing0008T06/0013.
## Verify the separately admitted actual isolated consumer result
@ -87,7 +103,7 @@ priority: high
assignee: codex
needs_human: true
depends_on: [SECRETS-WP-0015-T03, NK-WP-0049-T33]
blocking_reason: "Await exact consumer proof/custody plan plus original TLS/private admission readiness; actual attended owner path/authority remains required."
blocking_reason: "Source plan delivered in T03. Await NK-WP-0049-T33 original TLS/archive/private admission, exact native owner authority, and original OpenBao/custody recovery for actual consumer continuity."
state_hub_task_id: "aeec6eb0-39e2-5f7c-8f5d-778133edfc73"
```