coulomb/secrets-engine
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Harden production authorization and service auth
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a0217e-8c4c-7383-be6b-f50a6e485306
This commit is contained in:
tegwick 2026-08-23 14:15:42 +02:00
parent f579f3761c
commit 70371649af
20 changed files with 1268 additions and 54 deletions
Download patch file Download diff file Expand all files Collapse all files

36
workplans/SECRETS-WP-0007-production-lifecycle-hardening.md
View file

@ -198,15 +198,23 @@ Acceptance:
```task
id: SECRETS-WP-0007-T04
status: wait
status: progress
priority: high
```
Waiting 2026-08-23 on the canonical external contract rather than parsing
decision prose or inventing authorization ownership locally. Contract requests
were sent to State Hub (`24663321-0263-43fe-8d48-e9c7e06d7bb9`) and flex-auth
(`ef8ff95d-6b4e-46f8-b1a9-497d06cf7c9a`). Until resolved, local fixtures cannot
unlock the new destroy path and that live operation remains disabled.
Progress 2026-08-23. flex-auth revision `c473f19` now supplies execute-time
structured binding and the proposed durable `ActionAuthorization` schema. The
engine builds and fail-closed validates the exact secrets-engine profile,
validity, State Hub authority, decision digest/binding, accepted policy
revision, and a caller-selected minimum distinct-approver threshold. Every live
production handler now carries its action into the shared gate and fails before
OpenBao while State Hub lacks the durable endpoint. Legacy local decisions are
reachable for prod-labeled lanes only with an explicit unsafe-demo switch,
disabled Hub URL, and loopback OpenBao. The throwaway scripts declare that
exception. Live destroy remains disabled independently. State Hub endpoint and
authenticated approval storage are still outstanding; the flex-auth example's
committed digest was also found stale against its Go `CheckRequest` encoder and
must be corrected upstream.
Define and enforce the decision contract needed by production commands. A
resolved approval must bind at least:
@ -256,6 +264,13 @@ to railiance-platform (`8f910aff-3a94-43c6-8805-eb9276e46fc0`) and key-cape
(`0627ca55-115e-43dc-b2f6-3195be3bc90d`); steady-state engine authentication
remains external-contract work.
KeyCape has accepted the `secrets-engine-openbao` service contract. An explicit
consumer scaffold now performs HTTPS client-credentials exchange, strict
out-of-repo client-secret input, exact claim/assurance/lifetime preflight,
three-minute renewal classification, and rejection of ID/refresh tokens. It has
no bootstrap/operator/AppRole fallback and is deliberately not wired into the
CLI until railiance-platform materializes the exact OpenBao JWT mount and role.
Refactor AppRole login into a scoped session object that retains only the
minimum non-secret lifecycle handle needed to revoke the issued token in a
`finally` path. Apply it consistently to exec, KV verification, auth-capability
@ -304,8 +319,13 @@ rejection, backend/input exceptions, interruption, verification failure, and
success are recorded without exception prose. Tests prove decision and backend
failures stop before inappropriate backend work and exclude fake secret text.
The complete repository suite passes with 115 tests after these changes,
including throwaway OpenBao integration coverage.
State Hub evidence posts now carry stable idempotency, source-agent, and repo
headers. HTTP 202 edge-relay receipts are classified as `queued` and retain only
their non-secret outbox id in the companion evidence record and lane audit.
Outbox replay remains owned by State Hub/operator tooling.
The complete repository suite is re-run at each implementation slice, including
throwaway OpenBao integration coverage.
Make verification and routing truthful for multi-field and high-risk lanes: