coulomb/secrets-engine
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Add native rotate and persistent lane overlay states
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
rotate replaces one declared KV field through the merge-safe patch path
and never prints the value. Overlay states active/suspended/deactivated/
compromised live under the evidence directory. compromise/reactivate and
successful suspend/deactivate/revoke update that overlay; exec/wrap/
handoff/provision refuse non-active lanes. Provider-side rotation stays
with rotation.owner. Production remains fail-closed.

Assistant: grok
Assistant-Session: 01a05f07-ae72-7781-9fcb-19efd61add00
This commit is contained in:
tegwick 2026-09-02 13:09:10 +02:00
parent 85d4548035
commit 72d3327c28
12 changed files with 596 additions and 20 deletions
Download patch file Download diff file Expand all files Collapse all files

4
tests/test_layer_conformance.py
View file

@ -173,6 +173,8 @@ def test_classify_does_not_grant_permission():
heartbeat = classify("evidence-heartbeat", "prod")
session_revoke = classify("session-revoke", "prod")
wrap = classify("wrap", "prod")
rotate = classify("rotate", "prod")
compromise = classify("lifecycle-compromise", "prod")
assert prod_provision.kind == "load-bearing"
assert test_provision.kind == "attributive"
assert destroy.kind == "load-bearing"
@ -180,6 +182,8 @@ def test_classify_does_not_grant_permission():
assert heartbeat.kind == "heartbeat"
assert session_revoke.kind == "load-bearing"
assert wrap.kind == "load-bearing"
assert rotate.kind == "load-bearing"
assert compromise.kind == "load-bearing"
assert prod_provision.completeness_claimed is False
assert CLASSIFICATION.exists()