coulomb/secrets-engine
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Advance whynot pilot routing status

Browse source
This commit is contained in:
tegwick 2026-06-30 17:33:52 +02:00
parent dc2099b9f0
commit 7d09fc3aea
1 changed files with 29 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

30
workplans/SECRETS-WP-0003-pilot-closeout.md
View file

@ -140,6 +140,15 @@ whynot-design Gitea bot package token. Live provisioning remains waiting on an
operator-minted package token and approved OpenBao authority; no token value was
read or recorded.
2026-06-30: Implementation recheck after adjacent routing progress: the
approved apply dry-run is valid for policy/AppRole
`se-prod-whynot-design-npm-publish`, but live apply/provision was not executed
because the documented bootstrap file
`~/.secrets-engine/bootstrap/prod-whynot-design.token` and package-token handoff
file `~/.secrets-engine/handoff/whynot-design-npm.token` are both absent. The
route still reports `metadata_applied: false`, `value_present: false`, and
`ready: false`.
Operator mints a package token for the bot account and places it in a mode-0600
file outside any repo. Provision it with
`secrets-engine provision whynot-design-npm-publish --stage prod --field npm_token
@ -167,6 +176,16 @@ A real publish is still waiting on T02/T03 plus a coordinated version bump in th
external `whynot-design` repo and operator confirmation of the published package
version.
2026-06-30: Adjacent evidence moved forward: ops-warden message
`ca847936-e3ce-4a9a-b33a-bb283a06f663` reported `@whynot/design@0.4.0` was
published through the warden access proxy on the same routing lane, and the
public Gitea npm package endpoint reports `dist-tags.latest: 0.4.0`. This proves
the package-side publication exists, but it does not close this native
secrets-engine task: `secrets-engine route whynot-design-npm-publish --json`
still reports `metadata_applied: false`, `value_present: false`, and `ready:
false`, so OpenBao apply/provision plus native `secrets-engine exec` evidence
remain outstanding.
Publish a real version of `@whynot/design` to the coulomb Gitea npm registry via
`secrets-engine exec --catalog whynot-design-npm-publish -- npm publish` (no
`--dry-run`). Coordinate the version bump with the whynot-design repo.
@ -183,7 +202,7 @@ Acceptance:
```task
id: SECRETS-WP-0003-T05
status: progress
status: done
priority: medium
state_hub_task_id: "461a7854-6229-4bc1-8d94-f6e2c4e5fa79"
```
@ -194,6 +213,15 @@ whynot-design pointer payload and sent State Hub message
waiting on ops-warden updating/confirming its own routing catalog so
`warden route find "npm publish whynot-design"` resolves here.
2026-06-30: Confirmed the adjacent ops-warden routing update is live. `warden
route find "npm publish whynot-design" --json` returns the active
`whynot-design-npm-publish` entry with `warden_executes: false`, `exec_owner:
secrets-engine`, pointer command `secrets-engine route
whynot-design-npm-publish --json`, and exec command `secrets-engine exec
--catalog whynot-design-npm-publish -- <cmd>`. This satisfies the cross-repo
routing handoff; ops-warden routes the need here and does not need or store the
raw token.
Coordinate with the ops-warden repo so `warden route find` points npm publish
credential needs at secrets-engine, returning the `secrets-engine route` pointer
rather than a value. This is a handoff/coordination task; the route catalog entry