coulomb/secrets-engine
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Refuse login-only protected execution before consuming approval
All checks were successful
CI Smoke / host-smoke (push) Successful in 1s
Details
CI Smoke / container-smoke (push) Successful in 2s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a126e1-76f8-7643-8cf3-e93336539ade
This commit is contained in:
tegwick 2026-10-11 14:19:30 +02:00
parent 4378ec1fc2
commit 97dfa5ea8f
5 changed files with 426 additions and 11 deletions
Download patch file Download diff file Expand all files Collapse all files

65
workplans/SECRETS-WP-0013-task-scoped-openbao-execution.md Normal file
View file

@ -0,0 +1,65 @@
---
id: SECRETS-WP-0013
type: workplan
title: "Design and prove task-scoped protected OpenBao execution"
domain: infotech
repo: secrets-engine
status: proposed
flavor: planning
owner: codex
topic_slug: netkingdom
created: "2026-10-11"
updated: "2026-10-11"
depends_on: []
---
Source-staged draft only; no owner acceptance or native authority inferred.
Existing SECRETS-WP-0008-T06 remains open for actual adoption. CCR38 is an
unchanged identity-only login and is not a protected execution entitlement.
## Define the exact mediated execution contract
```task
id: SECRETS-WP-0013-T01
status: progress
priority: high
```
Design SECRETS-EXEC-20261011-v1 in docs/task-scoped-openbao-execution-contract.md
binds action, target, payload/source digests, initiating identity, exact PDP/CAS,
owner-held ephemeral two-path token, bounded TTL/uses, durable admission and
cleanup. Independent Platform/Secrets Engine/identity/approval/PDP owner returns
are required. No foreign review is written by this draft.
## Prevent consumption without execution readiness
```task
id: SECRETS-WP-0013-T02
status: progress
priority: high
```
Staged local fail-closed guard rejects service-jwt protected actions before
approval consumption because no reviewed task-execution backend exists. Named
bootstrap/env paths and login-self probes remain distinct. Eight new readiness
tests plus 28 existing auth/consume/evidence checks pass (36 total). Owner review,
publication and native checkout verification remain pending; not marked done.
## Implement and prove one native metadata action
```task
id: SECRETS-WP-0013-T03
status: wait
depends_on: [SECRETS-WP-0013-T01, RPF-WP-0035-T12]
wait_reason: "Wait for independent execution-contract acceptance and Platform task-scoped entitlement design/materialization, then exact founder native go."
priority: high
```
After T01 independent owner acceptance, implement the narrow execute-ccr surface,
Platform task-grant mediator, bound policy package and admission ledger. Select
an actual unexecuted approved metadata CCR, exact founder go and attended owner
custody. Prove real protected effect, sibling/body/refusal/replay counterexamples
and confirmed revocation/cleanup. No applied CCR38 replay or broad default flip.
Native metadata proof does not certify provision/exec delivery or all T06 scope.
2026-10-11 source revision v2: qualified T03 dependencies point to the owning design and Platform execution-entitlement task. WP13 owns the missing task-scoped execution seam; WP8-T06 retains production adoption and its full workflow proof. Source publication and fixture checks do not imply native acceptance. Original v1 stage remains unchanged.