coulomb/secrets-engine
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Name the secrets-engine-openbao consumer custody coordinates.
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
Adds the consumer custody packet for KEY-WP-0037-T02 / RPF-WP-0035-T02,
strict value-free client-secret file checks with a check-secret-file CLI,
synthetic tests, and SECRETS-WP-0012 tracking founder decisions and the
attended delivery as needs_human wait tasks.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 132360@bnt-lap001
Assistant-Session: 769b1afd-4330-4c86-96b2-e510e26db42b
This commit is contained in:
tegwick 2026-10-06 13:39:29 +02:00
parent be8fab0332
commit a3897c2317
6 changed files with 475 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

7
docs/service-auth.md
View file

@ -17,6 +17,13 @@ outside every Git worktree. It is sent with HTTP Basic authentication and never
placed in a request body, command argument, evidence record, or object
representation.
Since 2026-10-06 the file must also be a canonical regular file (no symlink
component) owned by the running user, in a parent directory owned by that
user with mode 0700, and hold exactly one token.
`secrets-engine service-auth check-secret-file [--path P] [--json]` reports
those checks without the value. Consumer host, path, delivery and lifecycle
coordinates: [keycape-openbao-consumer-custody.md](keycape-openbao-consumer-custody.md).
JWT payload parsing does not prove a signature. OpenBao must verify RS256
against the configured issuer before issuing a token. railiance-platform owns
the exact OpenBao JWT auth mount/role, issuer keys, claim bindings, token