coulomb/secrets-engine
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Name the secrets-engine-openbao consumer custody coordinates.
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
Adds the consumer custody packet for KEY-WP-0037-T02 / RPF-WP-0035-T02,
strict value-free client-secret file checks with a check-secret-file CLI,
synthetic tests, and SECRETS-WP-0012 tracking founder decisions and the
attended delivery as needs_human wait tasks.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 132360@bnt-lap001
Assistant-Session: 769b1afd-4330-4c86-96b2-e510e26db42b
This commit is contained in:
tegwick 2026-10-06 13:39:29 +02:00
parent be8fab0332
commit a3897c2317
6 changed files with 475 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

71
workplans/SECRETS-WP-0012-keycape-openbao-consumer-custody.md Normal file
View file

@ -0,0 +1,71 @@
---
id: SECRETS-WP-0012
type: workplan
title: "KeyCape secrets-engine-openbao consumer custody acceptance"
domain: infotech
repo: secrets-engine
status: blocked
flavor: implementation
owner: claude-code
topic_slug: custodian
created: "2026-10-06"
updated: "2026-10-06"
related_workplans:
- SECRETS-WP-0008
---
# SECRETS-WP-0012 - KeyCape secrets-engine-openbao consumer custody acceptance
Demand: KEY-WP-0037-T02 and RPF-WP-0035-T02 (proposed CCR-2026-0033) need
secrets-engine's source acceptance of the consumer copy of the
`secrets-engine-openbao` client secret: host, owner, path, mode, delivery,
rotation/revocation ownership and a bounded validation interface. The founder
approved the two-copy custody boundary (decision
`632a8893-0d6a-4591-a50b-40bbdb798f32`), not generation, fetch, delivery,
registration or deployment. Live service-JWT adoption stays SECRETS-WP-0008-T06.
Packet: [docs/keycape-openbao-consumer-custody.md](../docs/keycape-openbao-consumer-custody.md).
## Consumer packet and strict file acceptance
```task
id: SECRETS-WP-0012-T01
status: done
priority: high
```
Done 2026-10-06. The packet names the coordinates and marks D1-D4 as founder
decisions with recommendations. `service_auth.read_client_secret_file`
now refuses symlinked, foreign-owned, non-regular, shared-parent and
multi-token files in addition to the earlier mode, worktree and empty checks.
`secrets-engine service-auth check-secret-file` is the value-free validation
interface. Synthetic tests are in `tests/test_consumer_secret_file.py`. Full
suite: 510 passed, 1 skipped (root-only owner test).
## Founder decisions D1-D4
```task
id: SECRETS-WP-0012-T02
status: wait
needs_human: true
priority: high
blocked_on: founder
blocking_reason: "Host (workstation), OS user (worsch), persistent storage and rotation cadence are recommendations awaiting founder acceptance; the custody child cannot be finalized without them."
```
## Attended consumer-copy delivery
```task
id: SECRETS-WP-0012-T03
status: wait
needs_human: true
depends_on: [SECRETS-WP-0012-T02]
priority: high
blocked_on: message-from:railiance-platform
blocking_reason: "Requires the founder-approved CCR-2026-0033 custody child, executed attended on the named host. Platform generates and writes both copies in one process. secrets-engine records only the check-secret-file result. No client-side OpenBao read."
```
Acceptance: receipt carries `check-secret-file --json` with `ok: true` and
no value, length or hash. A failed write leaves no consumer file and is
recovered by rotation, not by a KV read. First live exchange evidence belongs
to KEY-WP-0037-T04, and OpenBao login proof belongs to SECRETS-WP-0008-T06.