coulomb/secrets-engine
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Record inert native CLI source and configuration selection
All checks were successful
CI Smoke / host-smoke (push) Successful in 1s
Details
CI Smoke / container-smoke (push) Successful in 2s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a140c4-354a-7823-8f0d-8f717397f786
This commit is contained in:
tegwick 2026-10-16 20:58:30 +02:00
parent 3718e60d73
commit a4f1802b72
1 changed files with 30 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

30
workplans/SECRETS-WP-0014-pdp-transport-and-responder-authentication.md
View file

@ -190,3 +190,33 @@ production installation/trust/policy change or effect occurred. Native effect
coverage remains0/11 across10handlers; T02 progress/T03 wait and task-native
WP13/WP8 gates remain open. Published Access receipt-tool2b064ee and verified
source APIs do not substitute for the separately reviewed hardened native image.
2026-10-16 owner public-source selection for preparatory installation: select
runtime4dd004a/documentation3718e60 and the canonical offline release manifest
sha256:105dcebe6f03e9799f91ea75175e20500df2aa7f08b5e32d39c1c367593ca47e,
with public empty-key consumer baseline
sha256:72521ff7729f8ddf5176092f3949cd50ac5f9241b0a5d1d30f3c63ce1d83091b.
Select the fresh owner-controlled release prefix
`/home/worsch/.local/share/secrets-engine/releases/4dd004a22501-105dcebe6f03`
and config revision
`/home/worsch/.config/secrets-engine/native-lifecycle/lifecycle-20261016-pre-key-r1`.
Use the existing offline installer and fixed-helper CLI; verify the complete
owner-controlled parent chain and artifact set before installation. This closes
public runtime/config selection only; actual home installation is not yet made.
Fresh isolated install/help, ten catalog rows and real installed authorize_action
empty-key refusal before caller/socket access passed. All53 runtime source hashes
and complete consumerR1/PlatformP4/AccessrolloutR2 manifests matched. P4/R2 binds
the same baseline/policy/caller, projection8ce375f and separately pinned chartdc0420/
image84c78e0 OCI digest09a83b2. The historical P1/failed400 finding is superseded
only for this exact new source join, with old receipts preserved.
Secrets owns consumer/trust; Access workload/Helm; Platform custody/GitOps sync;
cluster runtime/storage/PV; founder the attended disposition. No native assent is
supplied: founder/expiry/approvedCCR/window remain null. Public custody return,
independent key-bearing successor admission, named-pod/runtime receipt, bounded
caller delivery and lifecycle capture/export scope remain outstanding. Approval,
backend/effects/readback/cleanup/WP13 grants remain separate. T02 stays progress,
T03 wait; TSA01/02/03 remain open, protected acceptance0/11sites across10handlers.
No credential/kubeconfig/private custody read, caller mint, live action, actual
home install or new authority occurred. Exact review/proof and concrete install
step: Custodian `secrets-native-admission-next/` within the2026-10-16 target wave.