coulomb/secrets-engine
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Close SECRETS-WP-0012-T03: service-JWT OpenBao login probe passed
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 2s
Details

Browse source 
Record the founder-run probe-openbao result as non-secret evidence,
finish SECRETS-WP-0012 and point SECRETS-WP-0008-T06 at the remaining
platform negative checks.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 544698@bnt-lap001
Assistant-Session: 279b8520-335f-4041-ba2a-9491335473db
This commit is contained in:
tegwick 2026-10-10 10:19:19 +02:00
parent 46f218b379
commit a963a77bc7
3 changed files with 47 additions and 7 deletions
Download patch file Download diff file Expand all files Collapse all files

36
docs/evidence/2026-10-10-keycape-openbao-probe.json Normal file
View file

@ -0,0 +1,36 @@
{
"status": "passed",
"phase": "first_live_attended_use",
"task": "SECRETS-WP-0012-T03",
"observed_at": "2026-10-10",
"operator": "founder (attended, KeyCape OIDC login with MFA)",
"command": "secrets-engine service-auth probe-openbao --json",
"bao_addr": "http://127.0.0.1:18200",
"login_contract": {
"file": "~/.secrets-engine/keycape/openbao-jwt-login.yaml",
"mount": "keycape-services",
"role": "secrets-engine-openbao",
"bound_issuer": "https://kc.coulomb.social",
"authority": "probe input per CCR-2026-0038 as amended (railiance-platform 93a4bc2)"
},
"result": {
"auth_provider": "service-jwt",
"established": true,
"ok": true,
"operator_revocation_attempted": true,
"operator_revocation_succeeded": true,
"operator_session_handle": "4e9c487b6206",
"revocation_attempted": true,
"revocation_succeeded": true,
"secret_source": "openbao-oidc-in-memory",
"session_handle": "0204e60340d2"
},
"notes": [
"Session handles are 12-hex-character SHA-256 fingerprints of accessors, not tokens or full accessors.",
"The client secret was read in memory from OpenBao through the operator OIDC session; no consumer file was used.",
"The bao CLI note that the token was not stored in the token helper is expected: the operator token stays in memory and was self-revoked.",
"This is the positive login proof only. The negative checks listed in CCR-2026-0038 remain with railiance-platform under RPF-WP-0035-T02."
],
"closes": ["SECRETS-WP-0012-T03"],
"evidence_for": ["KEY-WP-0037-T04", "RPF-WP-0035-T02", "ops-mason plan verification item 6", "SECRETS-WP-0008-T06"]
}

2
workplans/SECRETS-WP-0008-layer-model-lifecycle-conformance.md
View file

@ -332,7 +332,7 @@ Acceptance:
id: SECRETS-WP-0008-T06
status: wait
depends_on: [RPF-WP-0035-T02]
blocking_reason: "RPF-WP-0035-T02 awaits coordinated platform-tenant live registration, credential custody and scoped attended JWT role provisioning with native login/negative/revocation proof. The historical env-auth acceptance is not service-JWT adoption."
blocking_reason: "Positive service-JWT login proof passed 2026-10-10 (SECRETS-WP-0012-T03, docs/evidence/2026-10-10-keycape-openbao-probe.json). Waits on railiance-platform closing RPF-WP-0035-T02 with the CCR-2026-0038 negative checks, then on routing live engine actions through service-jwt instead of bootstrap/env."
priority: medium
state_hub_task_id: "d7bc8bdc-a0f8-5058-a640-374ef9859148"
```

16
workplans/SECRETS-WP-0012-keycape-openbao-consumer-custody.md
View file

@ -4,12 +4,12 @@ type: workplan
title: "KeyCape secrets-engine-openbao consumer custody acceptance"
domain: infotech
repo: secrets-engine
status: blocked
status: finished
flavor: implementation
owner: claude-code
topic_slug: custodian
created: "2026-10-06"
updated: "2026-10-09"
updated: "2026-10-10"
related_workplans:
- SECRETS-WP-0008
state_hub_workstream_id: "143de42b-b568-5070-add0-d5e71eabd436"
@ -89,11 +89,8 @@ Docs: `docs/keycape-openbao-consumer-custody.md` (rewritten),
```task
id: SECRETS-WP-0012-T03
status: wait
needs_human: true
status: done
priority: high
blocked_on: founder
blocking_reason: "All upstream objects are live: CCR-2026-0033 applied, KeyCape registration live (KEY-WP-0037), CCR-2026-0038 JWT mount keycape-services / role secrets-engine-openbao applied 2026-10-08 (railiance-platform 1b36e14). Probe input ~/.secrets-engine/keycape/openbao-jwt-login.yaml written 2026-10-09 with founder approval (mode 0600, parsed by the engine loader; allowed by CCR-2026-0038 as amended in railiance-platform 93a4bc2). Founder runs the attended probe-openbao command in docs/keycape-openbao-consumer-custody.md."
state_hub_task_id: "1c3afd34-4aa3-5484-a9c7-2db577225269"
```
@ -103,3 +100,10 @@ fingerprints and both revoke-self results true, recorded without any value,
token or full accessor. This is the evidence for KEY-WP-0037-T04,
RPF-WP-0035-T02 and plan verification item 6; OpenBao login proof also
closes into SECRETS-WP-0008-T06.
Result 2026-10-10: the founder ran the attended probe and it passed with
`ok: true`, `secret_source: openbao-oidc-in-memory`, both revoke-self results
true, and session handles `0204e60340d2` (service) and `4e9c487b6206`
(operator). Evidence: `docs/evidence/2026-10-10-keycape-openbao-probe.json`.
The CCR-2026-0038 negative checks remain with railiance-platform under
RPF-WP-0035-T02.