coulomb/secrets-engine
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Document scope alignment and warden-sign readiness

Browse source
This commit is contained in:
tegwick 2026-06-30 00:52:05 +02:00
parent d8aadaffe3
commit ae685f3a0a
10 changed files with 736 additions and 41 deletions
Download patch file Download diff file Expand all files Collapse all files

31
INTENT.md
View file

@ -7,8 +7,9 @@
## One-liner
**secrets-engine is the secure interaction and automation layer for approved
secret custody, delivery, and lifecycle work across build, test, and production,
with OpenBao as the initial enforcement backend.**
secret custody, scoped OpenBao capability handoff, delivery, and lifecycle work
across build, test, and production, with OpenBao as the initial enforcement
backend.**
## Why This Exists
@ -26,8 +27,8 @@ already produced avoidable friction:
- build, test, and production need different levels of privilege and ceremony;
- secret values must never move through chat, Git, prompts, State Hub messages,
or workplans;
- ops-warden needs a reliable front door for credential use, not direct secret
custody responsibility.
- ops-warden needs a reliable front door for credential and scoped capability
use, not direct secret custody responsibility.
This repository exists to capture that complexity once, behind a stable and
auditable interface.
@ -36,10 +37,11 @@ auditable interface.
To provide a decision-aware secrets workflow that can:
- translate approved requests into narrowly scoped OpenBao changes;
- translate approved requests into narrowly scoped OpenBao changes or capability
grants;
- operate with distinct build, test, and production privilege layers;
- deliver secrets to commands and workloads without printing or storing raw
values in coordination systems;
- deliver secrets and scoped capabilities to commands and workloads without
printing or storing raw values in coordination systems;
- record enough non-secret evidence for review, audit, and troubleshooting;
- make routine secure work fast enough that operators and agents actually use
the secure path.
@ -55,7 +57,8 @@ not silently create new secret authority.
### 2. OpenBao Enforces, secrets-engine Orchestrates
OpenBao remains the vault, policy, lease, and audit backend. secrets-engine owns
the workflow, catalog, validation, delivery, and operator/agent interface.
the workflow, catalog, validation, delivery, scoped capability handoff, and
operator/agent interface.
### 3. Stage-aware Privilege
@ -97,11 +100,13 @@ has non-secret evidence that can be reviewed later.
secrets-engine is:
- a workflow layer for approved secret changes and access;
- a workflow layer for approved secret changes, scoped capability grants, and
access;
- a CLI and service API for operators, agents, and automation;
- a typed catalog of secret lanes, grants, delivery modes, and stage policies;
- a typed catalog of KV secret lanes, auth-capability lanes, grants, delivery
modes, and stage policies;
- an OpenBao policy/auth-role applier with strict local validation;
- an exec-time secret delivery helper;
- an exec-time secret delivery and scoped capability handoff helper;
- an audit evidence writer for State Hub and local logs;
- the credential interaction surface that ops-warden can route to.
@ -124,8 +129,8 @@ secrets-engine is not:
| Secret custody, leases, audit backend | OpenBao / railiance-platform | Use through least-privilege roles and validated paths. |
| Human and service identity | key-cape / user-engine | Consume identity claims; do not replace identity lifecycle. |
| Authorization decisions | flex-auth / State Hub decision model | Require and verify decisions before privileged actions. |
| SSH certificate issuance | ops-warden | Provide routed credential access; do not make ops-warden vend secrets. |
| Workload secret consumption | Workload repos / CI / runtime | Provide safe delivery contracts and catalog entries. |
| SSH certificate issuance | ops-warden | Provide routed credential/capability access; do not make ops-warden vend secrets. |
| Workload secret consumption | Workload repos / CI / runtime | Provide safe delivery and handoff contracts plus catalog entries. |
| Request history and progress | State Hub | Write non-secret evidence and decision links only. |
## Direction of Evolution