coulomb/secrets-engine
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Add response-wrapped operator handoff
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
secrets-engine wrap writes a single-use OpenBao wrap token to a mode-0600
out-of-repo file and never prints it. KV reads and AppRole secret_ids are
wrapped with a 15m TTL cap. Unwrapped secret payloads fail closed.
Production wrap remains fail-closed.

Assistant: grok
Assistant-Session: 01a05f07-ae72-7781-9fcb-19efd61add00
This commit is contained in:
tegwick 2026-09-02 08:12:42 +02:00
parent 2278cefbb3
commit afd1c8e593
12 changed files with 387 additions and 8 deletions
Download patch file Download diff file Expand all files Collapse all files

2
tests/test_layer_conformance.py
View file

@ -172,12 +172,14 @@ def test_classify_does_not_grant_permission():
apply_prod = classify("apply", "prod")
heartbeat = classify("evidence-heartbeat", "prod")
session_revoke = classify("session-revoke", "prod")
wrap = classify("wrap", "prod")
assert prod_provision.kind == "load-bearing"
assert test_provision.kind == "attributive"
assert destroy.kind == "load-bearing"
assert apply_prod.kind == "attributive"
assert heartbeat.kind == "heartbeat"
assert session_revoke.kind == "load-bearing"
assert wrap.kind == "load-bearing"
assert prod_provision.completeness_claimed is False
assert CLASSIFICATION.exists()