coulomb/secrets-engine
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Read the secrets-engine-openbao client secret in memory from OpenBao
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 2s
Details

Browse source 
Founder direction 2026-10-06 and ops-mason plan
keycape-secrets-engine-openbao-client-custody (658cdbc): no workstation copy.
service-jwt now gets CLIENT_SECRET from platform/workloads/keycape/
secrets-engine-openbao through one attended OIDC login on
keycape-secrets-engine-openbao-operator-workload-kv-read (-no-store, token from
a pipe, header-only GET, unconditional revoke-self). The consumer file is
refused for this profile and kept for the approval client.
service-auth probe-openbao prints value-free first-use evidence.

SECRETS-WP-0012: T02 cancelled (D1-D4 superseded), T04 done, T03 is the
founder-run first live use. Synthetic tests only; 524 passed, 1 skipped.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 132360@bnt-lap001
Assistant-Session: 769b1afd-4330-4c86-96b2-e510e26db42b
This commit is contained in:
tegwick 2026-10-06 14:13:41 +02:00
parent 6941610b8d
commit b8094f701b
12 changed files with 688 additions and 185 deletions
Download patch file Download diff file Expand all files Collapse all files

53
workplans/SECRETS-WP-0012-keycape-openbao-consumer-custody.md
View file

@ -25,6 +25,12 @@ approved the two-copy custody boundary (decision
`632a8893-0d6a-4591-a50b-40bbdb798f32`), not generation, fetch, delivery,
registration or deployment. Live service-JWT adoption stays SECRETS-WP-0008-T06.
Redirected 2026-10-06: founder direction keeps the secret only in OpenBao, and
the ops-mason plan `keycape-secrets-engine-openbao-client-custody` (658cdbc)
replaces the consumer file with a per-command in-memory read (T02 cancelled,
T04 implements it, T03 is the first live use). T01's file checks remain for
the approval client only.
Packet: [docs/keycape-openbao-consumer-custody.md](../docs/keycape-openbao-consumer-custody.md).
## Consumer packet and strict file acceptance
@ -48,28 +54,51 @@ suite: 510 passed, 1 skipped (root-only owner test).
```task
id: SECRETS-WP-0012-T02
status: wait
needs_human: true
status: cancel
priority: high
blocked_on: founder
blocking_reason: "Host (workstation), OS user (worsch), persistent storage and rotation cadence are recommendations awaiting founder acceptance; the custody child cannot be finalized without them."
state_hub_task_id: "b95da704-ce13-5bf5-be3b-126e894a669d"
```
## Attended consumer-copy delivery
Cancelled 2026-10-06: superseded by founder direction 2026-10-06 (the client
secret lives only in OpenBao, no workstation copy) and the ops-mason plan
`keycape-secrets-engine-openbao-client-custody` (658cdbc, MASON-WP-0009).
D1-D4 (host, OS user, persistent file, rotation cadence) no longer apply.
## In-memory OpenBao secret source
```task
id: SECRETS-WP-0012-T04
status: done
priority: high
```
Done 2026-10-06. `service_auth.OpenBaoOidcClientSecretSource`: attended
`bao login -method=oidc -path=netkingdom -no-store -format=json` on role
`keycape-secrets-engine-openbao-operator-workload-kv-read`, token from a
stdout pipe, ambient `BAO_TOKEN`/`VAULT_TOKEN` stripped, header-only GET of
`platform/data/workloads/keycape/secrets-engine-openbao` field
`CLIENT_SECRET`, unconditional `revoke-self`, then the KeyCape exchange and
OpenBao JWT login. The file source is refused for this profile (kept for the
approval client). `secrets-engine service-auth probe-openbao` prints
value-free evidence. Synthetic tests: `tests/test_openbao_secret_source.py`.
Docs: `docs/keycape-openbao-consumer-custody.md` (rewritten),
`docs/service-auth.md`, `docs/cli.md`.
## First live attended use
```task
id: SECRETS-WP-0012-T03
status: wait
needs_human: true
depends_on: [SECRETS-WP-0012-T02]
priority: high
blocked_on: message-from:railiance-platform
blocking_reason: "Requires the founder-approved CCR-2026-0033 custody child, executed attended on the named host. Platform generates and writes both copies in one process. secrets-engine records only the check-secret-file result. No client-side OpenBao read."
blocked_on: founder
blocking_reason: "Founder runs the attended probe-openbao command in docs/keycape-openbao-consumer-custody.md after plan approval A1-A3, the revised CCR-2026-0033 objects applied by railiance-platform, the KeyCape registration live (KEY-WP-0037) and the JWT login contract published."
state_hub_task_id: "1c3afd34-4aa3-5484-a9c7-2db577225269"
```
Acceptance: receipt carries `check-secret-file --json` with `ok: true` and
no value, length or hash. A failed write leaves no consumer file and is
recovered by rotation, not by a KV read. First live exchange evidence belongs
to KEY-WP-0037-T04, and OpenBao login proof belongs to SECRETS-WP-0008-T06.
Acceptance: the one-line JSON from `service-auth probe-openbao --json` with
`ok: true`, `secret_source: openbao-oidc-in-memory`, both accessor
fingerprints and both revoke-self results true, recorded without any value,
token or full accessor. This is the evidence for KEY-WP-0037-T04,
RPF-WP-0035-T02 and plan verification item 6; OpenBao login proof also
closes into SECRETS-WP-0008-T06.