coulomb/secrets-engine
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Add companion lanes to catalog-bound exec owners (SECRETS-WP-0011 T01-T03)
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 2s
Details

Browse source 
A configured exec owner may receive fields from other consenting kv lanes.
Each lane is gated, consumed and read through its own AppRole; any refusal
starts no child. Companions are part of the owner digest.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 226514@bnt-lap001
Assistant-Session: 26ba103d-05fe-45a1-9cd7-9475bf239df6
This commit is contained in:
tegwick 2026-09-23 17:27:09 +02:00
parent 452203b19b
commit bc58184d71
10 changed files with 449 additions and 29 deletions
Download patch file Download diff file Expand all files Collapse all files

4
SCOPE.md
View file

@ -114,6 +114,10 @@ operation or produce OpenBao audit-request correlation.
exact-value redaction.
- Undeclared fields and undeclared/unsupported exec modes are rejected before
value fetch.
- A configured exec owner may also receive companion lanes. Each companion lane
must consent with `companion_of`, is gated through its own approval and
consume, and is read through its own AppRole. A refusal on any lane starts no
child (`docs/exec-owner-binding.md`).
The OpenBao KV response is parsed in the parent process, so every field stored
at the path crosses that process boundary even though only the selected field is