coulomb/secrets-engine
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Add companion lanes to catalog-bound exec owners (SECRETS-WP-0011 T01-T03)
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 2s
Details

Browse source 
A configured exec owner may receive fields from other consenting kv lanes.
Each lane is gated, consumed and read through its own AppRole; any refusal
starts no child. Companions are part of the owner digest.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 226514@bnt-lap001
Assistant-Session: 26ba103d-05fe-45a1-9cd7-9475bf239df6
This commit is contained in:
tegwick 2026-09-23 17:27:09 +02:00
parent 452203b19b
commit bc58184d71
10 changed files with 449 additions and 29 deletions
Download patch file Download diff file Expand all files Collapse all files

4
tests/test_exec_delivery.py
View file

@ -48,7 +48,7 @@ def test_exec_env_injects_only_selected_declared_field(monkeypatch):
def fake_spawn(command, env, secret):
assert command == ["probe"]
assert secret == "test-secret-value"
assert secret == ["test-secret-value"]
assert env["SELECTED_VALUE"] == "test-secret-value"
assert "PRIMARY" not in env
return 0
@ -81,7 +81,7 @@ def test_exec_file_injects_path_not_value_and_unlinks(monkeypatch, tmp_path):
seen["contents"] = __import__("pathlib").Path(path).read_text()
seen["has_value_env"] = "API_TOKEN" in env
assert command == ["probe"]
assert secret == "test-secret-value"
assert secret == ["test-secret-value"]
return 0
monkeypatch.setattr("secrets_engine.exec_delivery._fetch_value", fake_fetch)