coulomb/secrets-engine
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix(auth): authenticate producer-signed decisions before authorization
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a140c4-354a-7823-8f0d-8f717397f786
This commit is contained in:
tegwick 2026-10-16 07:51:44 +02:00
parent 6bd7129eac
commit c80a944105
30 changed files with 2059 additions and 32 deletions
Download patch file Download diff file Expand all files Collapse all files

23
docs/pdp-access-path.md
View file

@ -132,3 +132,26 @@ The lesson worth keeping: the replay fixtures could not catch this, because
`_request_from()` rebuilds the request from the binding, so the tests hashed the
evaluator's output and compared it to the evaluator's output. Only a real
request through this access path exposed it.
## Mandatory responder authentication (WP14 source preparation)
Every serving `authorize_action` path requires `SECRETS_ENGINE_PDP_TRUST_FILE`
and `SECRETS_ENGINE_PDP_VERIFIER`. These fail closed before approval/PDP credential
access when a PDP path is configured. Trust must be an absolute regular JSON file,
not group/world writable, admitted independently of the responder or its keys
endpoint. Neither a loopback URL nor installing source admits production keys.
See `verifier/README.md` for build, source pin/update and installation requirements.
Trust schema `secrets-engine.pdp-trust.v1` requires exactly `schema`, `evaluator`,
`mode`, `policy_package`, `policy_version`, `policy_package_digest`, and `keys`
(a map of signer kid to base64url-unpadded Ed25519 public key). The producer has
no separate issuer or instance identifier: issuer binding is the admitted signer
plus signed provenance evaluator/mode; the exact policy coordinate and artifact
digest identify the admitted pin. Deployment key custody must scope the signer to
that responder; shared signing keys cannot prove a distinct pod identity.
Rotation is an explicit reviewed admission update: admit old/new keys for a bounded
overlap, switch producer signer, verify the actual consumer, then remove the old
kid and prove refusal. Keys are reloaded each call; no endpoint discovery, cached
key fallback, unsigned exception, or automatic admission exists. These source
checks do not constitute Platform key admission or native rollout acceptance.