coulomb/secrets-engine
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix(auth): authenticate producer-signed decisions before authorization
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a140c4-354a-7823-8f0d-8f717397f786
This commit is contained in:
tegwick 2026-10-16 07:51:44 +02:00
parent 6bd7129eac
commit c80a944105
30 changed files with 2059 additions and 32 deletions
Download patch file Download diff file Expand all files Collapse all files

22
workplans/SECRETS-WP-0014-pdp-transport-and-responder-authentication.md
View file

@ -8,7 +8,7 @@ status: active
owner: codex
topic_slug: secrets-engine
created: "2026-10-12"
updated: "2026-10-12"
updated: "2026-10-16"
flavor: implementation
depends_on: []
state_hub_workstream_id: "7252469d-d7a5-5c18-8911-b511b8c6a736"
@ -44,7 +44,7 @@ This closes the source transport defects only; T02/T03 remain mandatory.
```task
id: SECRETS-WP-0014-T02
status: todo
status: progress
priority: high
state_hub_task_id: "877782e5-045b-5186-8b95-82e25db21a5a"
```
@ -59,6 +59,24 @@ wrong issuer/pin, unsigned/downgrade, expired and rotation overlap/refusal cases
Track any temporary exception using all required SEC-DSM-EXC fields and actual
approval; neither source support nor a loopback URL is that approval.
2026-10-16 source preparation: production `authorize_action` now requires an
independently admitted local trust file and installed verifier before approval/PDP
credential reads. The Go helper vendors exact producer API/signature sources,
checks source hashes, authenticates the original response and returns only its
verified typed interpretation. Signed evaluator/mode and exact package/version/
artifact digest are bound to admitted public keys. Unknown/unsigned/altered
responses refuse; existing request/approval/lifetime/CAS checks remain required.
Native replay, real producer signing and consumer-boundary tests cover downgrade,
issuer/pin, request joins, and distinct-key overlap/removal. Build/install and
source update procedures are documented in `verifier/README.md`.
This is an isolated source implementation awaiting integration/independent review.
No production verification keys, native pin signed-mode change, trust admission,
owner assent or rollout has occurred. T02 stays progress because independent
key admission remains part of its scope; T03 stays wait. WP13 execution and
identity-only CCR38 are unchanged. Custodian source/verification handoff:
`docs/changes/netkingdom-target-2026-10-16/decision-auth/` in the Custodian repo.
## Verify the admitted native consumer and rotation path
```task