coulomb/secrets-engine
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Implement exec-file delivery
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
Write the selected field to a mode-0600 temp file, inject FIELD_FILE for
the child only, then overwrite and unlink on every exit path. The value
is not copied into the child environment.

Assistant: grok
Assistant-Session: 01a05f07-ae72-7781-9fcb-19efd61add00
This commit is contained in:
tegwick 2026-09-02 08:59:56 +02:00
parent afd1c8e593
commit ce1790f267
7 changed files with 126 additions and 19 deletions
Download patch file Download diff file Expand all files Collapse all files

5
workplans/SECRETS-WP-0006-catalog-lane-adoption.md
View file

@ -8,7 +8,7 @@ status: active
owner: codex
topic_slug: custodian
created: "2026-08-21"
updated: "2026-08-21"
updated: "2026-09-02"
state_hub_workstream_id: "31f7f8ea-7f73-516c-8877-f03a13f1db82"
---
@ -49,7 +49,8 @@ The current implementation is generic at the catalog level for KV
`mount`/`path`/`fields`, and `secrets-engine exec` supports `exec-env` plus the
npm-specific `npm-config` adapter. The remaining delivery-mode names are not all
exec adapters: `read-check` is verification, `approle-login` is auth-capability
handoff, and `exec-file`/`wrapped` are not yet implemented by `exec`.
handoff. `exec-file` is implemented by `exec`; `wrapped` operator handoff is
`secrets-engine wrap`, not an exec adapter.
## Design constraints