coulomb/secrets-engine
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix: confine PDP checks to the admitted local transport
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a12d13-27f2-7163-b8c0-f682af02772c
This commit is contained in:
tegwick 2026-10-12 08:27:37 +02:00
parent 0db6adef69
commit d379a3dfba
6 changed files with 268 additions and 50 deletions
Download patch file Download diff file Expand all files Collapse all files

77
workplans/SECRETS-WP-0014-pdp-transport-and-responder-authentication.md Normal file
View file

@ -0,0 +1,77 @@
---
id: SECRETS-WP-0014
type: workplan
title: "Constrain PDP transport and authenticate decision responses"
domain: infotech
repo: secrets-engine
status: active
owner: codex
topic_slug: secrets-engine
created: "2026-10-12"
updated: "2026-10-12"
flavor: implementation
depends_on: []
state_hub_workstream_id: "7252469d-d7a5-5c18-8911-b511b8c6a736"
---
Native owner work for CUST-WP-0080 G13. Reuses the accepted Check contract and
FLEX-WP-0024 producer signature surface; does not create another PDP or grant
any catalog-lane execution authority. SECRETS-WP-0013 still owns task-scoped
protected execution. Transport review is complete; key admission and native
rollout remain separate gates below.
## Prevent the Check credential from leaving the admitted local transport
```task
id: SECRETS-WP-0014-T01
status: done
priority: high
state_hub_task_id: "8baba9a3-3513-5f02-bafe-ed9dce743173"
```
Reproduced redirects (301/302/303), environment proxy forwarding, malformed URL
handling, oversized-body truncation and invalid UTF-8 against the prior source.
The bounded fix disables redirects and ambient proxies/global openers, requires
a literal loopback bare origin before credential access, caps the complete
response body and rejects invalid UTF-8 as a DecisionError. The approval consumer
no longer overrides this safe default with urlopen. Synthetic local-server tests
cover both entry points, all five redirect status codes and proxy forwarding.
No real credentials or protected backend were touched. Source verification is
recorded in the Custodian evidence directory for 2026-10-12, pdp-transport.json.
This closes the source transport defects only; T02/T03 remain mandatory.
## Implement independently anchored responder authentication
```task
id: SECRETS-WP-0014-T02
status: todo
priority: high
state_hub_task_id: "877782e5-045b-5186-8b95-82e25db21a5a"
```
Review producer canonical signature bytes and the native pin's unsigned/signed
mode. Establish independently admitted verification keys and exact issuer/pin
binding with AccessEngine and Platform; an unauthenticated keys endpoint on the
same responder is not a trust anchor. Reuse the native producer fixtures rather
than inventing a Python canonicalization. Require valid signed envelopes on the
production consumer path; prove forged allow, altered payload, unknown key,
wrong issuer/pin, unsigned/downgrade, expired and rotation overlap/refusal cases.
Track any temporary exception using all required SEC-DSM-EXC fields and actual
approval; neither source support nor a loopback URL is that approval.
## Verify the admitted native consumer and rotation path
```task
id: SECRETS-WP-0014-T03
status: wait
priority: high
depends_on: [SECRETS-WP-0014-T02]
blocking_reason: "Requires reviewed verification-key admission, source enforcement and exact native rollout receipt; no production trust change is proposed yet."
state_hub_task_id: "85aa4c78-b66d-5201-8e31-0ed50e7eaeec"
```
Under an exact reviewed rollout, prove the real pin and consumer accept the
admitted signer, reject forgery/downgrade, rotate without accepting removed keys,
and preserve request/approval binding, lifetime and single-use consumption.
Retain rollback and failure evidence. Update CUST-WP-0080 G13 only with these
native receipts; do not equate passing transport tests with closure.