coulomb/secrets-engine
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Bind typed execution context across authorization requests
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a126e1-76f8-7643-8cf3-e93336539ade
This commit is contained in:
tegwick 2026-10-11 16:28:54 +02:00
parent e24437607b
commit d8edd9e516
6 changed files with 475 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

10
workplans/SECRETS-WP-0013-task-scoped-openbao-execution.md
View file

@ -35,6 +35,16 @@ owner-held ephemeral two-path token, bounded TTL/uses, durable admission and
cleanup. Independent Platform/Secrets Engine/identity/approval/PDP owner returns
are required. No foreign review is written by this draft.
2026-10-11 source-only preparation: typed execution_contract is staged through
all four request builders. The new descriptor is restricted to execute-ccr,
requires prod/platform/human control and binds the catalog fingerprint before
claim. Existing apply/other actions cannot borrow this descriptor. 99 focused
source checks verify propagation, canonical approval/full consume joins,
immutable copies and changed-binding refusals. Detailed schema/limitations are
in the execution-contract document. No source owner assent, initiating-principal
admission, new policy package, ledger/mediator/backend or native acceptance is
claimed. Independent source review remains required. Task statuses are unchanged.
## Prevent consumption without execution readiness
```task