coulomb/secrets-engine
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Finish companion catalog work and reconcile completed approval tasks
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 4s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a0e324-abce-7e51-bb2b-496f097afdb0
This commit is contained in:
tegwick 2026-09-27 16:15:01 +02:00
parent 41e4c4a3d8
commit e33f9c3ca5
18 changed files with 472 additions and 87 deletions
Download patch file Download diff file Expand all files Collapse all files

31
workplans/SECRETS-WP-0007-production-lifecycle-hardening.md
View file

@ -9,7 +9,7 @@ flavor: implementation
owner: codex
topic_slug: custodian
created: "2026-08-23"
updated: "2026-09-06"
updated: "2026-09-27"
state_hub_workstream_id: "68a39be1-bd9c-5133-ad64-e7bca892aaf3"
---
@ -213,11 +213,15 @@ Acceptance:
```task
id: SECRETS-WP-0007-T04
status: wait
status: done
priority: high
state_hub_task_id: "4b58edec-c705-55e5-9ece-362e1ff13079"
```
Completed 2026-09-27 by reconciling the implemented shared approval guard with the
2026-09-16 native receipt. See the closure note below; the serving-path waits
in the dated history are superseded. Native lane cutover remains T07.
Wait 2026-08-29. The consumer validator and production fail-closed gate are
shipped. What remains is not local engine work: State Hub / `access-engine`
must serve the durable ActionAuthorization object. Paired with
@ -707,6 +711,7 @@ Acceptance:
```task
id: SECRETS-WP-0007-T07
status: wait
blocking_reason: "Engine approval hardening is complete. Remaining per-lane cutover includes native routing/proxy retirement with ops-warden under SECRETS-WP-0006-T05/T06; the exact OpenRouter key-check receipt does not establish broader recipient readiness."
priority: high
state_hub_task_id: "a0a1dd92-d703-5a95-b488-d895f34d5cf7"
```
@ -787,3 +792,25 @@ routing/proxy retirement; SECRETS-WP-0007-T04/T07 retain general native readines
Do not reuse the consumed approvals or treat the temporary key-check overlay as
approval for a radar trial recipient. IR-WP-0005 owns radar delivery acceptance;
IR-WP-0006 owns the outstanding USD 0.023712 billing reservation.
### T04 completed after evidence reconciliation — 2026-09-27
The original serving-path wait is superseded by the native 2026-09-16 receipt
`docs/evidence/2026-09-16-t03-completion.json`, not by synthetic tests or Hub
status. It records separate human-controlled apply, verify and exec approvals,
three distinct current PDP decisions/request digests, successful CAS consumes,
and the resulting native OpenBao operations. The claim/PDP/consume join is the
accepted path; the earlier proposed ActionAuthorization is not a dependency.
Current regression coverage exercises wrong fields/actions/tenant/digest,
superseded or expired claims, changed catalog/owner bindings, denied or missing
PDP responses, consume conflicts/unavailability, declared human control and
production fixture refusal. Every live privileged handler still uses the shared
approval gate before backend access. The recorded approvals are consumed and
expired; they are historical completion evidence, never reusable grants.
T04 is done. T07 stays wait because its per-lane acceptance includes routing and
proxy retirement, and the receipt covers only the exact OpenRouter key-check
recipient. Other lanes and cross-owner cutover remain SECRETS-WP-0006-T05/T06;
this workplan is not finished merely because the engine gate is complete.