coulomb/secrets-engine
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Finish companion catalog work and reconcile completed approval tasks
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 4s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a0e324-abce-7e51-bb2b-496f097afdb0
This commit is contained in:
tegwick 2026-09-27 16:15:01 +02:00
parent 41e4c4a3d8
commit e33f9c3ca5
18 changed files with 472 additions and 87 deletions
Download patch file Download diff file Expand all files Collapse all files

32
workplans/SECRETS-WP-0008-layer-model-lifecycle-conformance.md
View file

@ -9,7 +9,7 @@ flavor: implementation
owner: grok
topic_slug: custodian
created: "2026-08-29"
updated: "2026-09-21"
updated: "2026-09-27"
state_hub_workstream_id: "9c9e5164-b2f5-5ea2-a557-5368d65e9fe0"
---
@ -90,11 +90,15 @@ Acceptance:
```task
id: SECRETS-WP-0008-T02
status: wait
status: done
priority: high
state_hub_task_id: "3eb9cff8-1441-5437-9e92-a2b655c82d04"
```
Completed 2026-09-27: the 2026-09-16 native apply/verify/exec receipt supplies
the live PDP/claim/consume return awaited below. The dated serving-path waits
are historical. Service JWT adoption remains T06.
Progress 2026-09-02. Gate House notice `632bdad9` (`GH-DEC-2026-003`): this
engine is the PEP for FLEX-WP-0017-T05 / OpenBao writes. The shared consume
function now lives in `src/secrets_engine/approval_consume.py` and every live
@ -327,6 +331,7 @@ Acceptance:
```task
id: SECRETS-WP-0008-T06
status: wait
blocking_reason: "RPF-WP-0035-T02 still awaits exact service claims/tenant, credential custody and scoped attended JWT role provisioning with native login/negative/revocation proof. The historical env-auth acceptance is not service-JWT adoption."
priority: medium
state_hub_task_id: "d7bc8bdc-a0f8-5058-a640-374ef9859148"
```
@ -486,3 +491,26 @@ gate-house (message `4220413a`); we follow that answer rather than choose.
- `layer.yaml` / `pep-stance.yaml` / INTENT frontmatter stay in one voice.
- No raw secret values in Git, State Hub, chat, prompts, workplans, evidence,
or argv.
## Decision consumer closure and declaration ruling applied — 2026-09-27
T02 is done. `docs/evidence/2026-09-16-t03-completion.json` provides the native
return awaited in the September 9 note: separately approved apply/verify/exec
requests received current PDP allows and successful CAS consumption before real
OpenBao work. The shared guard records decision IDs and retains refusal before
backend access for invalid/missing/replayed decisions. SECRETS-WP-0007-T04 now
records the same completed contract; no native activation grant is inferred.
The open conformance-record question is also resolved. GH-DEC-2026-020 §4 says
a versioned/scoped re-runnable checker is sufficient; each declaring repository
need not emit a durable record. GH-DEC-2026-021 §2/§3 names the accepted v0.7
text plus applicable decisions and the ops-warden reference detector. The
checker now copies that detector, permits own-document versions/prose citations,
refuses nested/identity-bearing version pins and names the accepted text and
rulings on every run, including PASS. Declaration spellings are unchanged.
T06 remains wait: railiance-platform's RPF-WP-0035-T02 still records an
unprovisioned, login-only JWT role, pending exact service claims/tenant and
custody/attended admission. The existing env-auth native receipt cannot prove
steady-state service JWT login. This is the only remaining task in this workplan.