coulomb/secrets-engine
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Unblock SECRETS-WP-0012-T03 on the applied CCR-2026-0038 JWT role
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 2s
Details

Browse source 
The platform JWT mount/role is live, so the only remaining step is the
founder's attended probe. Document the local non-secret login contract
input the probe needs, since the CCR publishes its own copy only after
the proof passes.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 544698@bnt-lap001
Assistant-Session: 279b8520-335f-4041-ba2a-9491335473db
This commit is contained in:
tegwick 2026-10-09 19:19:57 +02:00
parent 2f35928ca9
commit e94dc07950
2 changed files with 21 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

22
docs/keycape-openbao-consumer-custody.md
View file

@ -67,9 +67,25 @@ Run only after **all** of: founder approval of the ops-mason plan (A1), the
revised CCR-2026-0033 applied by railiance-platform (A2/A3: KV entry written,
operator OIDC role and policy, ESO reader, JWT role), the KeyCape
`secrets-engine-openbao` registration live and KeyCape restarted after the KV
write (KEY-WP-0037), and the platform JWT login contract file published. This
is the evidence step for KEY-WP-0037-T04 / RPF-WP-0035-T02 and plan
verification item 6.
write (KEY-WP-0037), and the platform JWT role applied (CCR-2026-0038, applied
2026-10-08). This is the evidence step for KEY-WP-0037-T04 / RPF-WP-0035-T02 and
plan verification item 6.
CCR-2026-0038 publishes the consumer contract file only after the login proof
passes, so the probe cannot wait for it. Write the non-secret probe input
locally from the applied CCR values first:
```bash
mkdir -p ~/.secrets-engine/keycape && (umask 077; cat > ~/.secrets-engine/keycape/openbao-jwt-login.yaml <<'YAML'
mount: keycape-services
role: secrets-engine-openbao
bound_issuer: https://kc.coulomb.social
YAML
)
```
This file is the probe's input, not the platform's publication. railiance-platform
replaces or confirms it after the proof passes.
```bash
cd /home/worsch/secrets-engine && \

4
workplans/SECRETS-WP-0012-keycape-openbao-consumer-custody.md
View file

@ -9,7 +9,7 @@ flavor: implementation
owner: claude-code
topic_slug: custodian
created: "2026-10-06"
updated: "2026-10-06"
updated: "2026-10-09"
related_workplans:
- SECRETS-WP-0008
state_hub_workstream_id: "143de42b-b568-5070-add0-d5e71eabd436"
@ -93,7 +93,7 @@ status: wait
needs_human: true
priority: high
blocked_on: founder
blocking_reason: "Founder runs the attended probe-openbao command in docs/keycape-openbao-consumer-custody.md after plan approval A1-A3, the revised CCR-2026-0033 objects applied by railiance-platform, the KeyCape registration live (KEY-WP-0037) and the JWT login contract published."
blocking_reason: "All upstream objects are live: CCR-2026-0033 applied, KeyCape registration live (KEY-WP-0037), CCR-2026-0038 JWT mount keycape-services / role secrets-engine-openbao applied 2026-10-08 (railiance-platform 1b36e14). Founder writes the non-secret local login contract file and runs the attended probe-openbao command in docs/keycape-openbao-consumer-custody.md."
state_hub_task_id: "1c3afd34-4aa3-5484-a9c7-2db577225269"
```