coulomb/secrets-engine
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Unblock SECRETS-WP-0012-T03 on the applied CCR-2026-0038 JWT role
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 2s
Details

Browse source 
The platform JWT mount/role is live, so the only remaining step is the
founder's attended probe. Document the local non-secret login contract
input the probe needs, since the CCR publishes its own copy only after
the proof passes.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 544698@bnt-lap001
Assistant-Session: 279b8520-335f-4041-ba2a-9491335473db
This commit is contained in:
tegwick 2026-10-09 19:19:57 +02:00
parent 2f35928ca9
commit e94dc07950
2 changed files with 21 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

22
docs/keycape-openbao-consumer-custody.md
View file

@ -67,9 +67,25 @@ Run only after **all** of: founder approval of the ops-mason plan (A1), the
revised CCR-2026-0033 applied by railiance-platform (A2/A3: KV entry written,
operator OIDC role and policy, ESO reader, JWT role), the KeyCape
`secrets-engine-openbao` registration live and KeyCape restarted after the KV
write (KEY-WP-0037), and the platform JWT login contract file published. This
is the evidence step for KEY-WP-0037-T04 / RPF-WP-0035-T02 and plan
verification item 6.
write (KEY-WP-0037), and the platform JWT role applied (CCR-2026-0038, applied
2026-10-08). This is the evidence step for KEY-WP-0037-T04 / RPF-WP-0035-T02 and
plan verification item 6.
CCR-2026-0038 publishes the consumer contract file only after the login proof
passes, so the probe cannot wait for it. Write the non-secret probe input
locally from the applied CCR values first:
```bash
mkdir -p ~/.secrets-engine/keycape && (umask 077; cat > ~/.secrets-engine/keycape/openbao-jwt-login.yaml <<'YAML'
mount: keycape-services
role: secrets-engine-openbao
bound_issuer: https://kc.coulomb.social
YAML
)
```
This file is the probe's input, not the platform's publication. railiance-platform
replaces or confirms it after the proof passes.
```bash
cd /home/worsch/secrets-engine && \