coulomb/secrets-engine
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

build: package CLI with pinned producer verifier

Browse source 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a140c4-354a-7823-8f0d-8f717397f786
This commit is contained in:
tegwick 2026-10-16 09:20:33 +02:00
parent c80a944105
commit ebca4f5adb
9 changed files with 433 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

9
workplans/SECRETS-WP-0014-pdp-transport-and-responder-authentication.md
View file

@ -77,6 +77,15 @@ key admission remains part of its scope; T03 stays wait. WP13 execution and
identity-only CCR38 are unchanged. Custodian source/verification handoff:
`docs/changes/netkingdom-target-2026-10-16/decision-auth/` in the Custodian repo.
2026-10-16 packaging preparation: `scripts/build_release_bundle.py` and its
separate offline installer deliver the existing wheel plus the reviewed producer
verifier together into a new owner-controlled prefix. Source/hash drift checks,
artifact/toolchain receipts and a narrow fixed-helper launcher remove the silent
wheel-only deployment gap. Disposable build/install tests prove deterministic
artifacts, signed HTTP consumption and missing/tampered artifact refusal; they do
not admit packages, keys or a production prefix. T02 remains progress and T03
wait; no native installation, trust change or protected entitlement is claimed.
## Verify the admitted native consumer and rotation path
```task