coulomb/secrets-engine
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix: bind approval consumption to actual Flex Auth submissions
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-5.6-luna
Assistant-Session: 01a07ff8-19d0-7820-b4d0-1353833cb7fc
This commit is contained in:
tegwick 2026-09-09 08:55:46 +02:00
parent 89bc31460f
commit ee4e901611
23 changed files with 612 additions and 1023 deletions
Download patch file Download diff file Expand all files Collapse all files

26
workplans/SECRETS-WP-0008-layer-model-lifecycle-conformance.md
View file

@ -89,7 +89,7 @@ Acceptance:
```task
id: SECRETS-WP-0008-T02
status: progress
status: wait
priority: high
state_hub_task_id: "3eb9cff8-1441-5437-9e92-a2b655c82d04"
```
@ -194,6 +194,30 @@ The current source has not yet implemented the changes in this return; live
PDP rollout/adoption evidence remains explicit too. No synthetic fixture or Hub
decision substitutes for a runtime allow and consume.
### 2026-09-09 replay consumer implementation and real component acceptance
The returned correction is implemented. The PEP now checks the exact submitted
request digest including the full carried approval, permits registry-owned
attribute replacement, joins the evaluator-origin approval digests and rechecks
claim freshness after Check. The consume CAS uses the validated evaluator's
request_digest and decision id; an observation alone is not a consume binding.
334 regression tests pass. The disposable KeyCape + actual Approval Engine +
compiled Flex Auth exercise passes 13 checks, including real dual-control denial
then claim/check/consume, registry override, changed submitted request, wrong
action, consumed claim and same/different CAS digest. Independent producer
inputs replace response-reconstructed replay fixtures; existing digest pins
remain unchanged. Receipt: docs/evidence/2026-09-09-replay-contract-exercise.json.
No OpenBao side effect, live credential read or model request occurred.
T02 is wait for the live return: deployed PDP contract adoption and the admitted
Approval Engine claim/consume path (APPROVAL-WP-0002-T03 and RPF-WP-0035-T06 /
AUDIT-WP-0009-T09). SECRETS-WP-0009-T03 owns native delivery acceptance. The old
live decision lacks submitted_request_digest and is explicitly refused; its
historical evidence was not rewritten. Local conformance does not close the
remaining live task. This supersedes earlier additive-only and claim-free
transitive correspondence descriptions above.
## Emit evidence under the §9.6 bound
```task

10
workplans/SECRETS-WP-0009-glas-claude-native-delivery.md
View file

@ -186,3 +186,13 @@ Owner-return clarification: SECRETS-WP-0008-T02 is now progress for the publishe
FLEX-DEC-2026-012 submitted-request replay identity and approval-digest join.
The real-component identity exercise used a PDP double and does not close that
local implementation. T03 also consumes that correction before live activation.
## Replay-contract return — 2026-09-09
SECRETS-WP-0008-T02 supplies the implemented FLEX-DEC-2026-012 consumer join.
334 tests and 13 real local KeyCape/Approval Engine/Flex Auth checks pass;
receipt: docs/evidence/2026-09-09-replay-contract-exercise.json. The former PDP
double limitation is resolved for component conformance. T03 remains wait for
current deployed PDP adoption, separately admitted client-side/audit custody,
actual Approval Engine deployment, and the scoped native OpenBao delivery proof.