coulomb/secrets-engine
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Keep serve on the live lifecycle path until the job stream ends.
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
The process reads one stage credential file at startup, applies each job through the CLI lifecycle functions, and waits for further jobs. A second stage credential file refuses startup. A local allow flag does not authorize the call.

Assistant: grok
Assistant-Session: 01a1609f-72b8-7222-9dff-fae300115e42
This commit is contained in:
tegwick 2026-10-22 18:15:23 +02:00
parent 06dfe12c18
commit f211525f00
4 changed files with 299 additions and 151 deletions
Download patch file Download diff file Expand all files Collapse all files

6
SCOPE.md
View file

@ -236,8 +236,10 @@ credentials.
- `instance` prints the one bound stage. The injected credential is not
printed, returned, or written to Git, State Hub, logs, or the workplan.
- A second stage credential in the same process refuses startup.
- `serve` keeps the lifecycle library the CLI uses running for that one stage.
It is the in-process manifestation of this library.
- `serve` keeps that same lifecycle path running for the one injected stage.
It applies the first job, then waits on stdin for further jobs until the
stream ends. Each job uses `build_lifecycle_plan` and the live lifecycle
apply path. This is the in-process manifestation of the library.
- `--allow` and `SECRETS_ENGINE_LOCAL_ALLOW` do not authorize apply or the
service. Permission to use an instance is the access-engine claim in
`docs/engine-use-claim.md`. Protected side effects still require a decision