coulomb/secrets-engine
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Record privileged action failure evidence
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a0217e-8c4c-7383-be6b-f50a6e485306
This commit is contained in:
tegwick 2026-08-23 12:58:12 +02:00
parent c4504c6de9
commit f579f3761c
8 changed files with 517 additions and 189 deletions
Download patch file Download diff file Expand all files Collapse all files

7
docs/cli.md
View file

@ -112,6 +112,13 @@ does not echo arbitrary JSONL detail. State Hub failures are recorded locally as
append-only companion receipts; they are visible but are not automatically
replayed.
Live `apply`, `provision`, `verify`, `handoff`, `exec`, `revoke`, `suspend`, and
`deactivate` share one evidence guard. It records an attempt before lane approval
is resolved and a terminal outcome on every normal or exceptional exit. Rejected
approval and backend/input failures record only approval state and exception
class, not exception text. This evidence describes what the CLI observed; it is
not an authorization decision and does not replace OpenBao audit logs.
## Exit codes
| Code | Meaning |