secrets-engine

Author	SHA1	Message	Date
tegwick	f0d82908e9	Bind platform OpenBao service identity to tenant zero All checks were successful CI Smoke / host-smoke (push) Successful in 1s Details CI Smoke / container-smoke (push) Successful in 4s Details Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a0e324-abce-7e51-bb2b-496f097afdb0	2026-09-27 16:43:31 +02:00
tegwick	7688445184	feat: exchange scoped approval service tokens per request All checks were successful CI Smoke / host-smoke (push) Successful in 0s Details CI Smoke / container-smoke (push) Successful in 2s Details Assistant: codex Assistant-Model: gpt-5.6-luna Assistant-Session: 01a07ff8-19d0-7820-b4d0-1353833cb7fc	2026-09-09 07:06:05 +02:00
tegwick	3abee434df	Add named engine auth and accessor-file session revoke All checks were successful CI Smoke / host-smoke (push) Successful in 0s Details CI Smoke / container-smoke (push) Successful in 1s Details Select service-jwt, bootstrap, or env exclusively: JWT login uses a JSON file, self-revokes, and never falls back to bootstrap or BAO_TOKEN. The platform JWT mount/role is still unpublished, so auto keeps named bootstrap/env providers. session revoke --accessor-file revokes an already-issued token with fingerprint-only evidence. Production remains fail-closed. Assistant: grok Assistant-Session: 01a05f07-ae72-7781-9fcb-19efd61add00	2026-09-02 01:24:08 +02:00
tegwick	70371649af	Harden production authorization and service auth All checks were successful CI Smoke / host-smoke (push) Successful in 0s Details CI Smoke / container-smoke (push) Successful in 1s Details Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a0217e-8c4c-7383-be6b-f50a6e485306	2026-08-23 14:15:42 +02:00

4 commits