Headless multi-application, multi-tenant secrets mangement engine.
tegwick
03c0569820
Adoption asked for by flex-auth (FLEX-WP-0021-T05) and glas-harness (GLAS-WP-0015), plus the first real decision this engine has obtained from the deployed pin -- which found a defect the fixtures could not. ACCESS PATH. require_supported_pdp_address refuses in-cluster Service names and any non-loopback host. This is no longer a unilateral call: the owner path is documented as loopback kubectl port-forward over the authenticated Kubernetes API, which is what authenticates the responder transitively (FLEX-DEC-2026-010). A Service name from a workstation does not fail, it resolves through the DNS search suffix to an unrelated public host, and since decision records carry no signature, a responder knowing the published package and version can return an allow that passes every check we make. Fail-closed protects against a PDP that is absent, not one that lies. The guard runs before the token is read, so a misdirected request cannot leak it; a test pins that ordering. LIVE PROOF. Minted a 10-minute TokenRequest token (audience flex-auth, SA secrets-engine/secrets-engine, mode 0600 outside the worktree, shredded after), forwarded to the named pod, and sent a real CheckRequest for glas-claude-agent-dev-anthropic. Result: allow, catalog_lane_policy_matched, served by v2 (sha256:bd11c5fe...) -- so the redeploy flex-auth flagged as outstanding has landed and the pin no longer serves the tenant-blind v1. Our tenant fix is confirmed against the real service: binding.tenant is tenant:platform. THE DEFECT IT FOUND. The evaluator enriches from its registry before hashing -- subject gains attributes and tenant, resource gains tenant -- so binding.request_digest is over material we never sent and cannot reproduce. validate_decision_envelope rejects every real allow. Every replay test passes because _request_from() rebuilds the request out of the binding, i.e. the enriched form: a self-consistent fake agreeing with itself, which hid this through three rounds of digest work. Third time a real artifact has beaten a fake in this integration. NOT FIXED, DELIBERATELY. Rejecting a valid allow is wrong in the safe direction. Which fields may be enriched is flex-auth's contract to publish; inferring it means accepting a binding that differs from our proposal in a way we decided was benign -- the fail-open shape GH-DEC-2026-008 rejected for vocabularies and FLEX-DEC-2026-007 for digests. Raised with them. Tenant question closed by operator decision 5ed3fb35: tenant:platform exactly, and service_auth.TENANT stays tenant:coulomb because the two identity layers are to remain distinct. Declining to author that mapping was right -- the answer was neither reading offered. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01E4tNMAYcSQmZWUE4wqP4ij Assistant: claude-code Assistant-Model: opus Assistant-Process: 715726@bnt-lap001 Assistant-Session: 80a42b32-cba6-4b23-8be0-68819b1a6092 |
||
|---|---|---|
| .claude/rules | ||
| .decisions | ||
| .forgejo/workflows | ||
| catalog | ||
| docs | ||
| history | ||
| intakes | ||
| policies | ||
| registry | ||
| scripts | ||
| src/secrets_engine | ||
| tests | ||
| workplans | ||
| .custodian-brief.md | ||
| .gitignore | ||
| .repo-classification.yaml | ||
| AGENTS.md | ||
| CLAUDE.md | ||
| evidence-classification.yaml | ||
| INTENT.md | ||
| layer.yaml | ||
| LICENSE | ||
| pep-stance.yaml | ||
| ProductRequirementsDocument.md | ||
| pyproject.toml | ||
| README.md | ||
| SCOPE.md | ||
| uv.lock | ||
| WORK-RECORDS.md | ||
secrets-engine
Headless, multi-application, multi-tenant secrets workflow and automation layer for approved secret custody, delivery, and lifecycle work across build, test, and production stages.
Layer: Engine / Lifecycle under the accepted NetKingdom Security Layer
Model (layer.yaml). OpenBao remains the custody and enforcement backend.
secrets-engine is the deterministic API over it: catalog, decision
consumption, plan/apply, guarded provisioning, verification, delivery,
evidence, lifecycle metadata, and native-access deactivation. It does not
render authorization decisions. Local evidence can be inspected through an
allowlisted per-lane audit summary without exposing record detail.
Start Here
- INTENT.md - why this repository exists, including the Engine / Lifecycle declaration.
- layer.yaml - machine-readable layer declaration and proposed surfaces.
- ProductRequirementsDocument.md - product requirements and MVP scope.
- NetKingdom security infrastructure boundary pointer
- points to the canonical document in
net-kingdom/docs/, covering responsibilities and interactions with OpenBao, flex-auth, user-engine, ops-warden, ops-bridge, info-tech-canon, State Hub, and agents.
- points to the canonical document in
- Bootstrap MVP workplan - first implementation plan after State Hub bootstrap.
Core Direction
The MVP proves the whynot-design-npm-publish lane end to end:
- describe the lane in a non-secret catalog (
catalog/); - verify an approved decision (State Hub or local fixture);
- apply OpenBao policy/auth metadata through a stage-aware role;
- provision and verify the value without printing it;
- run a workload command through safe exec-time delivery.
Target command shape:
secrets-engine exec --catalog whynot-design-npm-publish -- npm publish
Quickstart
uv venv && uv pip install -e ".[dev]"
source .venv/bin/activate
secrets-engine catalog list
# Run the whole pilot chain live against a throwaway OpenBao dev server:
SECRETS_ENGINE_HUB_URL="" bash scripts/demo-e2e.sh
- CLI reference: docs/cli.md
- Publication-scope policy (maturity → token scope): docs/publication-scope-policy.md
- Stage roles & bootstrap tokens: docs/openbao-stage-roles.md
- warden-sign auth-capability lane: docs/warden-sign-auth-capability.md
- whynot-design real publish closeout: docs/whynot-design-real-publish-closeout.md
- ops-warden routing contract: docs/ops-warden-routing-contract.md
- Hardening backlog (exit bootstrap mode): docs/hardening-backlog.md
- Existing-lane catalog admission: docs/catalog-admission.md
- Native lane cutover (WP-0006 T05/T06): docs/native-lane-cutover.md
- KeyCape service-auth consumer boundary: docs/service-auth.md
- Approval consume-before-OpenBao (GH-DEC-2026-003): docs/approval-consumption.md
- OpenBao JWT login contract (engine consumer): docs/openbao-jwt-login.md
- Secret-use evidence surface: docs/secret-use-evidence-contract.md
The implementation is a Python package (src/secrets_engine/). OpenBao is
reached only through the bao CLI adapter (openbao.py); the rest of the code
speaks in lanes and guarded plans.
Security Rules
- Do not put raw secret values in Git, State Hub, chat, prompts, issue comments, workplans, or normal logs.
- OpenBao is the backend custody and audit authority.
- Build, test, and production have separate policy boundaries.
- Production live actions fail closed until the durable State Hub action-authorization endpoint is available; local approval mirrors are throwaway-demo material only.
- A privileged production OpenBao call also requires a successful approval-engine CAS consume first. Conflict or unavailability means do not write.
- Temporary bootstrap OpenBao credentials must live outside repos, use mode 0600, be revocable, and be removed after narrower auth is working.