coulomb/secrets-engine
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
secrets-engine/workplans/ADHOC-2026-08-21.md
repo-manager 57f6c4fa65
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details
chore(registrar): assign State Hub identifiers 
Assistant: grok
Assistant-Session: 01a04cea-cb33-7c63-bad7-c1b0f9f0076b
2026-08-29 12:00:51 +02:00

1 KiB
Raw Blame History

id type title domain repo status owner topic_slug created updated state_hub_workstream_id
SECRETS-WP-ADHOC-2026-08-21 workplan OpenBao dev-test and safe-path robustness infotech secrets-engine finished codex custodian 2026-08-21 2026-08-21 5580d785-c80f-5dbd-9ef8-22a630fa607b

SECRETS-WP-ADHOC-2026-08-21 - OpenBao dev-test and safe-path robustness

Keep verification safe in sandboxed environments

id: SECRETS-WP-ADHOC-2026-08-21-T01
status: done
priority: low

While verifying SECRETS-WP-0006, the suite exposed two environment-sensitive test failures. OpenBao 2.5.5 dev mode attempted to persist its root token under the read-only home directory, and an empty /tmp/.git sandbox marker was treated as a real Git worktree.

The dev fixture now uses -dev-no-store-token. Secret provisioning and AppRole handoff still reject real worktrees (.git file or .git/HEAD) but ignore an empty directory that is not a valid Git marker. Unit coverage preserves both the rejection and false-positive cases.