coulomb/secrets-engine
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
secrets-engine/workplans/ADHOC-2026-08-21.md
codex 9093b9ebba
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details
chore: commit work in progress before registrar reconciliation 
Refs CUST-WP-0068

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 2583210@bnt-lap001
Assistant-Session: f2bff2d5-e9b2-4338-92ca-10282a927006
2026-08-25 17:51:13 +02:00

1 KiB
Raw Blame History

id type title domain repo status owner topic_slug created updated state_hub_workstream_id
ADHOC-2026-08-21 workplan OpenBao dev-test and safe-path robustness infotech secrets-engine finished codex custodian 2026-08-21 2026-08-21 643a3710-9778-54d2-8bd5-cdc23a4139a6

ADHOC-2026-08-21 - OpenBao dev-test and safe-path robustness

Keep verification safe in sandboxed environments

id: ADHOC-2026-08-21-T01
status: done
priority: low
state_hub_task_id: "2d309354-7a5f-59f2-9817-15545f0fda5e"

While verifying SECRETS-WP-0006, the suite exposed two environment-sensitive test failures. OpenBao 2.5.5 dev mode attempted to persist its root token under the read-only home directory, and an empty /tmp/.git sandbox marker was treated as a real Git worktree.

The dev fixture now uses -dev-no-store-token. Secret provisioning and AppRole handoff still reject real worktrees (.git file or .git/HEAD) but ignore an empty directory that is not a valid Git marker. Unit coverage preserves both the rejection and false-positive cases.