coulomb/secrets-engine
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
secrets-engine/docs/gated-actions.md
tegwick a3eb6634aa docs: publish the authoritative gated-action list for flex-auth 
flex-auth (FLEX-DEC-2026-005 / FLEX-WP-0021-T01) reserved the coordinate
secrets-engine.catalog-lane.lifecycle v1 and stated an action they infer is
a blocker, not a default. This is the enforced set read out of cli.py.

Includes the traps an inferred list would hit: `revoke` gates as the
`deactivate` action and is not itself an action value; `destroy` is defined
but unreachable live; `compromise`/`reactivate` gate overlay state only.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01M65ovP3eiiPHubibvWs9mD

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 393550@bnt-lap001
Assistant-Session: 4bb359f9-1f12-4410-9e76-079cf23c82e4
2026-09-06 01:27:17 +02:00

2.6 KiB
Raw Blame History

Gated actions over secret-catalog-lane

Authoritative list of the action values secrets-engine passes to the shared authorization gate (_require_lane_approval → resolve_consume_binding → require_production_consume). Supplied to flex-auth for secrets-engine.catalog-lane.lifecycle (FLEX-WP-0021-T01 / FLEX-DEC-2026-005).

This is the enforced set read out of cli.py, not the secrets-engine.lifecycle/v1 example vocabulary. resource.type is secret-catalog-lane and resource.system is secrets-engine; the catalog id is request.resource.id.

action Reached by Side effect
apply apply writes consumer ACL policy + AppRole metadata
provision provision writes one declared KV field
rotate rotate replaces one declared KV field
verify verify AppRole login + bounded read/capability probe
handoff handoff mints role-id/secret-id to mode-0600 files
wrap wrap response-wrapped operator handoff
exec exec fetches one field into a child process
deactivate revoke and lifecycle deactivate removes managed AppRole/policy; preserves KV
suspend lifecycle suspend removes managed AppRole; preserves policy
destroy lifecycle destroy irreversible KV metadata deletion
compromise lifecycle compromise marks lane compromised; blocks delivery
reactivate lifecycle reactivate clears overlay state

Things a package author would otherwise get wrong

  • revoke is not an action. The CLI verb revoke gates as deactivate. There is no revoke action value. Do not add one.
  • destroy is defined but currently unreachable live. The handler raises before the gate; only --dry-run renders. Keep it in the package as the dual-control-capable case, but no live destroy Check will arrive until the exact-action approval contract lands (SECRETS-WP-0007-T04).
  • compromise and reactivate mutate local overlay state only. They touch no OpenBao object. They are gated because they change delivery posture, not because they write to the backend.
  • plan, apply --dry-run, route, audit, catalog, decision inspect and evidence never reach the gate and must not appear in the package.
  • Build and test stages remain fail-open relative to approval-engine; only stage: prod reaches consume.

Request attributes carried today

resource.attributes carries stage, and sorted fields, policy_targets, and auth_targets. fields is populated for provision, rotate, verify, and exec; the others send an empty list rather than a guess.