938f3edbac
source: repo-manager reason: deterministic projection registration Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a0726e-5232-73f2-aaca-2c05ceb62efb
2.3 KiB
| id | type | title | domain | repo | status | owner | created | updated | state_hub_workstream_id |
|---|---|---|---|---|---|---|---|---|---|
| SECRETS-WP-0009 | workplan | Activate native Claude credential delivery for Glas | infotech | secrets-engine | blocked | codex | 2026-09-05 | 2026-09-05 | 40ccc3b4-d046-5a58-8649-e7935f45c974 |
Demand: GLAS-WP-0012-T02 / SAND-WP-0015-T04, custody CCR-2026-0016. The user authorized continuing credential delivery after storing the key in Bao. This record tracks native read-lane adoption, not a new provider key or rotation.
Define the exact native read lane
id: SECRETS-WP-0009-T01
status: done
priority: high
state_hub_task_id: "4f1cf242-3aec-56a8-b958-5d53823875e0"
Added catalog glas-claude-agent-dev-anthropic; plan checks existing platform mount and proposes one data-only read policy/AppRole. Token TTL5m/max15m, single-use SecretID5m, token use budget8. See docs/glas-claude-delivery.md. No metadata, sibling, listing or write capability is proposed.
Support data-only delivery policies
id: SECRETS-WP-0009-T02
status: done
priority: high
state_hub_task_id: "fa4a3e87-0854-5e2b-af44-facd5b25f443"
Added boolean delivery_auth.metadata_read with compatible default true and explicit false for this lane. Validation refuses non-booleans; generated plan omits metadata permissions when disabled. Full owner suite passes. Sand-boxer synthetic exec-env transport proof passed; no real secret was read.
Activate the approved native lane and verify real owner delivery
id: SECRETS-WP-0009-T03
status: wait
priority: high
state_hub_task_id: "f8069c8a-ad6b-5d0b-9a36-c2326699437d"
Depends on SECRETS-WP-0007-T04 and SECRETS-WP-0008-T02/T06: canonical production authorization, successful consume and scoped service authority must exist. Current production exec refuses before OpenBao because durable access-engine decision records are not served. Do not bypass this with unsafe-demo or a human operator runtime token. Then apply the exact read policy/AppRole, prove positive and negative access, register delivery-ready evidence, bind owner exec with service authentication, and return verified pins/evidence to SAND-WP-0015 and GLAS-WP-0012. Provider scope/budget and expiry remain explicit acceptance inputs. Keep the catalog route inactive until real verification passes.