tegwick
9a8938be3e
INTENT.md now describes one enabling library over the store, manifested as a CLI or a single-stage service. SECRETS-WP-0016 is the implementation workplan. The accepted layer statute is still v0.8. Assistant: grok Assistant-Session: 01a1609f-72b8-7222-9dff-fae300115e42
4 KiB
| id | type | title | domain | repo | status | owner | topic_slug | created | updated | flavor | depends_on | related | ||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| SECRETS-WP-0016 | workplan | Manifest the lifecycle engine as one library, a CLI, and a single-stage service | infotech | secrets-engine | ready | secrets-engine | custodian | 2026-10-22 | 2026-10-22 | implementation |
|
Implements the engine shape in INTENT.md after gate-house ADR-015
(accepted 2026-10-22) and ArchitectureBlueprint.md §2.2.
Reviewed against the tree on 2026-10-22. secrets_engine.plan.build_plan
already renders a plan without an OpenBao client. secrets_engine.cli is the
process. SCOPE.md records that service delivery is absent, and that a
service API or daemon is not implemented. service-jwt can log in and cannot
yet carry engine actions. Accepted security-layer-model v0.8 still governs
PEP behavior. Proposed v0.9 §3.3 carries the same engine wording and does not
yet govern.
This workplan does not add a release-unit declaration, does not deploy a workload, and does not make this engine the only client of OpenBao or a decider of who may use it.
Lock the library boundary
id: SECRETS-WP-0016-T01
status: todo
priority: high
build_plan and the catalog validation it depends on stay free of the OpenBao
client. Add a test that calls the shipped build_plan for a fixture lane and
asserts no OpenBao client is constructed. If a plan path constructs one, move
that call to the process that applies the plan.
Done when that test passes against src/secrets_engine/plan.py and the apply
path still performs the OpenBao calls.
Inject one stage credential at process start
id: SECRETS-WP-0016-T02
status: todo
priority: high
depends_on: [SECRETS-WP-0016-T01]
The CLI process binds to exactly one stage, build, test, or production.
That stage's OpenBao credential is supplied to the process at start and is not
printed, returned, or written to Git, State Hub, logs, or the workplan. A
second stage credential present in the same process is a startup failure.
Done when a test starts the shipped CLI entry against fixture configuration, shows one stage bound, shows the credential value absent from stdout and stderr, and shows startup failure when two stage credentials are present.
Manifest the same library as a single-stage service
id: SECRETS-WP-0016-T03
status: todo
priority: medium
depends_on: [SECRETS-WP-0016-T02]
Add a service manifestation of the same library and the same one-stage injection. It is a kept-running process, not a second implementation and not a Deployment. It does not accept another stage's credential.
Done when an in-process test starts that manifestation for one stage and a lifecycle call goes through the shipped library functions used by the CLI.
Consume use, do not decide it
id: SECRETS-WP-0016-T04
status: todo
priority: medium
depends_on: [SECRETS-WP-0016-T03]
Permission to start or call an instance is an access-engine decision. This repository documents the claim it will consume and does not invent a local allow-list. A caller-supplied flag or config key must not authorize apply or the service. Protected side effects keep the existing rule: a decision record or the published unreachable-engine stance. v0.8 PEP obligations stay.
Done when a test shows a local allow flag does not authorize a protected call,
and the claim shape is written in docs/ without storing a credential.
Record the manifestations in SCOPE
id: SECRETS-WP-0016-T05
status: todo
priority: low
depends_on: [SECRETS-WP-0016-T03, SECRETS-WP-0016-T04]
Update SCOPE.md so it describes the library, the one-stage CLI, and the
service manifestation that the code then contains. State that other engines
may use OpenBao for other capabilities. Remove the claim that service delivery
is absent only for the manifestation this workplan adds. Leave exec-time
delivery as the default for a one-task caller.
Done when SCOPE.md matches the shipped commands and tests, and does not
describe a cluster Deployment this workplan did not add.