coulomb/secrets-engine
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
secrets-engine/tests
History
tegwick 9ec4e0bea5
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details
Keep ambient tokens out of the service-JWT OpenBao login 
The anonymous JWT login inherited BAO_TOKEN/VAULT_TOKEN and the bao CLI
token helper, so it presented an env/operator token alongside the JWT.
Run that login with no env token and a token helper that returns none,
proven against the real bao CLI. This closes secrets-engine's part of the
CCR-2026-0038 no-fallback check.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 544698@bnt-lap001
Assistant-Session: 279b8520-335f-4041-ba2a-9491335473db
2026-10-10 13:26:20 +02:00
..
fixtures fix: bind approval consumption to actual Flex Auth submissions 2026-09-09 08:55:46 +02:00
__init__.py feat(mvp): working secrets-engine CLI for the whynot-design npm publish lane 2026-06-28 12:28:45 +02:00
authorization_stub.py fix: bind approval consumption to actual Flex Auth submissions 2026-09-09 08:55:46 +02:00
test_action_authorization.py fix: bind approval consumption to actual Flex Auth submissions 2026-09-09 08:55:46 +02:00
test_application_time.py Use bounded Railiance time for protected validity checks 2026-09-15 22:16:31 +02:00
test_approval_auth.py Align native CLI execution with approved T03 targets and authority 2026-09-14 03:21:48 +02:00
test_approval_claim.py feat: bind the destroy gate to approval_binding_digest and pdp_path 2026-09-06 20:39:59 +02:00
test_approval_consume.py Align native CLI execution with approved T03 targets and authority 2026-09-14 03:21:48 +02:00
test_audit.py Harden production authorization and service auth 2026-08-23 14:15:42 +02:00
test_auth_capability.py Harden secret provisioning and lifecycle controls 2026-08-23 12:05:58 +02:00
test_catalog.py feat: admit existing OpenBao catalog lanes 2026-08-21 08:20:33 +02:00
test_consume_binding_join.py fix: bind approval consumption to actual Flex Auth submissions 2026-09-09 08:55:46 +02:00
test_consumer_secret_file.py Read the secrets-engine-openbao client secret in memory from OpenBao 2026-10-06 14:13:41 +02:00
test_decision_replay.py Bind native OpenRouter approval to custody and delivery inputs 2026-09-14 00:54:55 +02:00
test_decision_start_wait.py Wait within decision validity bounds and preserve failed preflight evidence 2026-09-14 03:46:28 +02:00
test_decisions.py Harden production authorization and service auth 2026-08-23 14:15:42 +02:00
test_dry_run_never_gates.py test: enforce that dry runs never reach the authorization gate 2026-09-06 08:09:42 +02:00
test_engine_auth.py Keep ambient tokens out of the service-JWT OpenBao login 2026-10-10 13:26:20 +02:00
test_evidence_class.py Implement SECRETS-WP-0008 unblocked layer-model obligations 2026-08-29 12:52:55 +02:00
test_exec_delivery.py Add companion lanes to catalog-bound exec owners (SECRETS-WP-0011 T01-T03) 2026-09-23 17:27:09 +02:00
test_exec_owner.py Finish companion catalog work and reconcile completed approval tasks 2026-09-27 16:15:01 +02:00
test_exec_owner_companions.py Enforce companion-only credential delivery and refresh activation handoff 2026-09-27 15:58:53 +02:00
test_existing_lane_admission.py Harden secret provisioning and lifecycle controls 2026-08-23 12:05:58 +02:00
test_guards.py feat: prepare data-only Anthropic native delivery lane 2026-09-06 00:25:37 +02:00
test_human_control.py Finish companion catalog work and reconcile completed approval tasks 2026-09-27 16:15:01 +02:00
test_integration_authorization.py Align native CLI execution with approved T03 targets and authority 2026-09-14 03:21:48 +02:00
test_integration_bao.py Add value-safe verification and audit reporting 2026-08-23 12:33:38 +02:00
test_integration_companions.py Add companion lanes to catalog-bound exec owners (SECRETS-WP-0011 T01-T03) 2026-09-23 17:27:09 +02:00
test_lane_state.py Add native rotate and persistent lane overlay states 2026-09-02 13:09:10 +02:00
test_layer_conformance.py Finish companion catalog work and reconcile completed approval tasks 2026-09-27 16:15:01 +02:00
test_lifecycle.py Harden secret provisioning and lifecycle controls 2026-08-23 12:05:58 +02:00
test_live_decision_enrichment.py fix: bind approval consumption to actual Flex Auth submissions 2026-09-09 08:55:46 +02:00
test_metered_activation_review.py Correct metered Sonnet 5 admission and prepare native action packet 2026-09-27 17:00:33 +02:00
test_multifield_readiness.py feat: implement the PIP claim + validate authorization join 2026-09-06 01:01:55 +02:00
test_openbao_safe_write.py Harden secret provisioning and lifecycle controls 2026-08-23 12:05:58 +02:00
test_openbao_secret_source.py Read the secrets-engine-openbao client secret in memory from OpenBao 2026-10-06 14:13:41 +02:00
test_openrouter_binding.py Align native CLI execution with approved T03 targets and authority 2026-09-14 03:21:48 +02:00
test_openrouter_key_check.py Bind native OpenRouter approval to custody and delivery inputs 2026-09-14 00:54:55 +02:00
test_privileged_cli_evidence.py feat: implement the PIP claim + validate authorization join 2026-09-06 01:01:55 +02:00
test_publication_policy.py feat(policy): netkingdom maturity-gated publication-scope policy 2026-06-28 13:14:46 +02:00
test_redact_evidence.py Harden production authorization and service auth 2026-08-23 14:15:42 +02:00
test_rotate.py Add native rotate and persistent lane overlay states 2026-09-02 13:09:10 +02:00
test_safe_paths.py feat: admit existing OpenBao catalog lanes 2026-08-21 08:20:33 +02:00
test_secret_use.py Ship secret-use snapshot surface for kings-guard 2026-09-02 01:31:23 +02:00
test_service_auth.py Read the secrets-engine-openbao client secret in memory from OpenBao 2026-10-06 14:13:41 +02:00
test_session_revoke.py Revoke leases by operator-held lease id 2026-09-02 10:08:33 +02:00
test_verification_negative.py Add value-safe verification and audit reporting 2026-08-23 12:33:38 +02:00
test_wp0006_cutover.py Prepare WP-0006 first-lane native cutover packet 2026-09-03 23:36:42 +02:00
test_wrap.py Add response-wrapped operator handoff 2026-09-02 08:12:42 +02:00