Headless multi-application, multi-tenant secrets mangement engine.
tegwick
a852d3f1ff
Implements SECRETS-WP-0002 end to end as a uv-managed Python package: - catalog: non-secret lane registry + strict validator (build/test/prod) - stage roles + OpenBao ACL policies; guards refuse wildcards, sys/, identity/, admin names, and cross-stage paths before any backend call - plan/apply: dry-run-first, idempotent policy + approle apply, decision-gated - decisions: State Hub lookup with local-fixture fallback; non-secret evidence to JSONL + hub progress, scrubbed of any value - provision/verify: mode-0600 file import + generated test values; positive/ negative checks that never print the value - exec delivery: `exec --catalog ... -- npm publish` injects the token via a temp .npmrc for the child only, cleaned up on exit/failure/interrupt - ops-warden routing contract + hardening backlog docs - 34 tests incl. live OpenBao integration; scripts/demo-e2e.sh runs the full chain against a throwaway bao dev server Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> |
||
|---|---|---|
| .claude/rules | ||
| .decisions | ||
| catalog | ||
| docs | ||
| policies | ||
| registry | ||
| scripts | ||
| src/secrets_engine | ||
| tests | ||
| workplans | ||
| .custodian-brief.md | ||
| .gitignore | ||
| .repo-classification.yaml | ||
| AGENTS.md | ||
| CLAUDE.md | ||
| INTENT.md | ||
| LICENSE | ||
| ProductRequirementsDocument.md | ||
| pyproject.toml | ||
| README.md | ||
| SCOPE.md | ||
secrets-engine
Headless, multi-application, multi-tenant secrets workflow and automation layer for approved secret custody, delivery, and lifecycle work across build, test, and production stages.
OpenBao remains the custody and enforcement backend. secrets-engine owns the
operator and agent interaction model: catalog, decision checks, plan/apply,
safe provisioning, verification, delivery, evidence, rotation, and deactivation.
Start Here
- INTENT.md - why this repository exists.
- ProductRequirementsDocument.md - product requirements and MVP scope.
- NetKingdom security infrastructure boundary pointer
- points to the canonical document in
net-kingdom/docs/, covering responsibilities and interactions with OpenBao, flex-auth, user-engine, ops-warden, ops-bridge, info-tech-canon, State Hub, and agents.
- points to the canonical document in
- Bootstrap MVP workplan - first implementation plan after State Hub bootstrap.
Core Direction
The MVP proves the whynot-design-npm-publish lane end to end:
- describe the lane in a non-secret catalog (
catalog/); - verify an approved decision (State Hub or local fixture);
- apply OpenBao policy/auth metadata through a stage-aware role;
- provision and verify the value without printing it;
- run a workload command through safe exec-time delivery.
Target command shape:
secrets-engine exec --catalog whynot-design-npm-publish -- npm publish
Quickstart
uv venv && uv pip install -e ".[dev]"
source .venv/bin/activate
secrets-engine catalog list
# Run the whole pilot chain live against a throwaway OpenBao dev server:
SECRETS_ENGINE_HUB_URL="" bash scripts/demo-e2e.sh
- CLI reference: docs/cli.md
- Stage roles & bootstrap tokens: docs/openbao-stage-roles.md
- ops-warden routing contract: docs/ops-warden-routing-contract.md
- Hardening backlog (exit bootstrap mode): docs/hardening-backlog.md
The implementation is a Python package (src/secrets_engine/). OpenBao is
reached only through the bao CLI adapter (openbao.py); the rest of the code
speaks in lanes and guarded plans.
Security Rules
- Do not put raw secret values in Git, State Hub, chat, prompts, issue comments, workplans, or normal logs.
- OpenBao is the backend custody and audit authority.
- Build, test, and production have separate policy boundaries.
- Production actions require approved decisions except explicit break-glass flows.
- Temporary bootstrap OpenBao credentials must live outside repos, use mode 0600, be revocable, and be removed after narrower auth is working.