tegwick
afd1c8e593
secrets-engine wrap writes a single-use OpenBao wrap token to a mode-0600 out-of-repo file and never prints it. KV reads and AppRole secret_ids are wrapped with a 15m TTL cap. Unwrapped secret payloads fail closed. Production wrap remains fail-closed. Assistant: grok Assistant-Session: 01a05f07-ae72-7781-9fcb-19efd61add00
62 lines
2 KiB
YAML
62 lines
2 KiB
YAML
# secrets-engine — load-bearing vs attributive evidence (§9.6)
|
|
#
|
|
# Machine-readable classification next to the layer declaration.
|
|
# Completeness is not claimed. No control may branch on presence or
|
|
# absence of a local evidence record.
|
|
|
|
schema_version: "0.1"
|
|
framework: netkingdom-security-layer-model
|
|
standard_version: "0.7"
|
|
repository: secrets-engine
|
|
bound: "§9.6"
|
|
completeness_claimed: false
|
|
no_control_branches_on_presence: true
|
|
intended_destination: audit-core
|
|
destination_today: "local JSONL; load-bearing also queued in evidence_dir/outbox/"
|
|
sound_claim: >-
|
|
The archive proves the records it holds were not altered or truncated
|
|
after arrival. It does not prove a record was sent, and absence is not
|
|
evidence of non-occurrence.
|
|
|
|
cadence:
|
|
load_bearing_form: heartbeat
|
|
interval: 1d
|
|
action: evidence-heartbeat
|
|
claim: nothing-to-report
|
|
command: "secrets-engine evidence heartbeat"
|
|
|
|
# First match wins.
|
|
rules:
|
|
- id: heartbeat
|
|
kind: heartbeat
|
|
actions: [evidence-heartbeat]
|
|
stages: [build, test, prod, unknown]
|
|
emission: local-outbox
|
|
note: >-
|
|
Positive claim that can itself go missing. Queue depth is metadata,
|
|
not a permission.
|
|
|
|
- id: destroy
|
|
kind: load-bearing
|
|
actions: [lifecycle-destroy]
|
|
stages: [build, test, prod, unknown]
|
|
emission: local-outbox
|
|
note: Live destroy is currently disabled; refusals are still classified here.
|
|
|
|
- id: production-control-mutation
|
|
kind: load-bearing
|
|
actions: [revoke, lifecycle-suspend, lifecycle-deactivate, provision, session-revoke, wrap]
|
|
stages: [prod]
|
|
emission: local-outbox
|
|
note: >-
|
|
Production provision, revoke, and suspend/deactivate once enabled.
|
|
Production live remains fail-closed until an access-engine decision
|
|
record is served.
|
|
|
|
- id: default-attributive
|
|
kind: attributive
|
|
actions: ["*"]
|
|
stages: [build, test, prod, unknown]
|
|
emission: local-jsonl
|
|
trade: >-
|
|
State Hub progress posts are non-blocking. Completeness is not claimed.
|