secrets-engine/workplans/SECRETS-WP-0012-keycape-openbao-consumer-custody.md

id	type	title	domain	repo	status	flavor	owner	topic_slug	created	updated	related_workplans	state_hub_workstream_id
SECRETS-WP-0012	workplan	KeyCape secrets-engine-openbao consumer custody acceptance	infotech	secrets-engine	finished	implementation	claude-code	custodian	2026-10-06	2026-10-10	SECRETS-WP-0008	143de42b-b568-5070-add0-d5e71eabd436

SECRETS-WP-0012 - KeyCape secrets-engine-openbao consumer custody acceptance

Demand: KEY-WP-0037-T02 and RPF-WP-0035-T02 (proposed CCR-2026-0033) need secrets-engine's source acceptance of the consumer copy of the secrets-engine-openbao client secret: host, owner, path, mode, delivery, rotation/revocation ownership and a bounded validation interface. The founder approved the two-copy custody boundary (decision 632a8893-0d6a-4591-a50b-40bbdb798f32), not generation, fetch, delivery, registration or deployment. Live service-JWT adoption stays SECRETS-WP-0008-T06.

Redirected 2026-10-06: founder direction keeps the secret only in OpenBao, and the ops-mason plan keycape-secrets-engine-openbao-client-custody (658cdbc) replaces the consumer file with a per-command in-memory read (T02 cancelled, T04 implements it, T03 is the first live use). T01's file checks remain for the approval client only.

Packet: docs/keycape-openbao-consumer-custody.md.

Consumer packet and strict file acceptance

id: SECRETS-WP-0012-T01
status: done
priority: high
state_hub_task_id: "d7978a83-0760-5763-a42f-77721fdeff1d"

Done 2026-10-06. The packet names the coordinates and marks D1-D4 as founder decisions with recommendations. service_auth.read_client_secret_file now refuses symlinked, foreign-owned, non-regular, shared-parent and multi-token files in addition to the earlier mode, worktree and empty checks. secrets-engine service-auth check-secret-file is the value-free validation interface. Synthetic tests are in tests/test_consumer_secret_file.py. Full suite: 510 passed, 1 skipped (root-only owner test).

Founder decisions D1-D4

id: SECRETS-WP-0012-T02
status: cancel
priority: high
state_hub_task_id: "b95da704-ce13-5bf5-be3b-126e894a669d"

Cancelled 2026-10-06: superseded by founder direction 2026-10-06 (the client secret lives only in OpenBao, no workstation copy) and the ops-mason plan keycape-secrets-engine-openbao-client-custody (658cdbc, MASON-WP-0009). D1-D4 (host, OS user, persistent file, rotation cadence) no longer apply.

In-memory OpenBao secret source

id: SECRETS-WP-0012-T04
status: done
priority: high
state_hub_task_id: "be26828b-1faf-53a1-bc49-77c4cc80f1ca"

Done 2026-10-06. service_auth.OpenBaoOidcClientSecretSource: attended bao login -method=oidc -path=netkingdom -no-store -format=json on role keycape-secrets-engine-openbao-operator-workload-kv-read, token from a stdout pipe, ambient BAO_TOKEN/VAULT_TOKEN stripped, header-only GET of platform/data/workloads/keycape/secrets-engine-openbao field CLIENT_SECRET, unconditional revoke-self, then the KeyCape exchange and OpenBao JWT login. The file source is refused for this profile (kept for the approval client). secrets-engine service-auth probe-openbao prints value-free evidence. Synthetic tests: tests/test_openbao_secret_source.py. Docs: docs/keycape-openbao-consumer-custody.md (rewritten), docs/service-auth.md, docs/cli.md.

First live attended use

id: SECRETS-WP-0012-T03
status: done
priority: high
state_hub_task_id: "1c3afd34-4aa3-5484-a9c7-2db577225269"

Acceptance: the one-line JSON from service-auth probe-openbao --json with ok: true, secret_source: openbao-oidc-in-memory, both accessor fingerprints and both revoke-self results true, recorded without any value, token or full accessor. This is the evidence for KEY-WP-0037-T04, RPF-WP-0035-T02 and plan verification item 6; OpenBao login proof also closes into SECRETS-WP-0008-T06.

Result 2026-10-10: the founder ran the attended probe and it passed with ok: true, secret_source: openbao-oidc-in-memory, both revoke-self results true, and session handles 0204e60340d2 (service) and 4e9c487b6206 (operator). Evidence: docs/evidence/2026-10-10-keycape-openbao-probe.json. The CCR-2026-0038 negative checks remain with railiance-platform under RPF-WP-0035-T02.