tegwick
06dfe12c18
Planning stays off the store client. The process binds one stage credential at start, serve runs the same lifecycle library, and a local allow flag does not authorize a protected call. Assistant: grok Assistant-Session: 01a1609f-72b8-7222-9dff-fae300115e42
128 lines
4.7 KiB
Markdown
128 lines
4.7 KiB
Markdown
---
|
|
id: SECRETS-WP-0016
|
|
type: workplan
|
|
title: "Manifest the lifecycle engine as one library, a CLI, and a single-stage service"
|
|
domain: infotech
|
|
repo: secrets-engine
|
|
status: finished
|
|
owner: secrets-engine
|
|
topic_slug: custodian
|
|
created: "2026-10-22"
|
|
updated: "2026-10-22"
|
|
reviewed_at: "2026-10-22"
|
|
reviewed_against_commit: "39314c18b611351294a8cf2cf26a3c938425d12d"
|
|
quality_dor: DoR-Ok
|
|
quality_dor_at: "2026-10-22"
|
|
quality_dor_by: "grok"
|
|
flavor: implementation
|
|
depends_on: []
|
|
related: [SECRETS-WP-0008, SECRETS-WP-0014]
|
|
state_hub_workstream_id: "5f5e0a89-176d-5482-b388-a42685065cd0"
|
|
---
|
|
|
|
Implements the engine shape in `INTENT.md` after gate-house ADR-015
|
|
(accepted 2026-10-22) and `ArchitectureBlueprint.md` §2.2.
|
|
|
|
Reviewed against the tree on 2026-10-22. `secrets_engine.plan.build_plan`
|
|
renders a plan without an OpenBao client. `secrets_engine.cli` is the process,
|
|
bound to one stage credential at start. `serve` keeps that same library
|
|
running for the bound stage. `SCOPE.md` records the library, the one-stage
|
|
CLI, and that in-process manifestation. Exec-time delivery remains the default
|
|
for a one-task caller. `service-jwt` can log in and cannot yet carry engine
|
|
actions. Accepted security-layer-model v0.8 still governs PEP behavior.
|
|
Proposed v0.9 §3.3 carries the same engine wording and does not yet govern.
|
|
|
|
This workplan does not add a release-unit declaration, does not deploy a
|
|
workload, and does not make this engine the only client of OpenBao or a
|
|
decider of who may use it.
|
|
|
|
## Lock the library boundary
|
|
|
|
```task
|
|
id: SECRETS-WP-0016-T01
|
|
status: done
|
|
priority: high
|
|
state_hub_task_id: "4319d9c6-f7e1-500c-9011-a58c216d555d"
|
|
```
|
|
|
|
`build_plan` and the catalog validation it depends on stay free of the OpenBao
|
|
client. Add a test that calls the shipped `build_plan` for a fixture lane and
|
|
asserts no OpenBao client is constructed. If a plan path constructs one, move
|
|
that call to the process that applies the plan.
|
|
|
|
Done when that test passes against `src/secrets_engine/plan.py` and the apply
|
|
path still performs the OpenBao calls.
|
|
|
|
## Inject one stage credential at process start
|
|
|
|
```task
|
|
id: SECRETS-WP-0016-T02
|
|
status: done
|
|
priority: high
|
|
depends_on: [SECRETS-WP-0016-T01]
|
|
state_hub_task_id: "f5d5e9ba-ba56-56cc-8920-1417d70beb1d"
|
|
```
|
|
|
|
The CLI process binds to exactly one stage, `build`, `test`, or `production`.
|
|
That stage's OpenBao credential is supplied to the process at start and is not
|
|
printed, returned, or written to Git, State Hub, logs, or the workplan. A
|
|
second stage credential present in the same process is a startup failure.
|
|
|
|
Done when a test starts the shipped CLI entry against fixture configuration,
|
|
shows one stage bound, shows the credential value absent from stdout and
|
|
stderr, and shows startup failure when two stage credentials are present.
|
|
|
|
## Manifest the same library as a single-stage service
|
|
|
|
```task
|
|
id: SECRETS-WP-0016-T03
|
|
status: done
|
|
priority: medium
|
|
depends_on: [SECRETS-WP-0016-T02]
|
|
state_hub_task_id: "c37280f3-e9d0-5cdd-ba15-a95ec5f9aa0c"
|
|
```
|
|
|
|
Add a service manifestation of the same library and the same one-stage
|
|
injection. It is a kept-running process, not a second implementation and not a
|
|
Deployment. It does not accept another stage's credential.
|
|
|
|
Done when an in-process test starts that manifestation for one stage and a
|
|
lifecycle call goes through the shipped library functions used by the CLI.
|
|
|
|
## Consume use, do not decide it
|
|
|
|
```task
|
|
id: SECRETS-WP-0016-T04
|
|
status: done
|
|
priority: medium
|
|
depends_on: [SECRETS-WP-0016-T03]
|
|
state_hub_task_id: "89b71b5b-a2ce-57d6-b16b-0f94d76e0104"
|
|
```
|
|
|
|
Permission to start or call an instance is an access-engine decision. This
|
|
repository documents the claim it will consume and does not invent a local
|
|
allow-list. A caller-supplied flag or config key must not authorize apply or
|
|
the service. Protected side effects keep the existing rule: a decision record
|
|
or the published unreachable-engine stance. v0.8 PEP obligations stay.
|
|
|
|
Done when a test shows a local allow flag does not authorize a protected call,
|
|
and the claim shape is written in `docs/` without storing a credential.
|
|
|
|
## Record the manifestations in SCOPE
|
|
|
|
```task
|
|
id: SECRETS-WP-0016-T05
|
|
status: done
|
|
priority: low
|
|
depends_on: [SECRETS-WP-0016-T03, SECRETS-WP-0016-T04]
|
|
state_hub_task_id: "6b013ea1-4a04-57e8-bab2-acb196303e0a"
|
|
```
|
|
|
|
Update `SCOPE.md` so it describes the library, the one-stage CLI, and the
|
|
service manifestation that the code then contains. State that other engines
|
|
may use OpenBao for other capabilities. Remove the claim that service delivery
|
|
is absent only for the manifestation this workplan adds. Leave exec-time
|
|
delivery as the default for a one-task caller.
|
|
|
|
Done when `SCOPE.md` matches the shipped commands and tests, and does not
|
|
describe a cluster Deployment this workplan did not add.
|