coulomb/secrets-engine
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
secrets-engine/workplans/ADHOC-2026-08-21.md
repo-manager ebdff586fe
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 2s
Details
repo.work.assign_missing_identifiers 
source: repo-manager
reason: deterministic projection registration

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a05e30-2884-71b0-98d7-7edd16ae737b
2026-09-04 00:03:13 +02:00

1.1 KiB
Raw Blame History

id type title domain repo status owner topic_slug created updated state_hub_workstream_id
SECRETS-WP-ADHOC-2026-08-21 workplan OpenBao dev-test and safe-path robustness infotech secrets-engine finished codex custodian 2026-08-21 2026-08-21 5580d785-c80f-5dbd-9ef8-22a630fa607b

SECRETS-WP-ADHOC-2026-08-21 - OpenBao dev-test and safe-path robustness

Keep verification safe in sandboxed environments

id: SECRETS-WP-ADHOC-2026-08-21-T01
status: done
priority: low
state_hub_task_id: "d50e7dca-ef90-5263-ad40-35ec8a6e5291"

While verifying SECRETS-WP-0006, the suite exposed two environment-sensitive test failures. OpenBao 2.5.5 dev mode attempted to persist its root token under the read-only home directory, and an empty /tmp/.git sandbox marker was treated as a real Git worktree.

The dev fixture now uses -dev-no-store-token. Secret provisioning and AppRole handoff still reject real worktrees (.git file or .git/HEAD) but ignore an empty directory that is not a valid Git marker. Unit coverage preserves both the rejection and false-positive cases.