tegwick a852d3f1ff feat(mvp): working secrets-engine CLI for the whynot-design npm publish lane

Implements SECRETS-WP-0002 end to end as a uv-managed Python package:

- catalog: non-secret lane registry + strict validator (build/test/prod)
- stage roles + OpenBao ACL policies; guards refuse wildcards, sys/, identity/,
  admin names, and cross-stage paths before any backend call
- plan/apply: dry-run-first, idempotent policy + approle apply, decision-gated
- decisions: State Hub lookup with local-fixture fallback; non-secret evidence
  to JSONL + hub progress, scrubbed of any value
- provision/verify: mode-0600 file import + generated test values; positive/
  negative checks that never print the value
- exec delivery: `exec --catalog ... -- npm publish` injects the token via a
  temp .npmrc for the child only, cleaned up on exit/failure/interrupt
- ops-warden routing contract + hardening backlog docs
- 34 tests incl. live OpenBao integration; scripts/demo-e2e.sh runs the full
  chain against a throwaway bao dev server

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

2026-06-28 12:28:45 +02:00

2.7 KiB

Raw Blame History

secrets-engine

Headless, multi-application, multi-tenant secrets workflow and automation layer for approved secret custody, delivery, and lifecycle work across build, test, and production stages.

OpenBao remains the custody and enforcement backend. secrets-engine owns the operator and agent interaction model: catalog, decision checks, plan/apply, safe provisioning, verification, delivery, evidence, rotation, and deactivation.

Start Here

INTENT.md - why this repository exists.
ProductRequirementsDocument.md - product requirements and MVP scope.
NetKingdom security infrastructure boundary pointer
- points to the canonical document in net-kingdom/docs/, covering responsibilities and interactions with OpenBao, flex-auth, user-engine, ops-warden, ops-bridge, info-tech-canon, State Hub, and agents.
Bootstrap MVP workplan - first implementation plan after State Hub bootstrap.

Core Direction

The MVP proves the whynot-design-npm-publish lane end to end:

describe the lane in a non-secret catalog (catalog/);
verify an approved decision (State Hub or local fixture);
apply OpenBao policy/auth metadata through a stage-aware role;
provision and verify the value without printing it;
run a workload command through safe exec-time delivery.

Target command shape:

secrets-engine exec --catalog whynot-design-npm-publish -- npm publish

Quickstart

uv venv && uv pip install -e ".[dev]"
source .venv/bin/activate
secrets-engine catalog list

# Run the whole pilot chain live against a throwaway OpenBao dev server:
SECRETS_ENGINE_HUB_URL="" bash scripts/demo-e2e.sh

CLI reference: docs/cli.md
Stage roles & bootstrap tokens: docs/openbao-stage-roles.md
ops-warden routing contract: docs/ops-warden-routing-contract.md
Hardening backlog (exit bootstrap mode): docs/hardening-backlog.md

The implementation is a Python package (src/secrets_engine/). OpenBao is reached only through the bao CLI adapter (openbao.py); the rest of the code speaks in lanes and guarded plans.

Security Rules

Do not put raw secret values in Git, State Hub, chat, prompts, issue comments, workplans, or normal logs.
OpenBao is the backend custody and audit authority.
Build, test, and production have separate policy boundaries.
Production actions require approved decisions except explicit break-glass flows.
Temporary bootstrap OpenBao credentials must live outside repos, use mode 0600, be revocable, and be removed after narrower auth is working.