tegwick
a852d3f1ff
Implements SECRETS-WP-0002 end to end as a uv-managed Python package: - catalog: non-secret lane registry + strict validator (build/test/prod) - stage roles + OpenBao ACL policies; guards refuse wildcards, sys/, identity/, admin names, and cross-stage paths before any backend call - plan/apply: dry-run-first, idempotent policy + approle apply, decision-gated - decisions: State Hub lookup with local-fixture fallback; non-secret evidence to JSONL + hub progress, scrubbed of any value - provision/verify: mode-0600 file import + generated test values; positive/ negative checks that never print the value - exec delivery: `exec --catalog ... -- npm publish` injects the token via a temp .npmrc for the child only, cleaned up on exit/failure/interrupt - ops-warden routing contract + hardening backlog docs - 34 tests incl. live OpenBao integration; scripts/demo-e2e.sh runs the full chain against a throwaway bao dev server Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
58 lines
1.5 KiB
Markdown
58 lines
1.5 KiB
Markdown
---
|
|
id: SECRETS-WP-0001
|
|
type: workplan
|
|
title: "Bootstrap State Hub integration"
|
|
domain: infotech
|
|
repo: secrets-engine
|
|
status: ready
|
|
owner: codex
|
|
topic_slug: custodian
|
|
created: "2026-06-28"
|
|
updated: "2026-06-28"
|
|
state_hub_workstream_id: "53f0c7b7-2899-4e91-a18e-67186775e2e2"
|
|
---
|
|
|
|
# Bootstrap State Hub integration
|
|
|
|
secrets-engine is a headless, multi-application, multi-tenant secrets workflow and automation layer that orchestrates approved secret custody, delivery, and lifecycle work across build, test, and production stages, with OpenBao as the initial enforcement backend.
|
|
|
|
## Review Generated Integration Files
|
|
|
|
```task
|
|
id: SECRETS-WP-0001-T01
|
|
status: todo
|
|
priority: high
|
|
state_hub_task_id: "e93ea995-8c3b-4892-ab09-70cf7e0a0346"
|
|
```
|
|
|
|
Review `INTENT.md`, `SCOPE.md`, `AGENTS.md`, and `.custodian-brief.md`.
|
|
Replace generated placeholders with repo-specific facts where needed.
|
|
|
|
## Verify Local Developer Workflow
|
|
|
|
```task
|
|
id: SECRETS-WP-0001-T02
|
|
status: todo
|
|
priority: high
|
|
state_hub_task_id: "3269b817-6e10-4e9f-804f-73a8b1ded920"
|
|
```
|
|
|
|
Identify the repo's install, test, lint, build, and run commands. Add or refine
|
|
those commands in the agent instructions so future coding sessions can verify
|
|
changes confidently.
|
|
|
|
## Seed First Real Workplan
|
|
|
|
```task
|
|
id: SECRETS-WP-0001-T03
|
|
status: todo
|
|
priority: medium
|
|
state_hub_task_id: "62de7242-1a4c-4ed0-a4e4-ebe17bcc06b6"
|
|
```
|
|
|
|
Create the first implementation workplan for the repository's most important
|
|
next change. After workplan file updates, run from `~/state-hub`:
|
|
|
|
```bash
|
|
make fix-consistency REPO=secrets-engine
|
|
```
|