Ting/Vedanta

Watch

Fork 0

Authorize and issue OpenBao identity leases #12

New issue

Closed

opened 2026-08-26 07:38:30 +00:00 by agent.odin · 1 comment

agent.odin commented

2026-08-26 07:38:30 +00:00

Owner

Proposal

Implement OpenBao authorization, provisional lease creation, private mint dispatch, commit, and one-shot wrapped delivery for initial identity leases.

Delivery class

agent-unit — add openbao-plugin/src/issue.rs with authorization-table and private-service capture doubles.

Design

Evaluate caller, claimant, grant, principal, assignment, isolation, resource, operation, audience, TTL, active limit, digest, and projection freshness in order. Persist pre-mutation intent, call Vedanta through the private contract, and commit only after mint succeeds.

Tasks

Add IssueLease request, response, and stable error classes.
Implement the ordered authorization table.
Bind signed commands to the exact grant and operation.
Commit and wrap the credential once only after successful mint.

Specification Delta

Requirement: failed internal mint creates no lease

Scenario: Vedanta or Kanidm refuses the operation

GIVEN an otherwise authorized request
WHEN private mint fails
THEN OpenBao returns neither a committed lease nor credential material

OpenSpec

OpenSpec 20

Structural parent

Vedanta#20

## Proposal Implement OpenBao authorization, provisional lease creation, private mint dispatch, commit, and one-shot wrapped delivery for initial identity leases. ## Delivery class `agent-unit` — add `openbao-plugin/src/issue.rs` with authorization-table and private-service capture doubles. ## Design Evaluate caller, claimant, grant, principal, assignment, isolation, resource, operation, audience, TTL, active limit, digest, and projection freshness in order. Persist pre-mutation intent, call Vedanta through the private contract, and commit only after mint succeeds. ## Tasks - [ ] Add `IssueLease` request, response, and stable error classes. - [ ] Implement the ordered authorization table. - [ ] Bind signed commands to the exact grant and operation. - [ ] Commit and wrap the credential once only after successful mint. ## Specification Delta ### Requirement: failed internal mint creates no lease #### Scenario: Vedanta or Kanidm refuses the operation - **GIVEN** an otherwise authorized request - **WHEN** private mint fails - **THEN** OpenBao returns neither a committed lease nor credential material ## OpenSpec [OpenSpec 20](https://jo.et0.pw/Ting/Vedanta/wiki/OpenSpec-20-openbao-forge-identity-lifecycle) ## Structural parent [Vedanta#20](https://jo.et0.pw/Ting/Vedanta/issues/20)

agent.odin added the

Kind/Feature

Status/Need Grooming

Status/Need More Info

labels

2026-08-26 07:38:30 +00:00

agent.odin commented

2026-08-26 07:38:31 +00:00

Author

Owner

Grooming state: Clarified by later authority
Evidence: Ratified OpenSpec 61 v0.1.4, current OpenSpec 20, and the refined #12/#22 records now define one-shot wrapped delivery and a dedicated authenticated, signed OpenBao→Vedanta private-command boundary.

The former Q1 delivery-contract and Q2 plugin-authority questions are no longer open. #12 remains the initial OpenBao authorization and lease-issue implementation unit governed by its current body; #22 owns private peer and command validation.

Larandar: no owner decision remains on this record.

**Grooming state:** Clarified by later authority **Evidence:** Ratified [OpenSpec 61 v0.1.4](https://jo.et0.pw/Ting/Ting/wiki/OpenSpec-61-forge-identity-lifecycle-contract), current [OpenSpec 20](https://jo.et0.pw/Ting/Vedanta/wiki/OpenSpec-20-openbao-forge-identity-lifecycle), and the refined #12/#22 records now define one-shot wrapped delivery and a dedicated authenticated, signed OpenBao→Vedanta private-command boundary. The former Q1 delivery-contract and Q2 plugin-authority questions are no longer open. #12 remains the initial OpenBao authorization and lease-issue implementation unit governed by its current body; #22 owns private peer and command validation. **Larandar:** no owner decision remains on this record.

larandar referenced this issue

2026-08-29 17:05:03 +00:00

Session: OpenBao-owned Forge identity leases and private Vedanta effect #20

larandar added a new dependency

2026-08-29 17:06:39 +00:00

#20 Session: OpenBao-owned Forge identity leases and private Vedanta effect

larandar changed title from ~~OpenBao plugin: expose Vedanta-backed agent credentials~~ to OpenBao lease backend for Vedanta-backed Forge identity credentials

2026-08-29 17:07:55 +00:00

larandar added

Kind/Security

and removed

Status/Need Grooming

Status/Need More Info

labels

2026-08-29 17:08:16 +00:00

larandar changed title from ~~OpenBao lease backend for Vedanta-backed Forge identity credentials~~ to Authorize and issue OpenBao identity leases

2026-08-29 19:53:27 +00:00

larandar added a new dependency

2026-08-29 19:53:56 +00:00

#22 Authenticate and validate private lifecycle commands

larandar added a new dependency

2026-08-29 19:53:56 +00:00

#21 Persist the operation journal and non-secret status acknowledgements

larandar added a new dependency

2026-08-29 19:53:56 +00:00

#24 Implement OpenBao lease read, rotation, and revocation transitions

~~larandar referenced this issue 2026-08-30 08:55:04 +00:00~~

session 20: the private lease contract end to end — validate, journal, mutate, reconcile, issue, rotate/revoke (#22 #8 #21 #23 #12 #24) #27