Reconcile uncertain delivery and invalidate orphan credentials #23

New issue

Closed

opened 2026-08-29 19:53:25 +00:00 by larandar · 0 comments

larandar commented

2026-08-29 19:53:25 +00:00

Owner

Proposal

Resolve missing OpenBao acknowledgements without redelivering secrets or destroying credentials that belong to committed leases.

Delivery class

agent-unit — implement src/reconcile.rs against captured OpenBao lease-state fixtures.

Design

Compare operation and token IDs with committed lease metadata. Recover acknowledgement for a match. Mark a missing or mismatched lease token orphaned, invalidate it by exact token ID, and require a new operation ID before replacement. Partial invalidation remains visible and retryable.

Tasks

Add acknowledgement timeout and delivery_uncertain selection.
Reconcile committed, missing, and mismatched lease fixtures.
Invalidate only confirmed orphan token IDs.
Prove replacement cannot race an active untracked orphan.

Specification Delta

Requirement: acknowledgement loss is not evidence of lease loss

Scenario: OpenBao committed but its acknowledgement was lost

GIVEN a minted token and matching committed lease generation
WHEN reconciliation runs
THEN it recovers acknowledgement without invalidating or redelivering the credential

OpenSpec

OpenSpec 20

Structural parent

Vedanta#20

## Proposal Resolve missing OpenBao acknowledgements without redelivering secrets or destroying credentials that belong to committed leases. ## Delivery class `agent-unit` — implement `src/reconcile.rs` against captured OpenBao lease-state fixtures. ## Design Compare operation and token IDs with committed lease metadata. Recover acknowledgement for a match. Mark a missing or mismatched lease token orphaned, invalidate it by exact token ID, and require a new operation ID before replacement. Partial invalidation remains visible and retryable. ## Tasks - [ ] Add acknowledgement timeout and `delivery_uncertain` selection. - [ ] Reconcile committed, missing, and mismatched lease fixtures. - [ ] Invalidate only confirmed orphan token IDs. - [ ] Prove replacement cannot race an active untracked orphan. ## Specification Delta ### Requirement: acknowledgement loss is not evidence of lease loss #### Scenario: OpenBao committed but its acknowledgement was lost - **GIVEN** a minted token and matching committed lease generation - **WHEN** reconciliation runs - **THEN** it recovers acknowledgement without invalidating or redelivering the credential ## OpenSpec [OpenSpec 20](https://jo.et0.pw/Ting/Vedanta/wiki/OpenSpec-20-openbao-forge-identity-lifecycle) ## Structural parent [Vedanta#20](https://jo.et0.pw/Ting/Vedanta/issues/20)

larandar added the

Kind/Feature

Kind/Security

labels

2026-08-29 19:53:26 +00:00

larandar referenced this issue

2026-08-29 19:53:27 +00:00

Session: OpenBao-owned Forge identity leases and private Vedanta effect #20

larandar added a new dependency

2026-08-29 19:53:55 +00:00

#20 Session: OpenBao-owned Forge identity leases and private Vedanta effect

larandar added a new dependency