Implement OpenBao lease read, rotation, and revocation transitions #24

New issue

Closed

opened 2026-08-29 19:53:26 +00:00 by larandar · 0 comments

larandar commented

2026-08-29 19:53:26 +00:00

Owner

Proposal

Implement the non-issue OpenBao lease state machine after initial authorization and delivery exist.

Delivery class

agent-unit — implement openbao-plugin/src/lease.rs with deterministic state-machine tests.

Design

Read returns metadata only. Rotation re-evaluates the active grant, retains the lease ID, and creates a distinct successor token and generation. Revoke denies further lease use immediately and remains revocation_pending until every downstream token invalidation completes.

Tasks

Implement metadata-only ReadLease.
Implement successor RotateLease with grant re-evaluation.
Implement RevokeLease and pending downstream invalidation state.
Test suspension, concurrent rotation, partial failure, and secret non-recovery.

Specification Delta

Requirement: lease transitions never recover an old secret

Scenario: a caller reads or retries an existing lease

GIVEN a committed credential generation
WHEN the caller reads status or retries a transition
THEN only metadata is returned and no previous credential value is recoverable

OpenSpec

OpenSpec 20

Structural parent

Vedanta#20

## Proposal Implement the non-issue OpenBao lease state machine after initial authorization and delivery exist. ## Delivery class `agent-unit` — implement `openbao-plugin/src/lease.rs` with deterministic state-machine tests. ## Design Read returns metadata only. Rotation re-evaluates the active grant, retains the lease ID, and creates a distinct successor token and generation. Revoke denies further lease use immediately and remains `revocation_pending` until every downstream token invalidation completes. ## Tasks - [ ] Implement metadata-only `ReadLease`. - [ ] Implement successor `RotateLease` with grant re-evaluation. - [ ] Implement `RevokeLease` and pending downstream invalidation state. - [ ] Test suspension, concurrent rotation, partial failure, and secret non-recovery. ## Specification Delta ### Requirement: lease transitions never recover an old secret #### Scenario: a caller reads or retries an existing lease - **GIVEN** a committed credential generation - **WHEN** the caller reads status or retries a transition - **THEN** only metadata is returned and no previous credential value is recoverable ## OpenSpec [OpenSpec 20](https://jo.et0.pw/Ting/Vedanta/wiki/OpenSpec-20-openbao-forge-identity-lifecycle) ## Structural parent [Vedanta#20](https://jo.et0.pw/Ting/Vedanta/issues/20)

larandar added the

Kind/Feature

Kind/Security

labels

2026-08-29 19:53:26 +00:00

larandar referenced this issue

2026-08-29 19:53:27 +00:00

Session: OpenBao-owned Forge identity leases and private Vedanta effect #20

larandar added a new dependency

2026-08-29 19:53:55 +00:00

#20 Session: OpenBao-owned Forge identity leases and private Vedanta effect

larandar added a new dependency