Ting/Vedanta
Watch
2
0
Fork
You've already forked Vedanta
 0
Code Issues 8 Pull requests Projects Releases Packages Wiki Activity Actions
Page: OpenSpec 20 openbao forge identity lifecycle
Pages
OpenSpec 20 openbao forge identity lifecycle OpenSpec 30 agent identity pool lifecycle OpenSpec documentation-log grooming-log
3 OpenSpec 20 openbao forge identity lifecycle
~larandar edited this page 2026-08-30 08:07:07 +02:00
Table of contents

OpenSpec 20 — OpenBao Forge identity lifecycle

Status: proposed Version: 0.1.4 Session: Ting/Vedanta#20 Epic: Ting/Ting#60

Proposal

OpenBao is the only workload-facing lease authority; Vedanta is its private resource-credential effector. The Session delivers bounded Forge token issue under the active queen holder, one-shot delivery, successor rotation, exact deletion, idempotency, lost-delivery compensation, and secret-free audit without assigning principal or pool mutation to Vedanta.

Design

The repository-scoped formal package is under openspec/changes/openbao-forge-identity-lifecycle. The exact complete 0.1.4 source package is pinned in references/canonical/ with canonical combined SHA-256 3af93de7e11433a89f4181ba7ea7624063ca78af81bdc1f40c6947f11f9198cb.

The governing cross-repository contract is OpenSpec 61. This projection owns only OpenBao and Vedanta's private runtime semantics and cannot widen that contract or take ownership of provider, pool, or resource-native policy.

Tasks

  • #8 — bounded mint, successor rotation, exact token-ID invalidation.
  • #12 — OpenBao issue/read/rotate/revoke lease backend and ordered authorization.
  • #21 — write-ahead operations, replay safety, delivery acknowledgement, orphan compensation, reconciliation.

Specification Delta

The delta requires a private authenticated command boundary, exact drone and active queen-tenure validation, the queen/grant/token visibility intersection, one-shot credential transit, stable error/event classes, idempotent mutation, correct lost-ack handling, 30/10/5/5 timing, handover reconciliation, exact Forge token deletion, worker-reuse gating while revocation is pending, and a complete non-secret audit join. All ten realized pool principals carry immutable grants, but Vedanta only consumes their deployed projection when a drone requests a lease.

Delivery decomposition

One PR carries six isolated Deliverables for a single interface-compatibility verdict.

Deliverable Surface
#8 Bounded Kanidm mutation adapter.
#22 Private command authentication and validation.
#21 Operation journal, status, and acknowledgement.
#23 Lost-delivery and orphan reconciliation.
#12 Initial OpenBao authorization and lease issue.
#24 Lease read, rotation, and revocation.