Repository navigation
Agent secrets: vault seam (eligibility, consent, secret.use client) - #1006
Queued
aft-alfonso[bot] wants to merge 10 commits into
Queued
aft-alfonso[bot] wants to merge 10 commits into
aft-alfonso[bot] wants to merge 10 commits into
Conversation
Adds the vault seam campaign slice S2. `crate::secret` holds the contract's `secret.use` request and reply shapes (wire-contract v1 §15), a `SecretVault` trait with `resolve`/`material`/`audit`, the production stand-in that resolves nothing while the live vault is undeployed, and a real client (`SubcSecretVault`) built and tested against the contract's golden examples. `crates/aft/tests/fixtures/secret/secret-approval-v1.json` is a byte-for-byte copy of claustrum's pinned approval vectors (sha256 efd4ba60…495cc27); the seam's tests check every statement digest, the envelope digests and each statement's decoded fields. `crate::subc::secret_consent` is where a stamped route becomes an eligibility answer: three eligible forms (direct Head, direct Worker, a codemode run linked to the head the daemon bound), with separate authorization and lifetime scopes; the head stamp is re-checked with `alfonso()` rather than trusted from `resolve_owner`'s owner comparison. The module also carries the V3 outcome table's first-failing-label rule and the consent adapter, which files a secret ask under the head's authorization scope and never through `ask_route`, `run_with_consent` or `requested_ask`. Dispatch installs the eligibility answer once per tool call (`SecretScopeGuard`) so a launch reads it without the route identity and a background command keeps the scopes it resolved at launch. `secret-test-fake` compiles the fake vault only for tests. A CI step runs `scripts/check-secret-test-fake.sh`, which fails when a dependency edge, a default feature set or another crate would ship it; its self-test proves the guard goes red for each. Co-authored-by: alfonso-aft <289616620+alfonso-aft@users.noreply.github.com>
The comments named constraints by their spec labels (V1, V2, V3, A1, P3...), which a reader of the code has no way to look up. Each sentence now says what it means on its own. Co-authored-by: alfonso-aft <289616620+alfonso-aft@users.noreply.github.com>
…xposes Adds resolve_label_for_launch, the one entry a bash or fetch launch calls per scanned label: it refuses an ineligible scope before the vault is asked anything, then turns the resolution into proceed, a filed consent ask, or a refusal. The ineligible-form test now drives that entry with a vault that would grant the label installed, so its zero resolve/material counts mean the seam refused and not that the fake was never reached. New cases cover a run whose parent link is Pending, Ended or absent, a run parented one epoch above and below its bound head, a bound head stamp of the wrong kind, and a bound head stamp that is not owner-authorized. Co-authored-by: alfonso-aft <289616620+alfonso-aft@users.noreply.github.com>
Co-authored-by: alfonso-aft <289616620+alfonso-aft@users.noreply.github.com>
Co-authored-by: alfonso-aft <289616620+alfonso-aft@users.noreply.github.com>
…module registration) Co-authored-by: alfonso-aft <289616620+alfonso-aft@users.noreply.github.com>
Replace the seam's provisional flat label/request fields assertion with Cingulate 0.12.0's exact single-item secret_use envelope. Keep the supplied phone GET vector byte-for-byte, including its unpadded statement. Co-authored-by: alfonso-aft <289616620+alfonso-aft@users.noreply.github.com> (cherry picked from commit a8f13f2e8d5676ad1380e47748f5de93a1c41a90)
Share the existing permission-ask daemon transport without its permission decoder or AccessGrant path. Forward one unchanged vault item and rely on Cingulate's item idempotency. Both generic card answers retry the vault immediately; pending cards hold, and expired, withdrawn, refused or unknown responses fail closed. Keep UnavailableVault in production. Add transport-context fields to the seam request without exposing them in the filed card. Response fixture pinning and final filtered gates follow when the owner supplies the 0.12.0 v1.1 vectors. Co-authored-by: alfonso-aft <289616620+alfonso-aft@users.noreply.github.com> (cherry picked from commit 1d08728e83e768106af55826761cab7e5c08d7eb)
Use Cingulate 0.12.0 secret-use-approval-v1.1 fixtures supplied from 133351a byte-for-byte. Generic await states are pending, answered and expired; allow, partial and decline all trigger the same vault retry. Replace provisional service samples with eight pinned filer fixtures and independent hash assertions. Per the owner's contract, leave withhold fail-closed without sending an unsupported withdrawal method, preserving original card expiry. Verification: cargo fmt --all -- --check (rustfmt 1.10.0-stable); cargo test -p agent-file-tools --lib secret (68 passed); cargo check --target x86_64-pc-windows-gnu --tests (Finished). All ran on linux,2c. The exact-body regression was shown red before the fix: flat label/request/statement fields differed from the required single-item envelope. No mutation checks or full suite were run. Co-authored-by: alfonso-aft <289616620+alfonso-aft@users.noreply.github.com> (cherry picked from commit 5f5e9feb39ad6fecee4105855f5b2b5a3349fba5)
Co-authored-by: alfonso-aft <289616620+alfonso-aft@users.noreply.github.com>
ualtinok
added this pull request to the merge queue
Oct 26, 2026
Any commits made after this event will not be merged.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Replaces #1002, which GitHub closed when its base branch (the merged #990) was deleted. Nothing user-visible: production keeps the fail-closed stand-in vault, so every secret placeholder still refuses.