Repository navigation
REQ 093
A lane guest shall receive only the secrets its declaration lists by name, delivered only to the workload's build phase (not to its fetch phase, the probe, or the base image; REQ-106).
VMs produce evidence; they never publish. The engine cannot tell a publishing credential from any other secret without naming a consumer, so scoping by declared name lets a consumer keep its publish credential out of every declaration and in its own hosted publish job (challenge ledger row CH-09 in VITechnologies/projectbuddy#159). The evidence-record obligation formerly combined in this statement is separately allocated to REQ-116; the split does not remove a secret-handling safeguard.
The forwarded-name list in the evidence record (REQ-092) equals the declared list. No forwarded value occurs in any evidence byte; the check is a raw-value match, encoded forms are not detected, and the record says so. The dispatching job's own token reaches the guest only if declared. A secret present in the dispatching context but absent from the declaration is not observable in the guest or the evidence; a declared secret whose value the workload writes into a declared output fails the run instead of being retained; a declared name that the dispatching context does not provide fails before any VM mutation, never as a silently empty value.
Planned, TEST-095; not yet performed live. Offline fixture tests show that a declared secret missing or empty in the dispatching context is refused before any VM mutation, that the plan carries secret names only, on build-phase steps, that the values reach the guest only on standard input, and that the guest supervisor gives them to the build unit only. The evidence record's name list and raw-value check are still to come.
Software-Requirements-Specification
High
scripts/tests/test_lane_plan.py secret cases, scripts/tests/test_lane_placement.py secret cases, and scripts/tests/test_lane_supervisor.py secret cases; planned lane workload contract cases
scripts/lane/plan.py (secret-missing, and secret names only on the place-secrets and build steps), scripts/lane/placement.py (place_secrets: the values on standard input only, as root's own file with mode 0600, and never in a message), and scripts/lane/supervisor.py (the secrets on the build unit's standard input only), with docs/vm-provisioning/ubuntu-lane.md; the evidence record is not implemented
Planned