Use enrolled OpenBao for Anima PAT issuance and delivery #783

Merged

toasterson merged 2 commits from codex/openbao-anima-pat-20261006 into main

2026-10-06 21:51:54 +00:00

toasterson commented

2026-10-06 19:34:39 +00:00

Owner

This is a local operator CLI, not a cluster service. Installation and the live October4 issuance/read receipts are documented. No new token or privilege grant is needed for this change; old server PATs are explicitly not reported as revoked.

Validation:17 focused Python tests pass, including actual age encryption, concurrent-process lock exclusion, uncertain issuance, CAS conflict/readback, and credential-output boundaries. Shell syntax and git diff whitespace checks pass. The suite is added to the shared Solstice job. Fresh native review/CI remain required.

Anima local work:01a112b3-1abf-7152-9c94-7d76b6949e54.

The Anima PAT helper previously depended on OS Keychain storage, which prevented enrolled operator sessions from restoring MCP access through the existing OpenBao identity. This replaces that path with supported Anima Login/IssuePat/Logout calls, CAS-protected OpenBao storage, encrypted recovery after ambiguous issuance, and a private consumer environment. The compatibility launcher always selects the dedicated enrolled writer; there is no Keychain or other-identity fallback. This is a local operator CLI, not a cluster service. Installation and the live October4 issuance/read receipts are documented. No new token or privilege grant is needed for this change; old server PATs are explicitly not reported as revoked. Validation:17 focused Python tests pass, including actual age encryption, concurrent-process lock exclusion, uncertain issuance, CAS conflict/readback, and credential-output boundaries. Shell syntax and git diff whitespace checks pass. The suite is added to the shared Solstice job. Fresh native review/CI remain required. Anima local work:01a112b3-1abf-7152-9c94-7d76b6949e54.

toasterson added 1 commit

2026-10-06 19:34:40 +00:00