tegwick 8e9383a33a feat: opt-in flex-auth policy gate and OpenBao verify (WP-0007) ...

Add policy.py client that calls flex-auth /v1/check before sign/issue when
policy.enabled is true. Record policy_decision_id in signatures.log. Default
off preserves existing inventory-only behavior. Document production OpenBao
health probe and update config/wiki references.

2026-06-17 08:37:14 +02:00

4.5 KiB

Raw Blame History

View Raw