cadrumo.application.operations.secret_submission module

Runtime-only, exact-bound ephemeral secret submission contracts and broker.

class OperationEphemeralSecretDeclaration(**data)[source]

Bases: BaseModel

Registry declaration for one bounded pre-executor secret requirement.

Parameters:

data (Any)

secret_kind: OperationSecretKind
lifetime: timedelta
class OperationSecretRequirement(**data)[source]

Bases: BaseModel

Credential-free durable identity of one exact runtime-only secret wait.

Parameters:

data (Any)

identity: OperationIdentity
interaction_id: OperationInteractionId
revision: OperationRevision
secret_kind: OperationSecretKind
expires_at: datetime
class OperationEphemeralSecretAccess(*args, **kwargs)[source]

Bases: Protocol

Executor-only scoped access to the submitted secret for its definition.

property requirement: OperationSecretRequirement

Return the exact durable requirement bound to this executor.

consume()[source]

Yield the secret once and wipe its backing storage on scope exit.

Return type:

AbstractAsyncContextManager[memoryview]

class EphemeralSecretBroker[source]

Bases: object

Supervisor-private mutable custody with no serialization surface.

submit(requirement, secret, *, observed_at)[source]
Return type:

None

Parameters:
has_exact(requirement, *, observed_at)[source]
Return type:

bool

Parameters:
consume(requirement, *, observed_at)[source]
Return type:

AsyncGenerator[memoryview]

Parameters:
discard(operation_id)[source]
Return type:

None

Parameters:

operation_id (OperationId)

close()[source]
Return type:

None

class BoundEphemeralSecretAccess(*, requirement, broker, clock)[source]

Bases: object

Parameters:
property requirement: OperationSecretRequirement
consume()[source]
Return type:

AbstractAsyncContextManager[memoryview]

zeroize_secret_buffer(buffer)[source]
Return type:

None

Parameters:

buffer (bytearray)