{
  "schema": "varexis-public-evidence-record/0.3",
  "generated_at_utc": "2026-10-16T07:59:18.009Z",
  "record_id": "VXI-EXT-PROCUREMENT-VAULT-WRAP-01-v1",
  "record_kind": "external_reference",
  "title": "Vault wrapping: Delivery-token expiry is not secret expiry",
  "system": "HashiCorp Vault",
  "evidence_family": "vendor_evidence_review",
  "index_status": "PUBLIC_SAFE_SOURCE_REVIEW",
  "evidence_state": "PRIMARY_DOCUMENTATION_REVIEW_ONLY",
  "canonical_question": "Does a short-lived Vault wrapping token make the underlying secret expire at the same time?",
  "near_questions": [
    "Is a wrapping token single-use?",
    "Does its TTL equal the secret lifetime?",
    "Can the creation path be inspected before unwrap?",
    "Does failed unwrap prove interception?",
    "Could the token have expired first?",
    "Which Vault server validates the token?",
    "Does the wrapping response contain the original secret?",
    "Can a relay inspect the wrapped secret without unwrapping?",
    "What separate lease evidence is needed?",
    "Who is authorised to unwrap it?",
    "When should an agent investigate an unexpected unwrap failure?",
    "Can I save the wrapped-delivery review?"
  ],
  "supported_claims": [
    {
      "claim": "Response wrapping delivers a single-use token with its own lifetime instead of the original response. That lifetime is separate from the wrapped secret. Creation-path inspection and unwrap status help review delivery, but failed unwrapping alone does not prove interception; expiry is another possible cause.",
      "reliance": "DOCUMENTED_CAPABILITY_ONLY"
    }
  ],
  "not_demonstrated_claims": [
    "Verified buyer configuration or effective access rights",
    "Independent execution, completeness or security testing",
    "Vendor certification, legal compliance or guaranteed suitability"
  ],
  "public_summary": "Response wrapping delivers a single-use token with its own lifetime instead of the original response. That lifetime is separate from the wrapped secret. Creation-path inspection and unwrap status help review delivery, but failed unwrapping alone does not prove interception; expiry is another possible cause.",
  "related_record_ids": [],
  "source_review": {
    "source_type": "official_external_documentation",
    "source_title": "Vault response wrapping",
    "source_url": "https://developer.hashicorp.com/vault/docs/concepts/response-wrapping",
    "checked_on": "2026-10-16",
    "candidate_record_id": "VXI-EXT-PROCUREMENT-VAULT-WRAP-01-v1",
    "candidate_record_sha256": "60d0c5b61592e25fd61b393a4ab890992f105fc9b8713bf41e6ad0439a6dff1c",
    "method": "Primary documentation reviewed for the published bounded statement.",
    "deployment_tested_by_varexis": false,
    "revalidation": "The delivered snapshot preserves the review date shown. Recheck current primary documentation and deployment context before relying on present applicability; payment does not trigger fresh research."
  },
  "answer_policy": {
    "classification": "DOCUMENTED_WITH_DEPLOYMENT_BOUNDARY",
    "bounded_answer": "Response wrapping delivers a single-use token with its own lifetime instead of the original response. That lifetime is separate from the wrapped secret. Creation-path inspection and unwrap status help review delivery, but failed unwrapping alone does not prove interception; expiry is another possible cause.",
    "required_buyer_context": "Wrapping metadata, origin, unwrap state and secret lifecycle. Effective buyer configuration and dated operational evidence are required.",
    "missing_evidence": "A broader claim needs evidence matching the intended use. Payment does not upgrade the evidence state."
  },
  "private_boundary": "Raw logs, thresholds, private paths, source code, protected mechanisms and reconstruction-level details are excluded from public and paid delivery.",
  "decision_profile": {
    "schema": "varexis-vendor-evidence-review/1",
    "review_status": "documentation_review_only",
    "checked_on": "2026-10-16",
    "claim_to_check": "A wrapping token's lifetime is the lifetime of the wrapped credential.",
    "documented_statement": {
      "status": "documented",
      "statement": "Response wrapping delivers a single-use token with its own lifetime instead of the original response. That lifetime is separate from the wrapped secret. Creation-path inspection and unwrap status help review delivery, but failed unwrapping alone does not prove interception; expiry is another possible cause.",
      "source_ids": [
        "vault-wrap"
      ]
    },
    "buyer_evidence_required": [
      "Wrapping creation path and expiry metadata.",
      "Underlying secret or lease lifecycle.",
      "Authorized unwrap outcome."
    ],
    "review_condition": {
      "status": "varexis_review_policy",
      "statement": "Keep delivery-token and underlying-credential lifetime claims separate."
    },
    "unknowns": "The buyer configuration, contract, effective entitlement and operational evidence have not been inspected. Missing evidence does not establish absence or failure of the feature.",
    "evidence_sources": [
      {
        "source_id": "vault-wrap",
        "url": "https://developer.hashicorp.com/vault/docs/concepts/response-wrapping",
        "final_url": "https://developer.hashicorp.com/vault/docs/concepts/response-wrapping",
        "title": "Vault response wrapping",
        "checked_on": "2026-10-16",
        "sha256": "319b0564b8ea743d0f2e50eaa2494755790f7fc1fe36df7c11605e26800100e9",
        "bytes": 279970
      }
    ],
    "observed_deployment": false,
    "commercial_reliance_boundary": "Procurement evidence support only; no supplier clearance, legal conclusion, configuration audit or verification of the buyer's claim is supplied.",
    "paid_value": {
      "decision_context": "Retain separate delivery and credential-lifetime evidence for a secret handoff.",
      "free": "Complete review, practical questions, sources and limitations; may be saved locally.",
      "single_request": "Existing server-saved version-bound route snapshot for later authenticated retrieval.",
      "evidence_receipt": "The same snapshot plus the existing unsigned delivery receipt.",
      "excluded": [
        "Fresh vendor research",
        "Continuous monitoring or change alerts",
        "Testing the buyer configuration",
        "Private evidence or vendor certification"
      ],
      "integrity": "Hashes identify content versions; they do not prove truth or provide a signature."
    },
    "revalidation": {
      "trigger": "A saved purchase does not recheck the source or buyer configuration.",
      "specific_watch": "Wrapping metadata, origin, unwrap state and secret lifecycle"
    }
  },
  "paid_access_note": "The full published answer and boundaries are free. Paid access saves the selected route and source versions, with an unsigned receipt when purchased. Preview coverage before paying. Fresh research, bespoke assessment and protected evidence are excluded.",
  "service_route": {
    "request_guide": "/varexis-index/request.html",
    "request_workflow": "/varexis-index/request-workflow.json",
    "service_id": "single_request",
    "service_routes_url": "/varexis-index/service-routes.json",
    "payment_required": true,
    "availability_endpoint": "/api/index/capabilities",
    "operational_status": "AUTOMATIC_SERVICE_CAPABILITIES_GATED",
    "checkout_url": "/index-access"
  },
  "authority_boundary": "VAREXIS-INDEX informs evidence reliance. It does not provide advice, certification, deployment authority, security assurance, production approval, or guarantee.",
  "human_page": "/varexis-index/catalog.html#vault-wrapping-token-secret-lifetime",
  "machine_readable_record": "/varexis-index/records/vault-wrapping-token-secret-lifetime.json"
}