- Lane 1 (LLM provider): reuse verified — warden catalog
openrouter-llm-connect, policy workload-kv-read-llm-connect-provider-secrets
- Lane 2 (forgejo deploy key): new, per-repo write deploy key design,
founder Red lane
- Lane 3 (mail-scan AppRole): executor-worker-binky-mail bound to the
existing IMAP read policy — closes email checklist item 9's auth
blocker on paper; provisioning founder Red lane
- No secret values anywhere; T04 can proceed on Lane 1 alone
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
