# Non-secret static registration fragments for KeyCape's bounded OpenBao JWT
# consumers. Merge these entries into the deployment-owned KeyCape config.
# The named environment variables must be materialized by an approved
# out-of-repository custody path; this file never contains their values.
clients:
  - clientId: "codex-railiance-platform"
    displayName: "Railiance platform coding agent"
    allowedScopes: ["openbao:login"]
    grantTypes: ["client_credentials"]
    clientType: "confidential"
    secretRef: "env:KEYCAPE_CODEX_RAILIANCE_PLATFORM_CLIENT_SECRET"
    serviceSubject: "service:codex:railiance-platform"
    tenant: "tenant:coulomb"
    roles: ["coding-agent"]
    tokenLifetime: "15m"

  - clientId: "secrets-engine-openbao"
    displayName: "secrets-engine OpenBao login"
    allowedScopes: ["openbao:login"]
    grantTypes: ["client_credentials"]
    clientType: "confidential"
    secretRef: "env:KEYCAPE_SECRETS_ENGINE_OPENBAO_CLIENT_SECRET"
    serviceSubject: "service:secrets-engine"
    tenant: "tenant:coulomb"
    roles: ["secrets-engine"]
    tokenLifetime: "15m"