key-cape/workplans/KEY-WP-0037-secrets-engine-openbao-registration-custody.md

id	type	title	domain	repo	status	owner	topic_slug	created	updated	state_hub_workstream_id
KEY-WP-0037	workplan	Secrets Engine OpenBao live registration and protected custody	infotech	key-cape	finished	codex	netkingdom	2026-10-04	2026-10-07	62800ecf-064b-5546-a1e4-4521b5932973

KeyCape's accepted provider contract (KEY-WP-0009) does not establish actual registration or custody. This plan names those missing owner gates for RPF-WP-0035-T02. The founder authorized workers to attend the review requests, not live registration, credential generation, rotation, fetching or deployment.

Establish the exact registration and deployment authority

id: KEY-WP-0037-T01
status: done
priority: high
state_hub_task_id: "0409f656-65fb-5ee2-a934-a687a3e139f1"

Reviewed KeyCape base 672e1faf4b: config/service-clients.example.yaml, docs/openbao-service-auth-contract.md, src/internal/config/config.go, src/cmd/keycape/clients_test.go. The exact service registration remains accepted: secrets-engine-openbao, service:secrets-engine, tenant:platform, role secrets-engine, only openbao:login, client_credentials, confidential, tokenLifetime 15m and issuer https://kc.coulomb.social. Audience defaults to clientId, with no resource audience override. See the owner packet for concrete deployment/custody proposals. NetKingdom owns the live sso/keycape deployment and config, not this example. Existing approved approval-client rollout demonstrates the owner procedure; it does not approve or provision this different service client.

Agree and prepare the separately approved protected custody operation

id: KEY-WP-0037-T02
status: done
priority: high
state_hub_task_id: "ac798fb4-ed77-5e45-83ab-f56eea92be34"

Platform owns the authoritative OpenBao client-secret custody and least-privilege issuer-side delivery; secrets-engine owns its explicitly selected mode-0600 client-side file outside every worktree. The proposal in docs/secrets-engine-openbao-owner-packet.md provides candidate coordinates, not a live custody claim or allocated CCR. Complete the platform CCR(s), delivery policy/roles, two target bindings, exact attended child and rollback before seeking the founder's separate concrete approval. Values stay out of Hub/Git/chat, argv and logs. Existing verifier/requester values must not be reused.

Done 2026-10-05. The founder resolved 632a8893-0d6a-4591-a50b-40bbdb798f32. The custody boundary is approved: platform owns OpenBao client-secret custody and issuer-side delivery, and secrets-engine owns the mode-0600 file outside every worktree. The owner packet is still coordinates. This approval does not register the client, generate a secret, or deploy.

Prepare and approve the deployment-owned registration operation

id: KEY-WP-0037-T03
status: done
priority: high
needs_human: true
decision_id: caafe4be-4f68-47b4-9567-316d47b94992
blocking_reason: "Custody boundary 632a8893 is approved. Registration merge and rollout still need an exact reviewed revision and a separate live go. Opening caafe4be does not deploy."
state_hub_task_id: "52f03e39-d05b-5da5-85df-e28c059430e4"

Coordinate source registration merge and the single new env secretKeyRef with NetKingdom's sso-mfa/k8s/keycape/deployment.yaml and owner rollout implementation. An exact reviewed source revision, image digest, config preservation test, synthetic issuance/denial verification and founder live go are required. Use an idempotent exact-match merge: absence permits adding only this client; matching client permits noop; duplicates or drift fail closed. Preserve signing key, unrelated clients, existing policy and confidential config bytes. No deployment changes are authorized by this source plan.

Done 2026-10-07 under live go caafe4be.

• Custody (decision 2ab717e1): KV v1 written with cas=0.
• ESO amendment 1fdd993b; the sso Secret is synced.
• NK-WP-0046 (1fbb8db): env binding, then the exact-match config add (rv 71471711 to 71655453, unrelated bytes preserved), then a restart on image 6f79a2af.

Prepared 2026-10-06 (source only). NetKingdom NK-WP-0046 (a1e7302) holds the exact-match single-client merge helper, its rollback and the proposed env patch. secrets-engine SECRETS-WP-0012 (a3897c2) names the consumer file. Platform CCR-2026-0033 (df24a77, still proposed) holds the KV path platform/workloads/keycape/secrets-engine-openbao, the sso-only ESO and the attended custody script; its approval is RPF-WP-0035-T09. The live order is custody run, then issuer Secret, env patch, this merge and a restart. Nothing is live. The founder keeps the deployed image (NK-WP-0046-T02, 2026-10-06). Revised the same day: the value lives only in OpenBao (ops-mason MASON-WP-0009) and has no consumer file. The custody approvals A1-A3 are decision 2ab717e1-7881-491e-aed4-28946550c289.

Verify actual issuance and publish non-secret owner receipt

id: KEY-WP-0037-T04
status: done
priority: high
depends_on:
  - KEY-WP-0037-T03
blocking_reason: "Live issuance proof waits on the registration operation (T03)."
state_hub_task_id: "40b80bcd-243d-5bf8-ba18-b992e3c5f8f7"

After authorized registration and custody, verify issuer/JWKS signature, subject, audience, principal_type, tenant, roles, scope and 900-second lifetime; refuse wrong credential/excess scope and preserve existing human login. Record only booleans and identities, immutable image/source coordinates and custody binding metadata. Hand off to RPF-WP-0035-T02 for isolated OpenBao metadata provisioning, claim/expiry/use-limit denial and self-revocation proof. Never report an example registration, discovery metadata or source test as live acceptance.

Done 2026-10-07. keycape verify-client passed all 10 checks:

• issuer, JWKS signature and claims (service:secrets-engine, tenant:platform, role secrets-engine);
• no excess scope;
• openbao:admin and a wrong secret refused.

The founder's KeyCape login after the restart also proved the CCR-2026-0034 operator reader (net-kingdom-admins, aal2). Receipt: docs/evidence/2026-10-07-secrets-engine-openbao-issuance.json. The 900s lifetime was not measured. Handed to RPF-WP-0035-T02 for the OpenBao JWT role and login proof.