key-cape/workplans/KEY-WP-0037-secrets-engine-openbao-registration-custody.md

id	type	title	domain	repo	status	owner	topic_slug	created	updated	state_hub_workstream_id
KEY-WP-0037	workplan	Secrets Engine OpenBao live registration and protected custody	infotech	key-cape	active	codex	netkingdom	2026-10-04	2026-10-05	62800ecf-064b-5546-a1e4-4521b5932973

KeyCape's accepted provider contract (KEY-WP-0009) does not establish actual registration or custody. This plan names those missing owner gates for RPF-WP-0035-T02. The founder authorized workers to attend the review requests, not live registration, credential generation, rotation, fetching or deployment.

Establish the exact registration and deployment authority

id: KEY-WP-0037-T01
status: done
priority: high
state_hub_task_id: "0409f656-65fb-5ee2-a934-a687a3e139f1"

Reviewed KeyCape base 672e1faf4b: config/service-clients.example.yaml, docs/openbao-service-auth-contract.md, src/internal/config/config.go, src/cmd/keycape/clients_test.go. The exact service registration remains accepted: secrets-engine-openbao, service:secrets-engine, tenant:platform, role secrets-engine, only openbao:login, client_credentials, confidential, tokenLifetime 15m and issuer https://kc.coulomb.social. Audience defaults to clientId, with no resource audience override. See the owner packet for concrete deployment/custody proposals. NetKingdom owns the live sso/keycape deployment and config, not this example. Existing approved approval-client rollout demonstrates the owner procedure; it does not approve or provision this different service client.

Agree and prepare the separately approved protected custody operation

id: KEY-WP-0037-T02
status: done
priority: high
state_hub_task_id: "ac798fb4-ed77-5e45-83ab-f56eea92be34"

Platform owns the authoritative OpenBao client-secret custody and least-privilege issuer-side delivery; secrets-engine owns its explicitly selected mode-0600 client-side file outside every worktree. The proposal in docs/secrets-engine-openbao-owner-packet.md provides candidate coordinates, not a live custody claim or allocated CCR. Complete the platform CCR(s), delivery policy/roles, two target bindings, exact attended child and rollback before seeking the founder's separate concrete approval. Values stay out of Hub/Git/chat, argv and logs. Existing verifier/requester values must not be reused.

Done 2026-10-05. The founder resolved 632a8893-0d6a-4591-a50b-40bbdb798f32. The custody boundary is approved: platform owns OpenBao client-secret custody and issuer-side delivery, and secrets-engine owns the mode-0600 file outside every worktree. The owner packet is still coordinates. This approval does not register the client, generate a secret, or deploy.

Prepare and approve the deployment-owned registration operation

id: KEY-WP-0037-T03
status: wait
priority: high
needs_human: true
decision_id: caafe4be-4f68-47b4-9567-316d47b94992
blocking_reason: "Custody boundary 632a8893 is approved. Registration merge and rollout still need an exact reviewed revision and a separate live go. Opening caafe4be does not deploy."
state_hub_task_id: "52f03e39-d05b-5da5-85df-e28c059430e4"

Coordinate source registration merge and the single new env secretKeyRef with NetKingdom's sso-mfa/k8s/keycape/deployment.yaml and owner rollout implementation. An exact reviewed source revision, image digest, config preservation test, synthetic issuance/denial verification and founder live go are required. Use an idempotent exact-match merge: absence permits adding only this client; matching client permits noop; duplicates or drift fail closed. Preserve signing key, unrelated clients, existing policy and confidential config bytes. No deployment changes are authorized by this source plan.

Verify actual issuance and publish non-secret owner receipt

id: KEY-WP-0037-T04
status: wait
priority: high
depends_on:
  - KEY-WP-0037-T03
blocking_reason: "Live issuance proof waits on the registration operation (T03)."
state_hub_task_id: "40b80bcd-243d-5bf8-ba18-b992e3c5f8f7"

After authorized registration and custody, verify issuer/JWKS signature, subject, audience, principal_type, tenant, roles, scope and 900-second lifetime; refuse wrong credential/excess scope and preserve existing human login. Record only booleans and identities, immutable image/source coordinates and custody binding metadata. Hand off to RPF-WP-0035-T02 for isolated OpenBao metadata provisioning, claim/expiry/use-limit denial and self-revocation proof. Never report an example registration, discovery metadata or source test as live acceptance.