operators/nextcloud:
  description: ''
  missing:
  - description
  - used_by
  - rotation
  - on_loss
  on_loss: ''
  owner: railiance-platform
  review: draft
  rotation: ''
  sources: []
  used_by: ''
operators/nextcloud/backup:
  description: Operator login (BACKUP_USERNAME, BACKUP_PASSWORD) for the dedicated Nextcloud Storage Share
    account Backup on nx4069.your-storageshare.de, the independent secondary backup copy lane.
  missing: []
  on_loss: Resettable by the founder in the Storage Share provider admin (attended). If the share is recreated,
    update the workload lane's NC_WEBDAV_TOKEN. Stored backups are unaffected.
  owner: railiance-platform
  review: accepted
  rotation: railiance-platform/docs/backup-credential-recovery.md; railiance-platform/credential-change-requests/CCR-2026-0004-railiance-backup-offsite-lane.yaml
  sources:
  - railiance-platform reply 3e490cd4 (2026-10-09)
  used_by: Attended operator only, to manage the account and its create-only /railiance-backups share.
    Never delivered to production; workloads get only the derived NC_WEBDAV_TOKEN/NC_WEBDAV_URL via the
    workload lane.
platform/workloads/activity-core/llm-connect/llm-connect-provider-secrets:
  description: llm-connect provider access through OpenBao workload KV and External Secrets
  missing: []
  on_loss: 'Re-issue per rotation: Replace OPENROUTER_API_KEY directly in OpenBao and record non-secret
    rotation evidence.'
  owner: railiance-platform
  review: accepted
  rotation: railiance-platform/credential-change-requests/CCR-2026-0003-llm-connect-openrouter-api-key.yaml#lifecycle.rotate
  sources:
  - CCR-2026-0003-llm-connect-openrouter-api-key.yaml
  - ops-warden catalog openrouter-llm-connect
  used_by: ExternalSecret to Secret llm-connect-provider-secrets in the activity-core namespace
platform/workloads/activity-core/ops-run-workers/rein-aharness-metered-railiance01:
  description: Deliver the bearer token of ops_run queue worker rein-aharness-metered@railiance01 to the
    activity-core runtime Secret through External Secrets.
  missing: []
  on_loss: 'Re-issue per rotation: activity-core re-mints the worker token at its path. ESO syncs it within
    1h, and the queue accepts the new token per ACTIVITY_CORE_WORKERS.'
  owner: railiance-platform
  review: accepted
  rotation: railiance-platform/credential-change-requests/CCR-2026-0030-activity-core-ops-run-worker-rein-aharness-metered-railiance01.yaml#lifecycle.rotate
  sources:
  - CCR-2026-0030-activity-core-ops-run-worker-rein-aharness-metered-railiance01.yaml
  used_by: ExternalSecret actcore-ops-run-worker-tokens merges ACTIVITY_CORE_WORKER_TOKEN_METERED into
    Secret actcore-runtime-secret in namespace activity-core.
platform/workloads/activity-core/ops-run-workers/rein-aharness-railiance01:
  description: Deliver the bearer token of ops_run queue worker rein-aharness@railiance01 to the activity-core
    runtime Secret through External Secrets.
  missing: []
  on_loss: 'Re-issue per rotation: activity-core re-mints the worker token at its path. ESO syncs it within
    1h, and the queue accepts the new token per ACTIVITY_CORE_WORKERS.'
  owner: railiance-platform
  review: accepted
  rotation: railiance-platform/credential-change-requests/CCR-2026-0029-activity-core-ops-run-worker-rein-aharness-railiance01.yaml#lifecycle.rotate
  sources:
  - CCR-2026-0029-activity-core-ops-run-worker-rein-aharness-railiance01.yaml
  used_by: ExternalSecret actcore-ops-run-worker-tokens merges ACTIVITY_CORE_WORKER_TOKEN into Secret
    actcore-runtime-secret in namespace activity-core.
platform/workloads/agent-harness/forgejo-deploy-key:
  description: agent-harness Forgejo deploy key (write sandbox; binky-control at cutover)
  missing: []
  on_loss: 're-establish by railiance-platform: On railiance01 generate a new ed25519 keypair under ~/.local/agent-harness/ssh/
    (mode 600); do not paste the private key into chat or Git.'
  owner: railiance-platform
  review: accepted
  rotation: ops-warden/wiki/playbooks/agent-harness-secrets.md#lane-2-forgejo-deploy-key
  sources:
  - ops-warden catalog agent-harness-forgejo-deploy
  - railiance-platform reply 3e490cd4 (2026-10-09)
  used_by: agent-harness worker on railiance01 (private key at ~/.local/agent-harness/ssh/forgejo-deploy);
    this OpenBao copy is the recovery copy, via ops-warden agent-harness-forgejo-deploy (policy workload-kv-read-agent-harness-forgejo).
    Deploy key on coulomb/executor-sandbox (write).
platform/workloads/approval-engine/audit-sender:
  description: Provide only the approval-engine sender with source=approval-engine, tenants=[tenant:platform],
    may_write=true, may_read=false, evidence_kind=load-bearing, secret_policy=redact.
  missing: []
  on_loss: 'Re-issue per rotation: Reviewed overlap-first rotation: append a replacement to this sender
    only, deliver it, prove acceptance, then remove the predecessor and prove refusal. The first-provision
    helper refuses rotation and unexpected existing values.'
  owner: railiance-platform
  review: accepted
  rotation: railiance-platform/credential-change-requests/CCR-2026-0021-approval-engine-audit.yaml#lifecycle.rotate
  sources:
  - CCR-2026-0021-approval-engine-audit.yaml
  used_by: 'ClusterSecretStore openbao-approval-engine-audit restricted to namespace approval-engine;
    ExternalSecret and Secret approval-engine/approval-engine-audit, key audit-token. Source: manifests/factory-audit-senders.yaml.
    A missing namespace stays a workload-owner prerequisite; this packet creates none.'
platform/workloads/approval-engine/operator-client:
  description: Hold the approval-engine-operator confidential client secret in platform custody and project
    it into the KeyCape runtime so KeyCape can verify presented client_credentials for the operator client.
  missing: []
  on_loss: 'Re-issue per rotation: KeyCape mints a replacement client secret; platform writes the new
    KV version under the same attended authority. Rotation is independent of CCR-2026-0017.'
  owner: railiance-platform
  review: accepted
  rotation: railiance-platform/credential-change-requests/CCR-2026-0018-keycape-approval-engine-operator-client.yaml#lifecycle.rotate;
    railiance-platform/credential-change-requests/CCR-2026-0020-approval-engine-operator-client-read.yaml#lifecycle.rotate
  sources:
  - CCR-2026-0018-keycape-approval-engine-operator-client.yaml
  - CCR-2026-0020-approval-engine-operator-client-read.yaml
  used_by: 'ClusterSecretStore openbao-keycape-approval-engine-operator, limited to namespace sso, to
    ExternalSecret sso/keycape-approval-engine-operator-client and Secret sso/keycape-approval-engine-operator-client
    with key client-secret. KeyCape resolves it as KEYCAPE_APPROVAL_ENGINE_OPERATOR_CLIENT_SECRET through
    a secretKeyRef. Manifests: argocd/platform-addons/openbao-secretstore/openbao-keycape-approval-clients.clustersecretstore.yaml
    and keycape-approval-clients.externalsecrets.yaml.'
platform/workloads/audit-core/senders:
  description: audit-core sender registry (write and operator-read tokens)
  missing: []
  on_loss: audit-core re-mints sender tokens and every projected copy is reseeded; senders queue to their
    local outboxes meanwhile. See ops-mason/plans/audit-core-openbao-runtime-custody.md.
  owner: ops-mason
  review: accepted
  rotation: ops-warden/wiki/playbooks/audit-core-senders.md#worker-checklist
  sources:
  - ops-warden catalog audit-core-senders
  - ops-mason plan (hand-filled 2026-10-09)
  used_by: audit-core on railiance01 (sender registry authority); seed source for per-sender projections
    such as tenant-engine/audit-core-sender
platform/workloads/core-hub/forgejo-source-read:
  description: Hold a dedicated Forgejo PAT scoped exactly read:repository and project it through External
    Secrets into namespace core-hub as the Secret that the rapp-core-hub publisher mounts read-only at
    /var/run/secrets/repo-manager/forgejo/token.
  missing: []
  on_loss: 'Re-issue per rotation: Every 180 days or on owner change. Mint a replacement read:repository
    PAT for core-hub-source, write it to OpenBao from stdin, let ESO refresh (5m), pass make verify-publisher,
    then revoke the predecessor PAT and record evidence.'
  owner: railiance-platform
  review: accepted
  rotation: railiance-platform/credential-change-requests/CCR-2026-0031-core-hub-forgejo-source-read.yaml#lifecycle.rotate
  sources:
  - CCR-2026-0031-core-hub-forgejo-source-read.yaml
  - ops-warden catalog core-hub-forgejo-source-read
  used_by: ClusterSecretStore openbao-core-hub-forgejo-source (conditions limited to namespace core-hub)
    feeding ExternalSecret core-hub/repo-manager-forgejo-source, which materializes Secret repo-manager-forgejo-source
    with the single key token (remoteRef workloads/core-hub/forgejo-source-read property FORGEJO_SOURCE_TOKEN),
    explicit empty target metadata template, creationPolicy Owner, deletionPolicy Retain. rapp-core-hub
    then sets publisher.existingSecret to repo-manager-forgejo-source with tokenKey token. Both ma
platform/workloads/core-hub/runtime:
  description: Project the existing Core Hub protected-API token into the private railiance01 runtime
    through a namespace-limited ExternalSecret while preserving the token across the relocation window.
  missing: []
  on_loss: 'Re-issue per rotation: Coordinate a new random token with all protected API consumers, update
    the OpenBao field through attended custody, wait for ESO sync, roll Core Hub and consumers, verify
    protected calls, then invalidate the old token.'
  owner: railiance-platform
  review: accepted
  rotation: railiance-platform/credential-change-requests/CCR-2026-0013-core-hub-runtime-api-token.yaml#lifecycle.rotate
  sources:
  - CCR-2026-0013-core-hub-runtime-api-token.yaml
  used_by: ClusterSecretStore openbao-core-hub-runtime, limited to namespace core-hub, to ExternalSecret
    core-hub/core-hub-api-token and Secret core-hub-api-token. The rapp package consumes this Secret separately
    from runtime and migration PostgreSQL lease Secrets.
platform/workloads/coulomb-social/backup-primary:
  description: Read this application backup publisher key pair into the admitted node delivery process;
    no other workload credential or escrow.
  missing: []
  on_loss: 'Re-issue per rotation: Separate owner-approved CAS rotation and atomic host replacement contract
    required. This helper refuses different existing bytes; retain old provider identity until new publication/recovery
    acceptance, then revoke predecessor at provider.'
  owner: railiance-platform
  review: accepted
  rotation: railiance-platform/credential-change-requests/CCR-2026-0036-coulomb-social-backup-primary.yaml#lifecycle.rotate
  sources:
  - CCR-2026-0036-coulomb-social-backup-primary.yaml
  used_by: /etc/coulomb-social-backup/primary.env
platform/workloads/coulomb/fluid-telegram/hall-of-helix/bot-token:
  description: Telegram bot token for the hall-of-helix campaign bot, created by the provisioner. Not
    the operator session.
  missing: []
  on_loss: Regenerate with BotFather via the operator account (attended) and write a new version; the
    old token stops working.
  owner: fluid-telegram
  review: draft
  rotation: ops-mason/plans/fluid-telegram-operator-credential-lane.md; railiance-platform CCR-2026-0039
  sources:
  - ops-mason plan fluid-telegram-operator-credential-lane.md (approved 2026-10-09)
  used_by: Attended fluid-telegram provisioner only, via bao login -method=oidc -path=netkingdom role=fluid-telegram-hall-of-helix-workload-kv
    (group fluid-telegram-operators, aal2, 15m). Agents are denied (agent-high-risk-boundary). Create,
    read, update. The future adapter lane (MASON-IN-0003) may read it.
platform/workloads/coulomb/fluid-telegram/hall-of-helix/operator-app:
  description: Telegram API application credentials (api_id, api_hash) for the hall-of-helix provisioner.
    Not a session and not a bot token.
  missing: []
  on_loss: 'Re-create the app at my.telegram.org with the operator''s account and write a new version
    (attended). Cost: provisioning pauses; the existing session and bot keep working.'
  owner: fluid-telegram
  review: draft
  rotation: ops-mason/plans/fluid-telegram-operator-credential-lane.md; railiance-platform CCR-2026-0039
  sources:
  - ops-mason plan fluid-telegram-operator-credential-lane.md (approved 2026-10-09)
  used_by: Attended fluid-telegram provisioner only, via bao login -method=oidc -path=netkingdom role=fluid-telegram-hall-of-helix-workload-kv
    (group fluid-telegram-operators, aal2, 15m). Agents are denied (agent-high-risk-boundary). Read only.
platform/workloads/coulomb/fluid-telegram/hall-of-helix/operator-session:
  description: 'MTProto session (session_b64) of the operator''s Telegram account: a full-account credential.
    Not the bot token.'
  missing: []
  on_loss: Log in again with the operator's Telegram account through the provisioner (attended, needs
    the phone/2FA) and write a new version. Revoke the old session in Telegram if it may have leaked.
  owner: fluid-telegram
  review: draft
  rotation: ops-mason/plans/fluid-telegram-operator-credential-lane.md; railiance-platform CCR-2026-0039
  sources:
  - ops-mason plan fluid-telegram-operator-credential-lane.md (approved 2026-10-09)
  used_by: Attended fluid-telegram provisioner only, via bao login -method=oidc -path=netkingdom role=fluid-telegram-hall-of-helix-workload-kv
    (group fluid-telegram-operators, aal2, 15m). Agents are denied (agent-high-risk-boundary). Create,
    read, update.
platform/workloads/coulomb/fluid-telegram/hall-of-helix/redaction-salt:
  description: Redaction salt (salt) for hall-of-helix, created once by the provisioner; write-once.
  missing: []
  on_loss: Not recoverable by design; a new salt changes every redacted identifier. Replacing it is a
    separately approved platform action, not a provisioner capability.
  owner: fluid-telegram
  review: draft
  rotation: ops-mason/plans/fluid-telegram-operator-credential-lane.md; railiance-platform CCR-2026-0039
  sources:
  - ops-mason plan fluid-telegram-operator-credential-lane.md (approved 2026-10-09)
  used_by: Attended fluid-telegram provisioner only, via bao login -method=oidc -path=netkingdom role=fluid-telegram-hall-of-helix-workload-kv
    (group fluid-telegram-operators, aal2, 15m). Agents are denied (agent-high-risk-boundary). Create
    once, read.
platform/workloads/coulomb/whynot-design/npm-publish:
  description: npm package publishing through ops-warden caller-scoped fetch/exec
  missing: []
  on_loss: 'Re-issue per rotation: Replace NPM_AUTH_TOKEN value directly in OpenBao and record non-secret
    rotation evidence.'
  owner: railiance-platform
  review: accepted
  rotation: railiance-platform/credential-change-requests/CCR-2026-0001-whynot-design-npm-publish.yaml#lifecycle.rotate
  sources:
  - CCR-2026-0001-whynot-design-npm-publish.yaml
  - ops-warden catalog whynot-design-npm-publish
  - railiance-platform reply 3e490cd4 (2026-10-09)
  used_by: Attended whynot-design npm publishing via ops-warden whynot-design-npm-publish (warden access
    ... --exec -- npm publish), OIDC role whynot-design-workload-kv-read on auth/netkingdom. Field NPM_AUTH_TOKEN.
platform/workloads/email-connect/backup-primary:
  description: Read this application backup publisher key pair into the admitted node delivery process;
    no other workload credential or escrow.
  missing: []
  on_loss: 'Re-issue per rotation: Separate owner-approved CAS rotation and atomic host replacement contract
    required. This helper refuses different existing bytes; retain old provider identity until new publication/recovery
    acceptance, then revoke predecessor at provider.'
  owner: railiance-platform
  review: accepted
  rotation: railiance-platform/credential-change-requests/CCR-2026-0037-email-connect-backup-primary.yaml#lifecycle.rotate
  sources:
  - CCR-2026-0037-email-connect-backup-primary.yaml
  used_by: /etc/email-connect-backup/primary.env
platform/workloads/email-connect/transactional:
  description: Deliver EMAIL_CONNECT_INGEST_TOKEN and IONOS SMTP username/password into the email-connect
    namespace via External Secrets so the transactional receiver can send invitation and verification
    mail without baking secrets into the image, Git, or user-engine.
  missing: []
  on_loss: 'Re-issue per rotation: Overlap-first: put new SMTP password and/or ingest token in OpenBao;
    wait for ESO refresh (or force sync); roll email-connect and user-engine as needed; revoke old provider
    password / retire old bearer.'
  owner: railiance-platform
  review: accepted
  rotation: railiance-platform/credential-change-requests/CCR-2026-0010-email-connect-transactional.yaml#lifecycle.rotate
  sources:
  - CCR-2026-0010-email-connect-transactional.yaml
  - ops-warden catalog email-connect-transactional
  used_by: ClusterSecretStore openbao-email-connect (tokenSecretRef openbao-email-connect-eso-token; namespace
    condition email-connect) at railiance-platform/argocd/platform-addons/openbao-secretstore/openbao-email-connect.clustersecretstore.yaml
    → ExternalSecret email-connect/email-connect-runtime → Secret email-connect-runtime. Package manifests
    in email-connect/deploy/k8s/railiance/ (not applied until this CCR is approved and the KV secret is
    provisioned).
platform/workloads/forgejo/forgejo-admin:
  description: Forgejo admin API token for package prune, registry ops, org webhooks, and operator bootstrap
    on workstations and activity-core worker
  missing: []
  on_loss: 'Re-issue per rotation: Mint a new PAT in Forgejo, update API_TOKEN in OpenBao, record non-secret
    rotation evidence, and restart dependent automation after downstream consumers load from OpenBao.'
  owner: railiance-platform
  review: accepted
  rotation: railiance-platform/credential-change-requests/CCR-2026-0006-forgejo-admin-api-token-lane.yaml#lifecycle.rotate
  sources:
  - CCR-2026-0006-forgejo-admin-api-token-lane.yaml
  - ops-warden catalog forgejo-admin-api-token
  used_by: railiance-platform tools/cmd/forgejo-package-prune, activity-core weekly-forgejo-package-prune
    shell resolver, and railiance-apps Forgejo tools (load_token pattern after lane verified)
platform/workloads/glas-harness/claude-agent-dev:
  description: Dedicated Claude Code inference for the Glas local agent-dev profile, delivered by the
    sandbox owner.
  missing: []
  on_loss: 'Re-issue per rotation: Create a replacement provider key, write with expected-version CAS,
    stop old runs, verify new delivery and inference, then revoke the predecessor at Anthropic and prove
    its denial.'
  owner: railiance-platform
  review: accepted
  rotation: railiance-platform/credential-change-requests/CCR-2026-0016-glas-claude-anthropic.yaml#lifecycle.rotate
  sources:
  - CCR-2026-0016-glas-claude-anthropic.yaml
  used_by: Sand-boxer delivers ANTHROPIC_API_KEY only to the selected Claude workload; neither the Glas
    caller nor the runtime receives an OpenBao token.
platform/workloads/inbound-library/imap:
  description: inbound-library AppRole for non-interactive library@coulomb.social IMAP read
  missing: []
  on_loss: 'rotate by ops-mason: bao write -f auth/approle/role/inbound-library/secret-id -> new secret_id;
    deliver mode-0600 to ~/.local/inbound-library/approle; shred old secret_id file.'
  owner: ops-mason
  review: accepted
  rotation: ops-warden/wiki/playbooks/inbound-library-imap-approle.md#worker-checklist
  sources:
  - ops-warden catalog inbound-library-imap-approle
  - ops-mason plan (hand-filled 2026-10-09)
  used_by: inbound-library systemd user timer on the workstation, via AppRole inbound-library (reads once
    per run, then revokes its token)
platform/workloads/informed-decision/audit-sender:
  description: Provide only the informed-decision sender with source=informed-decision, tenants=[tenant:platform],
    may_write=true, may_read=false, evidence_kind=load-bearing, secret_policy=redact.
  missing: []
  on_loss: 'Re-issue per rotation: Reviewed overlap-first rotation: append a replacement to this sender
    only, deliver it, prove acceptance, then remove the predecessor and prove refusal. The first-provision
    helper refuses rotation and unexpected existing values.'
  owner: railiance-platform
  review: accepted
  rotation: railiance-platform/credential-change-requests/CCR-2026-0022-informed-decision-audit.yaml#lifecycle.rotate
  sources:
  - CCR-2026-0022-informed-decision-audit.yaml
  used_by: 'ClusterSecretStore openbao-informed-decision-audit restricted to namespace informed-decision;
    ExternalSecret and Secret informed-decision/informed-decision-audit, key token. Source: manifests/factory-audit-senders.yaml.
    A missing namespace stays a workload-owner prerequisite; this packet creates none.'
platform/workloads/informed-decision/sitting-requester:
  description: create-only sitting requester KeyCape verifier custody; approval:create only; subject informed-decision;
    audience approval-engine.
  missing: []
  on_loss: 'Re-issue per rotation: Rotate through KeyCape and platform using a new version with predecessor
    refusal proof.'
  owner: railiance-platform
  review: accepted
  rotation: railiance-platform/credential-change-requests/CCR-2026-0026-informed-decision-sitting-requester-verifier.yaml#lifecycle.rotate;
    railiance-platform/credential-change-requests/CCR-2026-0027-informed-decision-sitting-requester-reader.yaml#lifecycle.rotate
  sources:
  - CCR-2026-0026-informed-decision-sitting-requester-verifier.yaml
  - CCR-2026-0027-informed-decision-sitting-requester-reader.yaml
  - CCR-2026-0032.yaml
  used_by: sso/keycape-informed-decision-sitting-requester-client via ESO; env KEYCAPE_INFORMED_DECISION_SITTING_REQUESTER_CLIENT_SECRET
platform/workloads/issue-core/issue-core/issue-core-runtime:
  description: issue-core runtime ingestion through OpenBao workload KV and External Secrets
  missing: []
  on_loss: 'Re-issue per rotation: Replace issue-core runtime secret values directly in OpenBao and record
    non-secret rotation evidence.'
  owner: railiance-platform
  review: accepted
  rotation: railiance-platform/credential-change-requests/CCR-2026-0002-issue-core-ingestion-api-key.yaml#lifecycle.rotate
  sources:
  - CCR-2026-0002-issue-core-ingestion-api-key.yaml
  - ops-warden catalog issue-core-ingestion-api-key
  used_by: ExternalSecret issue-core/issue-core-runtime -> Secret issue-core-runtime in the issue-core
    namespace
platform/workloads/keycape/secrets-engine-openbao:
  description: Hold the secrets-engine-openbao client secret authoritatively in platform KV and deliver
    it to the KeyCape issuer through sso-only ESO
  missing: []
  on_loss: 'Re-issue per rotation: Roll-forward only: custody child writes a new version with cas=<current>
    under a standing rotation approval for this CCR (event-driven + 90d); never a read or restore of an
    old version'
  owner: railiance-platform
  review: accepted
  rotation: railiance-platform/credential-change-requests/CCR-2026-0033.yaml#lifecycle.rotate; railiance-platform/credential-change-requests/CCR-2026-0034.yaml#lifecycle.rotate
  sources:
  - CCR-2026-0033.yaml
  - CCR-2026-0034.yaml
  used_by: sso/keycape-secrets-engine-openbao-client key client-secret; issuer-side delivery only
platform/workloads/net-kingdom/keycape-factor-issuer:
  description: Renewable login (USERNAME, PASSWORD, REQUEST) of the local privacyIDEA service admin keycape-factor-reader,
    permission tokenlist for realm coulomb only. Used to obtain the short-lived factor-read JWT. Not the
    JWT KeyCape uses, not a privacyIDEA admin credential (pi-admin is operators/privacyidea/pi-admin).
  missing:
  - rotation
  on_loss: 'Resettable by a privacyIDEA administrator via attended pi-admin custody: new password for
    keycape-factor-reader, CAS-write here. Cost: renewal stops; JWT valid up to 2h, then coulomb MFA lookup
    fails closed until restored.'
  owner: railiance-platform
  review: draft
  rotation: ''
  sources:
  - net-kingdom reply 75b48030 (2026-10-09); rotation is a railiance-platform gap
  used_by: CronJob sso/keycape-factor-renewer (own SA, every 10 min, 5-min OpenBao session); writes keycape-factor-read.
    The keycape-factor-read ESO reader is denied this path.
platform/workloads/net-kingdom/keycape-factor-read:
  description: Deliver only a provider-issued coulomb factor-read JWT to KeyCape, separating it from issuer
    credentials and signing keys.
  missing: []
  on_loss: 'Re-issue per rotation: Issue replacement before expiry, CAS update exact KV, verify ESO projection
    and consumer acceptance; retain no plaintext artifacts.'
  owner: railiance-platform
  review: accepted
  rotation: railiance-platform/credential-change-requests/CCR-2026-0023-keycape-factor-read.yaml#lifecycle.rotate
  sources:
  - CCR-2026-0023-keycape-factor-read.yaml
  used_by: Namespace-restricted ClusterSecretStore openbao-keycape-factor-read -> sso/keycape-factor-read
    Secret admin-token. Mount only the JWT in KeyCape; provider password remains in separate custody.
platform/workloads/policy-nexus/forgejo-source-read:
  description: Hold a dedicated Forgejo PAT with read:repository only and deliver it as the FORGEJO_SOURCE_TOKEN
    secret to the policy-nexus Actions workflow.
  missing: []
  on_loss: 'Re-issue per rotation: Mint a replacement read:repository-only PAT, update OpenBao and the
    Actions secret through attended custody, pass one candidate build, then revoke the predecessor.'
  owner: railiance-platform
  review: accepted
  rotation: railiance-platform/credential-change-requests/CCR-2026-0014-policy-nexus-forgejo-source-read.yaml#lifecycle.rotate
  sources:
  - CCR-2026-0014-policy-nexus-forgejo-source-read.yaml
  - ops-warden catalog policy-nexus-forgejo-source-read
  used_by: Repository Actions secret FORGEJO_SOURCE_TOKEN on coulomb/policy-nexus. Delivery is attended
    and must not expose the value in command output, process arguments, Git, State Hub, or workflow logs.
platform/workloads/railiance-clock/authority-signing:
  description: Hold one ES256 authority private signing key in OpenBao and deliver it only to the private
    railiance01 Railiance Clock service; no public listener or consumer-wide distribution.
  missing: []
  on_loss: 'Re-issue per rotation: Stop authority, perform separately versioned attended CAS rotation
    and atomic host replacement, then admit new public key and epoch for consumers.'
  owner: railiance-platform
  review: accepted
  rotation: railiance-platform/credential-change-requests/CCR-2026-0028-railiance-clock-authority-signing.yaml#lifecycle.rotate
  sources:
  - CCR-2026-0028-railiance-clock-authority-signing.yaml
  used_by: /var/lib/railiance-clock/signing.pem
platform/workloads/railiance-telemetry/smtp:
  description: Native password-reset notifier; password mounted read-only under /run/secrets/authelia-smtp/password.
  missing: []
  on_loss: 'Resettable by the founder in IONOS mail admin; write a new KV version keeping the other fields,
    wait for ESO refresh. Cost: alert mail and Authelia reset emails fail until then; no data loss.'
  owner: railiance-platform
  review: accepted
  rotation: railiance-platform/credential-change-requests/CCR-2026-0035-authelia-platform-smtp.yaml#lifecycle.rotate
  sources:
  - CCR-2026-0035-authelia-platform-smtp.yaml
  - railiance-platform reply 3e490cd4 (2026-10-09)
  used_by: railiance-telemetry alert mail (ESO telemetry-smtp-eso -> Secret telemetry/telemetry-alert-smtp,
    SMTP_PASSWORD only) and the Authelia password-reset notifier (CCR-2026-0035, /run/secrets/authelia-smtp/password).
    Mailbox platform@coulomb.social at IONOS.
platform/workloads/railiance/backup/object-storage:
  description: Object-store credentials for Railiance backup destinations.
  missing: []
  on_loss: 'Re-issue per rotation: Overlap-first. Put a new key in OpenBao, wait for ESO refresh, revoke
    the old Scaleway key.'
  owner: railiance-platform
  review: accepted
  rotation: railiance-platform/credential-change-requests/CCR-2026-0012-backup-object-storage.yaml#lifecycle.rotate
  sources:
  - CCR-2026-0012-backup-object-storage.yaml
  used_by: 'ClusterSecretStore openbao-backup-object-storage (first namespace condition: databases) →
    ExternalSecret databases/platform-pg-backup-s3 → Secret platform-pg-backup-s3 (ACCESS_KEY_ID / ACCESS_SECRET_KEY
    projected from ACCESS_KEY / SECRET_KEY). Drafts live under railiance-platform/argocd/platform-addons/openbao-secretstore/
    and rapp-postgres/helm/platform-pg-backup-s3.externalsecret.yaml. Do not apply until this CCR is approved
    and the KV values are real.'
platform/workloads/railiance/backup/offsite-lane:
  description: age-encrypted offsite backup upload through Nextcloud WebDAV file drop
  missing: []
  on_loss: 'Re-issue per rotation: Mint a new Nextcloud upload token, update NC_WEBDAV_TOKEN in OpenBao,
    and record non-secret rotation evidence.'
  owner: railiance-platform
  review: accepted
  rotation: railiance-platform/credential-change-requests/CCR-2026-0004-railiance-backup-offsite-lane.yaml#lifecycle.rotate
  sources:
  - CCR-2026-0004-railiance-backup-offsite-lane.yaml
  - ops-warden catalog railiance-backup-offsite-lane
  used_by: railiance-platform lib/railiance-backup-common.sh and forgejo-backup via RAILIANCE_BACKUP_NC_TOKEN
    env (fetched through OpenBao or warden access)
platform/workloads/railiance/scaleway/bootstrap:
  description: Create reef-storage object-store members; not the Barman runtime key
  missing: []
  on_loss: 'Re-issue per rotation: Put a new bootstrap key; do not reuse the scoped backup key.'
  owner: railiance-platform
  review: accepted
  rotation: railiance-platform/credential-change-requests/CCR-2026-0011-scaleway-object-storage-bootstrap.yaml#lifecycle.rotate
  sources:
  - CCR-2026-0011-scaleway-object-storage-bootstrap.yaml
  - ops-warden catalog scaleway-bootstrap
  used_by: reef-storage/tools/create-platform-audit-bucket.sh (reads, never prints)
platform/workloads/rapp-qonto/keycape-client:
  description: rapp-qonto KeyCape workload client
  missing: []
  on_loss: 'rotate by key-cape: Generate a fresh newline-free secret through an approved execution transport;
    never print it. NOT automatable — no admitted execution and rollback contract (see delegation.blocked_on).'
  owner: key-cape
  review: accepted
  rotation: ops-warden/wiki/CredentialRouting.md#routing-catalog-index
  sources:
  - ops-warden catalog rapp-qonto-keycape-client
  - key-cape reply 40395cc2 (2026-10-10)
  used_by: (1) KeyCape via ESO -> Secret sso/keycape-rapp-qonto-client key client-secret, to verify client_credentials
    for rapp-qonto-client. (2) The rapp-qonto runtime, presenting it to keycape service-token; its delivery
    transport is for railiance-apps/rapp-qonto to name.
platform/workloads/reuse/reuse-surface/runtime-secrets:
  description: reuse-surface federation hub runtime secrets through OpenBao workload KV and External Secrets
  missing: []
  on_loss: 'Re-issue per rotation: Replace field values directly in OpenBao, wait for ESO refresh, rollout
    reuse-surface, then run make reuse-forgejo-webhook when rotating the webhook HMAC.'
  owner: railiance-platform
  review: accepted
  rotation: railiance-platform/credential-change-requests/CCR-2026-0005-reuse-surface-runtime-secrets-lane.yaml#lifecycle.rotate
  sources:
  - CCR-2026-0005-reuse-surface-runtime-secrets-lane.yaml
  - ops-warden catalog reuse-surface-hub-write-token
  used_by: ExternalSecret reuse/reuse-surface-runtime -> Secret reuse-surface-env; ClusterSecretStore
    openbao-reuse uses private railiance01 OpenBao and exact reuse/reuse-surface-eso Kubernetes identity.
    Caller-facing OIDC policy workload-kv-read-reuse-surface-runtime remains separately retained.
platform/workloads/secrets-engine/approval-client:
  description: Hold the secrets-engine-approval confidential client secret in platform custody and project
    it into the KeyCape runtime so KeyCape can verify presented client_credentials without the value living
    in Git, a chart value, or a hand-created Kubernetes Secret.
  missing: []
  on_loss: 'Re-issue per rotation: KeyCape mints a replacement client secret; platform writes the new
    KV version under the same attended authority; ESO refresh delivers it and KeyCape restarts or re-reads.
    Rotation is independent of the operator client.'
  owner: railiance-platform
  review: accepted
  rotation: railiance-platform/credential-change-requests/CCR-2026-0017-keycape-secrets-engine-approval-client.yaml#lifecycle.rotate;
    railiance-platform/credential-change-requests/CCR-2026-0019-secrets-engine-approval-client-read.yaml#lifecycle.rotate
  sources:
  - CCR-2026-0017-keycape-secrets-engine-approval-client.yaml
  - CCR-2026-0019-secrets-engine-approval-client-read.yaml
  used_by: 'ClusterSecretStore openbao-keycape-secrets-engine-approval, limited to namespace sso, to ExternalSecret
    sso/keycape-secrets-engine-approval-client and Secret sso/keycape-secrets-engine-approval-client with
    key client-secret. KeyCape resolves it as KEYCAPE_SECRETS_ENGINE_APPROVAL_CLIENT_SECRET through a
    secretKeyRef, matching the live KEYCAPE_RAPP_QONTO_CLIENT_SECRET shape observed on image main-153258b.
    Manifests: argocd/platform-addons/openbao-secretstore/openbao-keycape-approval-clients.clustersecretstor'
platform/workloads/secrets-engine/approval-requester:
  description: T03 create-only requester KeyCape verifier custody; execute only the three fixed T03 request
    records.
  missing: []
  on_loss: 'Re-issue per rotation: Rotate through KeyCape and platform using a new version with predecessor
    refusal proof.'
  owner: railiance-platform
  review: accepted
  rotation: railiance-platform/credential-change-requests/CCR-2026-0024-t03-requester-verifier.yaml#lifecycle.rotate;
    railiance-platform/credential-change-requests/CCR-2026-0025-t03-requester-reader.yaml#lifecycle.rotate
  sources:
  - CCR-2026-0024-t03-requester-verifier.yaml
  - CCR-2026-0025-t03-requester-reader.yaml
  used_by: sso/keycape-secrets-engine-requester-client via ESO; env KEYCAPE_SECRETS_ENGINE_REQUESTER_CLIENT_SECRET
platform/workloads/state-hub/repository-rename-preflight:
  description: Deliver one HMAC signing key to the transitional State Hub API; no rename execution, general
    credential vending, or second identity authority.
  missing: []
  on_loss: 'Re-issue per rotation: Stop every API replica and verify no matching pods before CAS rotation;
    wait ESO, recreate API replicas with one version, verify old token invalidation and health.'
  owner: railiance-platform
  review: accepted
  rotation: railiance-platform/credential-change-requests/CCR-2026-0015-state-hub-preflight-signing.yaml#lifecycle.rotate
  sources:
  - CCR-2026-0015-state-hub-preflight-signing.yaml
  used_by: Namespace SecretStore openbao-state-hub-rename-preflight -> ExternalSecret/Secret state-hub-rename-preflight;
    required explicit API-only secretKeyRef. Owner creation, Retain deletion policy.
platform/workloads/telemetry/grafana-admin:
  description: Grafana native administrator for rapp-telemetry on railiance01 (ADMIN_USERNAME, ADMIN_PASSWORD),
    the attended bootstrap credential.
  missing: []
  on_loss: 'Resettable by a cluster operator with Grafana''s admin reset in the pod, then a new KV version
    (not yet exercised). Cost: short loss of admin access; dashboards and data unaffected.'
  owner: railiance-platform
  review: accepted
  rotation: 'railiance-platform/docs/credential-lane-designs/telemetry-grafana.md (attended: change the
    Grafana DB admin password and OpenBao together, then test old fails and new works)'
  sources:
  - railiance-platform reply 3e490cd4 (2026-10-09)
  used_by: Grafana in namespace telemetry via ExternalSecret telemetry-grafana-admin (ESO SA/role telemetry-grafana-eso,
    policy telemetry-grafana-admin-eso), plus the attended check scripts/telemetry_grafana_access.py.
platform/workloads/tenant-engine/audit-core-sender:
  description: tenant-engine's audit-core sender token, a copy of its entry in the audit-core sender registry.
    Not the registry itself.
  missing: []
  on_loss: Reseed from platform/workloads/audit-core/senders with the seed helper (founder, attended).
    audit-core re-mints if the registry entry is also gone; emission waits in tenant-engine's local outbox
    meanwhile.
  owner: railiance-platform
  review: accepted
  rotation: ops-mason/plans/tenant-engine-audit-core-sender-projection.md; reseed with railiance-platform/scripts/tenant_engine_audit_core_sender_seed.py
  sources:
  - ops-mason plan (hand-filled 2026-10-09)
  used_by: ESO ClusterSecretStore openbao-tenant-engine-audit-core-sender (k8s role tenant-engine-audit-core-sender-eso)
    -> Secret tenant-engine/tenant-engine-audit-core-sender key token
platform/workloads/user-engine/runtime:
  description: 'user-engine runtime secrets: the portal edge marker and the identity-provisioner service
    token. Not a user credential.'
  missing:
  - on_loss
  on_loss: ''
  owner: railiance-platform
  review: draft
  rotation: 'ops-mason/plans/user-engine-openbao-runtime-custody.md (rows 8-9: ExternalSecret is the sole
    writer and rotation path)'
  sources:
  - ops-mason plan (hand-filled 2026-10-09)
  used_by: user-engine and identity-provisioner via External Secrets Operator