Classify 5 proxy lanes interim; hold 6 pending secrets-engine

Revised the classification axis after inspecting the entries: sorting by
subsystem was wrong. Nine of eleven lanes are a generic KV read with the
caller's own token, duplicating no owner procedure. Test is now
procedure-or-lifecycle vs generic read.

Interim now: rapp-qonto-keycape-client (key-cape), binky-company-email-imap
and binky-qonto-api (tenant-engine), railiance-backup-offsite-lane and
agent-harness-forgejo-deploy (re-establish procedures).

Held: the six thin-wrapper lanes are permanent only if secrets-engine exec
stays per-lane; asked whether it generalizes (msg 7d55d332).

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

history/2026-08-11-delegation-surface-assessment.md

@@ -41,23 +41,40 @@ Consequence: an absorbed need is indistinguishable from a designed one. Ownershi
 drift is invisible by construction, which is exactly the failure mode the directive
 targets.
 
-## 3. Drafted classification of the eleven
+## 3. Classification of the eleven (revised on inspection, founder review 2026-08-11)
 
-Not authoritative — architecture judgement belongs to the founder (WP-0030 T02).
+A first draft sorted by *subsystem* — tenant lanes to tenant-engine, workload lanes to
+secrets-engine. Reading the entries showed that is the wrong axis. Nine of the eleven
+share one `auth_method` ("caller's own OpenBao token" via operator OIDC or a
+`workload-kv-read-*` policy) and one `fetch_command` shape
+(`bao kv get -field=X <path>`). No owner procedure is duplicated in those. Contrast
+`whynot-design-npm-publish` — npm config plus token injection into a specific tool, a
+*procedure*, which is why WP-0019 handed it to secrets-engine.
 
-| Lane | Draft reading | Intended owner / blocker |
+**Test applied: owner-specific procedure or lifecycle → interim. Generic KV read →
+thin wrapper, arguably permanent.**
+
+### Interim (5) — classified
+
+| Lane | Intended owner | Blocked on |
 | --- | --- | --- |
-| `key-cape-oidc-login` | **Permanent** | Login is key-cape's; the proxy is caller convenience, not custody |
-| `openbao-api-key` | **Permanent (by design)** | Generic escape hatch for any OpenBao path; a catch-all, not a lane |
-| `binky-company-email-imap` | Interim | **tenant-engine** — WP-0028 defined the tenant custody pattern; no tenant front door executes it |
-| `binky-qonto-api` | Interim | **tenant-engine** — same |
-| `rapp-qonto-keycape-client` | Interim | **tenant-engine** / key-cape — tenant workload client credential |
-| `issue-core-ingestion-api-key` | Interim | **secrets-engine** — same shape WP-0019 closed for npm publish |
-| `openrouter-llm-connect` | Interim | **secrets-engine** — high-risk provider key |
-| `reuse-surface-hub-write-token` | Interim | **secrets-engine** |
-| `railiance-backup-offsite-lane` | Interim | **secrets-engine** / railiance-platform |
-| `forgejo-admin-api-token` | Interim | **secrets-engine** |
-| `agent-harness-forgejo-deploy` | Interim | **secrets-engine** |
+| `rapp-qonto-keycape-client` | key-cape | `client_secret_basic` exchange is a key-cape procedure; rotation already `automatable: true` |
+| `binky-company-email-imap` | tenant-engine | `tenants/binky/...` custody, rotation owned by `binky-control` — split lifecycle |
+| `binky-qonto-api` | tenant-engine | Same split |
+| `railiance-backup-offsite-lane` | railiance-platform | Rotation is `re-establish`, a procedure ops-warden only describes |
+| `agent-harness-forgejo-deploy` | railiance-platform / agent-harness | `re-establish` + alternative host-local key path |
+
+### Held (6) — pending secrets-engine
+
+`openbao-api-key`, `key-cape-oidc-login`, `issue-core-ingestion-api-key`,
+`reuse-surface-hub-write-token`, `openrouter-llm-connect`, `forgejo-admin-api-token`.
+
+Permanent **only if** `secrets-engine exec` stays per-lane and provisioned. If it
+generalizes over arbitrary OpenBao lanes, all six become interim with secrets-engine as
+intended owner. Asked directly (msg `7d55d332`). For three of them
+(`issue-core-*`, `reuse-surface-*`, `openrouter-llm-connect`) production never touches
+the proxy at all — External Secrets delivers the value and the proxy serves operator
+verification only, which weakens the case that a front door is missing.
 
 **No lane names `user-engine` as owner.** It appears only as a *consumer* inside
 `coulomb-social-runtime-env` (route-only, owned by railiance-platform), whose rotation