Three fixes, the first of which is my own botched edit from an hour ago.
1. The "six delivery modes" claim was never actually removed. I ran a str.replace
with no assertion on the result, it matched nothing, and the print said "ok".
The wrong claim sat in all seven lanes while I told secrets-engine it was
fixed. This edit asserts 5/1/1 and fails loudly otherwise.
2. Five lanes ACCEPTED (SECRETS-WP-0006, decision ae676382). The blocker now
records that secrets-engine holds the entry and that the interim proxy retires
on approved native verification in T05 -- not on acceptance. Retiring early
would drop the cover before the replacement is proven.
3. Two lanes REFUSED, and both refusals are right:
- key-cape-oidc-login: intended_owner corrected secrets-engine -> key-cape.
Login and identity-token issuance were never secrets-engine's. Not yet asked
of key-cape, and the record says so.
- openbao-api-key: not a delegable lane at all -- a <domain>/<workload>/<bundle>
routing template, not one secret lane, so there is no front door to own.
interim -> native with railiance-platform named: OpenBao is itself the front
door and this entry is a pointer to it, never an interim cover. It should
not have been inflating the interim count.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
tegwick
675e04e8e6