coulomb/railiance-platform
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Document credential lane designs and adopt fast projection sync

Browse source 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a06ecb-456a-71c2-b41e-0755d336e883
This commit is contained in:
codex 2026-09-05 10:41:56 +02:00
parent 4c70fa83c5
commit 193b1276f3
9 changed files with 486 additions and 18 deletions
Download patch file Download diff file Expand all files Collapse all files

32
docs/credential-lane-designs/README.md Normal file
View file

@ -0,0 +1,32 @@
# Pending credential lane designs
Reviewed against local owner source on 2026-09-05. These are proposed designs,
not approvals or executable CCRs. No live credentials or OpenBao objects were
created. Files here are deliberately outside the production CCR/policy scan.
| Design | Owning platform workplan | Consumer dependency | Main unresolved input |
| --- | --- | --- | --- |
| [Secrets-engine service JWT](secrets-engine-service-jwt.md) | RPF-WP-0032 | SECRETS-WP-0008-T06; SECRETS-WP-0007-T04 | Actual issuer/JWKS, live registration and scoped execution authority |
| [Fluid-telegram operator KV](fluid-telegram-operator-kv.md) | RPF-WP-0033 | MASON-WP-0005; FT-WP-0002 | Tenant acceptance, actual OIDC group, write-capable CCR support |
| [State Hub preflight signing](state-hub-preflight-signing.md) | RPF-WP-0034 | STATE-WP-0085-T09 | Deployment binding, owner-approved custody and rotation window |
Each workplan separates completed design work from the owner review,
implementation, and live acceptance still required. Proposed object names can
be reviewed now; none represents a surveyed or active object. Before any secret
or access request, use `warden route find` / `warden route show` as required by
AGENTS.md. Keep values, bearer tokens and signing/preflight tokens out of Git,
State Hub, argv and captured logs. Only the final verified contract becomes
routable. No owner coordination messages were sent by this design work.
The source references use sibling checkout paths for review. Implementation
approval must pin the actual revisions and rerun a metadata-only live survey.
## Reviewed source revisions
| Owner repository | Revision |
| --- | --- |
| `key-cape` | `30fa8570aaff6e03c35617b265201b2ebf2c0094` |
| `secrets-engine` | `ebdff586fe60d165bc717f3fa1de8e037fd5502a` |
| `ops-mason` | `f920bcad1af688197c15417257b392aec42db9e7` |
| `fluid-telegram` | `f7af151f37a7d652fe389daf43efc9be0d3e2bc0` |
| `state-hub` | `2c60e5bcf76c31a2d2336f104ac9d5f01fc22e90` |