Document credential lane designs and adopt fast projection sync

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a06ecb-456a-71c2-b41e-0755d336e883

workplans/RPF-WP-0032-secrets-engine-service-jwt-design.md

@@ -0,0 +1,40 @@
+---
+id: RPF-WP-0032
+type: workplan
+title: "Design secrets-engine service JWT login"
+domain: financials
+repo: railiance-platform
+status: blocked
+owner: codex
+created: "2026-09-05"
+updated: "2026-09-05"
+---
+
+# Design secrets-engine service JWT login
+
+## Prepare the platform design
+
+```task
+id: RPF-WP-0032-T01
+status: done
+priority: high
+```
+
+Reviewed owner source and the current platform CCR contract. Delivered
+`docs/credential-lane-designs/secrets-engine-service-jwt.md` with proposed exact scope, custody, lifecycle, implementation gaps,
+approval requirements and positive/negative acceptance evidence. This is a
+completed design deliverable, not a live lane or approval. No secrets accessed,
+production objects changed or owner messages sent.
+
+## Obtain owner inputs and implement the approved lane
+
+```task
+id: RPF-WP-0032-T02
+status: wait
+priority: high
+```
+
+Confirm issuer, verification endpoint, actual KeyCape registration and live auth mount survey. Approve the login-only role/self policy, implement reviewed declarative support and prove effective-policy, wrong-claim, expiry and cleanup checks. Native lane execution still requires its separate exact authorization and scoped authority.
+
+Review the linked design and pin current source revisions before implementation.
+Do not interpret this workplan or a proposed coordinate as live authorization.

workplans/RPF-WP-0033-fluid-telegram-operator-kv-design.md

@@ -0,0 +1,40 @@
+---
+id: RPF-WP-0033
+type: workplan
+title: "Design fluid-telegram attended operator KV lane"
+domain: financials
+repo: railiance-platform
+status: blocked
+owner: codex
+created: "2026-09-05"
+updated: "2026-09-05"
+---
+
+# Design fluid-telegram attended operator KV lane
+
+## Prepare the platform design
+
+```task
+id: RPF-WP-0033-T01
+status: done
+priority: high
+```
+
+Reviewed owner source and the current platform CCR contract. Delivered
+`docs/credential-lane-designs/fluid-telegram-operator-kv.md` with proposed exact scope, custody, lifecycle, implementation gaps,
+approval requirements and positive/negative acceptance evidence. This is a
+completed design deliverable, not a live lane or approval. No secrets accessed,
+production objects changed or owner messages sent.
+
+## Obtain owner inputs and implement the approved lane
+
+```task
+id: RPF-WP-0033-T02
+status: wait
+priority: high
+```
+
+Obtain tenant/group/MFA decisions; extend the CCR schema, validator, renderer and ops-mason executor for the exact four-entry matrix; correct the consumer tenant default, atomic salt creation and preflight output. Complete an attended installed-engine probe and boundary checks before any routing activation.
+
+Review the linked design and pin current source revisions before implementation.
+Do not interpret this workplan or a proposed coordinate as live authorization.

workplans/RPF-WP-0034-state-hub-preflight-signing-design.md

@@ -0,0 +1,40 @@
+---
+id: RPF-WP-0034
+type: workplan
+title: "Design State Hub preflight signing custody"
+domain: financials
+repo: railiance-platform
+status: blocked
+owner: codex
+created: "2026-09-05"
+updated: "2026-09-05"
+---
+
+# Design State Hub preflight signing custody
+
+## Prepare the platform design
+
+```task
+id: RPF-WP-0034-T01
+status: done
+priority: high
+```
+
+Reviewed owner source and the current platform CCR contract. Delivered
+`docs/credential-lane-designs/state-hub-preflight-signing.md` with proposed exact scope, custody, lifecycle, implementation gaps,
+approval requirements and positive/negative acceptance evidence. This is a
+completed design deliverable, not a live lane or approval. No secrets accessed,
+production objects changed or owner messages sent.
+
+## Obtain owner inputs and implement the approved lane
+
+```task
+id: RPF-WP-0034-T02
+status: wait
+priority: high
+```
+
+Confirm exact primary deployment and delivery identity; approve the writer and read CCR; implement dedicated ESO/API-only delivery and a concrete rotation fence. Provision only in an approved window, prove preflight signing without executing a rename, and record API/ESO health and negative access evidence.
+
+Review the linked design and pin current source revisions before implementation.
+Do not interpret this workplan or a proposed coordinate as live authorization.