Complete RAILIANCE-WP-0011-T03 catalog migration for CCR-2026-0005

Activate CCR front door, document reuse-surface lane in workload-kv-access-lanes,
and mark consumer handoff task done.

credential-change-requests/CCR-2026-0005-reuse-surface-runtime-secrets-lane.yaml

@@ -3,7 +3,7 @@ kind: credential-change-request
 schema_version: 1
 request_type: workload-kv-read
 title: reuse-surface runtime secrets lane
-status: verified
+status: active
 created: '2026-07-07'
 updated: '2026-07-07'
 requester:
@@ -71,8 +71,9 @@ access_frontdoor:
   catalog_id: reuse-surface-hub-write-token
   selector: reuse-surface federation hub write bearer token
   command: warden access reuse-surface-hub-write-token --fetch REUSE_SURFACE_TOKEN
-  resolvable: false
+  resolvable: true
-  readiness: pending-review
+  readiness: ready
+  activation: verified-positive-and-negative-access-frontdoor-active-2026-07-07
 delivery:
   surface: external-secrets
   target: ExternalSecret reuse/reuse-surface-runtime -> Secret reuse-surface-env in
@@ -141,6 +142,13 @@ verification:
     details:
     - default-policy OpenBao token denied on platform/workloads/reuse/reuse-surface/runtime-secrets
       (HTTP permission denied)
+  - at: '2026-07-07T20:38:32+00:00'
+    actor: bernd.worsch
+    kind: frontdoor_activation
+    result: passed
+    details:
+    - ops-warden catalog reuse-surface-hub-write-token migrated to bao kv get handoff;
+      resolvable=true; playbook and workload-kv-access-lanes updated (RAILIANCE-WP-0011-T03)
 lifecycle:
   deactivate: Disable ops-warden catalog entry, remove ExternalSecret, and detach
     auth role policy; delete materialized reuse-surface-env only after confirming

docs/workload-kv-access-lanes.md

@@ -229,6 +229,55 @@ Until positive and negative caller verification are complete, ops-warden should
 keep the catalog entry in `applied-pending-verify`/non-active state with
 `resolvable=false`.
 
+## reuse-surface hub runtime secrets (`CCR-2026-0005`)
+
+Production federation hub at `https://reuse.coulomb.social`. Runtime secrets
+are OpenBao-custodied and delivered to Railiance01 via External Secrets.
+
+| Item | Value |
+| --- | --- |
+| CCR | `CCR-2026-0005-reuse-surface-runtime-secrets-lane` |
+| KV mount | `platform` |
+| OpenBao CLI path | `platform/workloads/reuse/reuse-surface/runtime-secrets` |
+| Fields | `REUSE_SURFACE_TOKEN`, `REUSE_SURFACE_FORGEJO_WEBHOOK_SECRET` |
+| Read policy | `workload-kv-read-reuse-surface-runtime` |
+| Policy file | `openbao/policies/workload-kv-read-reuse-surface-runtime.hcl` |
+| K8s auth role | `external-secrets-reuse-surface` (ESO delivery path) |
+| Primary consumer | ExternalSecret `reuse/reuse-surface-runtime` → Secret `reuse-surface-env` (Railiance01, 1h refresh) |
+| Interim ClusterSecretStore | `openbao-reuse` (token auth to `https://bao.coulomb.social`, namespace `reuse`) |
+| ops-warden catalog | `reuse-surface-hub-write-token` |
+
+Fetch hub write token (do not log the value):
+
+```bash
+export REUSE_SURFACE_TOKEN=$(
+  bao kv get -field=REUSE_SURFACE_TOKEN \
+    platform/workloads/reuse/reuse-surface/runtime-secrets
+)
+```
+
+Webhook HMAC (dual consumer — Forgejo org webhook must match):
+
+```bash
+bao kv get -field=REUSE_SURFACE_FORGEJO_WEBHOOK_SECRET \
+  platform/workloads/reuse/reuse-surface/runtime-secrets
+```
+
+Or via ops-warden:
+
+```bash
+warden access reuse-surface-hub-write-token --fetch REUSE_SURFACE_TOKEN
+```
+
+**Consumer facts the generated plan does not cover:**
+
+- `REUSE_SURFACE_FORGEJO_WEBHOOK_SECRET` is consumed by both the hub pod and
+  the Forgejo org webhook. After rotation, run `railiance-apps`
+  `make reuse-forgejo-webhook` once ESO has refreshed.
+- Break-glass cluster read remains available via
+  `kubectl ... get secret reuse-surface-env` when OpenBao is down; steady-state
+  custody is OpenBao + ESO only.
+
 ## Railiance offsite backup lane (`CCR-2026-0004`)
 
 Workstation and platform backup tools (`railiance-backup`, `forgejo-backup`) upload

workplans/RAILIANCE-WP-0011-reuse-surface-runtime-secrets-openbao-lane.md

@@ -107,7 +107,7 @@ path. CCR status `verified`. T03 catalog migration remains open.
 
 ```task
 id: RAILIANCE-WP-0011-T03
-status: wait
+status: done
 priority: low
 state_hub_task_id: "52fc7baf-5257-44cd-ae2c-298ef7edbe96"
 ```
@@ -120,16 +120,22 @@ Blocked on T02 verification.
 - Add lane to `docs/workload-kv-access-lanes.md`
 - Deprecate direct kubectl fetch as primary handoff (keep as break-glass note)
 
+**2026-07-07:** ops-warden catalog `reuse-surface-hub-write-token` migrated to
+`bao kv get -field=REUSE_SURFACE_TOKEN platform/workloads/reuse/reuse-surface/runtime-secrets`
+(owner `railiance-platform`, `resolvable=true`). Playbook, CredentialRouting index,
+`docs/workload-kv-access-lanes.md`, and railiance-apps export handoff updated; kubectl
+documented as break-glass only. CCR-2026-0005 front door `ready`/`resolvable=true`.
+
 ## Forgejo Webhook Rotation Runbook
 
 ```task
 id: RAILIANCE-WP-0011-T04
-status: wait
+status: todo
 priority: low
 state_hub_task_id: "eafc4011-69cf-473f-842c-c58d6a2bece7"
 ```
 
-Blocked on T02.
+Blocked on T03.
 
 - Document rotation: update OpenBao field → ESO sync → rollout →
   `make reuse-forgejo-webhook` (updates org hook secret)