Draft CCR-2026-0005 for reuse-surface runtime secrets lane

RAILIANCE-WP-0011-T01: propose OpenBao path
platform/workloads/reuse/reuse-surface/runtime-secrets with
REUSE_SURFACE_TOKEN and REUSE_SURFACE_FORGEJO_WEBHOOK_SECRET, matching
read policy, and metadata review for Railiance01 interim ESO delivery.

workplans/RAILIANCE-WP-0011-reuse-surface-runtime-secrets-openbao-lane.md

@@ -4,7 +4,7 @@ type: workplan
 title: "reuse-surface Runtime Secrets OpenBao Lane"
 domain: financials
 repo: railiance-platform
-status: backlog
+status: active
 owner: codex
 topic_slug: railiance
 created: "2026-07-07"
@@ -16,6 +16,7 @@ related_repos:
   - railiance-apps
   - reuse-surface
   - ops-warden
+state_hub_workstream_id: "3f9fd8de-7235-4486-aaa7-634dba2bb6fa"
 ---
 
 # RAILIANCE-WP-0011 — reuse-surface Runtime Secrets OpenBao Lane
@@ -44,6 +45,7 @@ chat, prompts, shell history, or workplan text.
 
 | Item | Proposed value |
 | --- | --- |
+| CCR | `CCR-2026-0005` |
 | Tenant/org | `reuse` |
 | Workload | `reuse-surface` |
 | KV mount | `platform` |
@@ -62,8 +64,9 @@ and keep `make reuse-forgejo-webhook` idempotent.
 
 ```task
 id: RAILIANCE-WP-0011-T01
-status: todo
+status: done
 priority: medium
+state_hub_task_id: "8a89c5a0-6ed5-4240-9ce1-1d529ac13b11"
 ```
 
 - Draft CCR for the lane (path, fields, policy, k8s role, ESO target)
@@ -71,15 +74,22 @@ priority: medium
   `docs/credential-lane-lifecycle-runbook.md`
 - Negative review: no secret values in CCR or workplan text
 
+**2026-07-07:** Drafted `CCR-2026-0005` and policy
+`openbao/policies/workload-kv-read-reuse-surface-runtime.hcl`. Metadata review
+confirms Railiance01 `reuse/reuse-surface-env` (two fields), ESO operator SA,
+and forgejo-style interim ClusterSecretStore delivery. CCR remains `proposed`;
+T02 blocked on platform-operator and reuse-surface-owner approval.
+
 ## Platform Apply And Verification
 
 ```task
 id: RAILIANCE-WP-0011-T02
-status: wait
+status: todo
 priority: medium
+state_hub_task_id: "69cf1728-8034-4309-b8ad-eb14184af6b6"
 ```
 
-Blocked on T01 approval.
+Blocked on CCR-2026-0005 approval.
 
 - Apply OpenBao policy + Kubernetes auth role (mirror forgejo-mailer / issue-core scripts)
 - Seed path from existing cluster Secret (one-time operator step; value never logged)
@@ -93,6 +103,7 @@ Blocked on T01 approval.
 id: RAILIANCE-WP-0011-T03
 status: wait
 priority: low
+state_hub_task_id: "52fc7baf-5257-44cd-ae2c-298ef7edbe96"
 ```
 
 Blocked on T02 verification.
@@ -109,6 +120,7 @@ Blocked on T02 verification.
 id: RAILIANCE-WP-0011-T04
 status: wait
 priority: low
+state_hub_task_id: "eafc4011-69cf-473f-842c-c58d6a2bece7"
 ```
 
 Blocked on T02.