Prepare tenant-zero OpenBao roles and review platform essentials

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a0e324-abce-7e51-bb2b-496f097afdb0

workplans/RPF-WP-0035-credential-lane-implementation.md

@@ -8,7 +8,7 @@ status: blocked
 flavor: implementation
 owner: codex
 created: "2026-09-05"
-updated: "2026-09-15"
+updated: "2026-09-27"
 related:
   - RPF-WP-0032
   - RPF-WP-0033
@@ -56,8 +56,9 @@ and a metadata-only custody receipt. KeyCape owns issuer/JWKS and service
 registration (KEY-WP-0009); secrets-engine owns service authentication and
 authority consumption (SECRETS-WP-0008-T06, SECRETS-WP-0007-T04).
 
-**Unblock:** confirmed HTTPS issuer/JWKS, exact claims and audience, consumer
-readiness, approved source and attended apply authority. A service login does
+**Unblock:** live registration and protected client custody, reviewed exact source
+and attended apply authority. Issuer/JWKS and consumer source claims now agree;
+see the 2026-09-27 return below. A service login does
 not grant lane mutation authority. Do not build another identity provider or
 lifecycle engine here.
 
@@ -276,15 +277,16 @@ governed lane is the live consumer. Do not wrap `secret/coulomb/whynot-design/np
 in a CCR. Value remains unread. Platform will ask secrets-engine which path
 publish actually reads before any attended destroy.
 
-**Unblock:** secrets-engine confirms which location their publish actually reads
-and whether the two hold the same value; the owner of the legacy path is
-identified; and a metadata-or-field-name read of the legacy path is admitted so
-the duplicate can be characterised without reading its value.
+**Unblock:** admit the governed exact-path AppRole policy and coordinated catalog
+path/field migration under SECRETS-WP-0006-T06; prove native delivery from the
+governed lane before the attended legacy destroy. secrets-engine confirmed the
+legacy source path on 2026-09-21 (message `355424d4-17ab-435e-9e1d-6921775cb4a2`).
+No comparison of values, fingerprints, lengths or shapes is needed or authorized.
 
 **Done when:** the legacy path's provenance and consumer are established, the
 governed lane is confirmed as the one in use or the consumer is moved to it as a
-reviewed lane change, the duplicate is destroyed or brought under a CCR with an
-owner, and the disposition is recorded. If the value proves to be live and
+reviewed lane change, the duplicate is destroyed under the September 15 operator decision and the
+disposition is recorded. Do not bring the legacy duplicate under a CCR. If the value proves to be live and
 ungoverned, treat it as an exposure with the same custody rules as RPF-WP-0027:
 never record the value, fingerprint, length or shape.
 
@@ -679,3 +681,18 @@ verify and exec using scoped attended authority, and capture native denial,
 revocation, workload health and key-check evidence. No OpenRouter credential has
 been read and no inference or spend was performed. T03 remains waiting; this
 entry supersedes earlier statements that requester or group admission is missing.
+
+### 2026-09-27 T02/T07 source follow-up
+
+T02 now has the exact proposed RS256 configuration, bounded JWT role and
+self-only policy in `openbao/`. Operator correction: platform infrastructure
+belongs to `tenant:platform`; KeyCape registration and consumer preflight are
+corrected together. Existing live registrations must be migrated and verified.
+Public discovery confirms issuer/JWKS/token endpoint. Registration/custody,
+attended provisioning and live rejection/cleanup evidence remain required;
+T02 stays wait. No service credential or backend entitlement was issued.
+
+T07 consumed the confirmed legacy consumer return. The stale value-comparison
+ask is removed. WARDEN-WP-0037-T03's no-rotation hold stays in force until the
+governed native migration is evidenced. Legacy destruction follows migration;
+neither source reconciliation nor the historical pilot is that evidence.