Consolidate platform workplans and assess intent gaps

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a06ecb-456a-71c2-b41e-0755d336e883

workplans/RPF-WP-0035-credential-lane-implementation.md

@@ -0,0 +1,119 @@
+---
+id: RPF-WP-0035
+type: workplan
+title: "Implement reviewed credential lanes with separate owner gates"
+domain: financials
+repo: railiance-platform
+status: blocked
+owner: codex
+created: "2026-09-05"
+updated: "2026-09-05"
+related:
+  - RPF-WP-0032
+  - RPF-WP-0033
+  - RPF-WP-0034
+---
+
+# Credential lane implementation
+
+One S3 queue for three designed lanes; each task keeps its own approval,
+execution and closure boundary. This replaces the implementation tasks in the
+three completed design workplans, not the designs themselves. No approval is
+inherited by consolidation. INTENT binding: secure custody, dependable delivery,
+stable consumer interfaces. Incident custody remains in RPF-WP-0027/0029.
+
+## Consolidate completed designs and owner dependencies
+
+```task
+id: RPF-WP-0035-T01
+status: done
+priority: medium
+```
+
+Completed 2026-09-05. Preserved the three designs under
+`docs/credential-lane-designs/`, identified native owner responsibilities and
+linked each superseded task below. Owners have not been sent new requests and
+no new external acceptance is claimed. STATE-WP-0085-T09 is already done;
+the signing dependency belongs to the proposed FLEX-WP-0020-T05 cutover.
+
+## Accept and provision secrets-engine service JWT login
+
+```task
+id: RPF-WP-0035-T02
+status: wait
+priority: high
+```
+
+Supersedes RPF-WP-0032-T02. Design:
+`docs/credential-lane-designs/secrets-engine-service-jwt.md`.
+
+Platform owns the exact JWT mount/role/policy, effective-policy negative tests
+and a metadata-only custody receipt. KeyCape owns issuer/JWKS and service
+registration (KEY-WP-0009); secrets-engine owns service authentication and
+authority consumption (SECRETS-WP-0008-T06, SECRETS-WP-0007-T04).
+
+**Unblock:** confirmed HTTPS issuer/JWKS, exact claims and audience, consumer
+readiness, approved source and attended apply authority. A service login does
+not grant lane mutation authority. Do not build another identity provider or
+lifecycle engine here.
+
+**Done when:** approved exact role succeeds for the intended service, wrong
+issuer/audience/subject/claims and unrelated secret access fail, bounded TTL
+and revocation are proven, the consumer explicitly opts into the verified
+contract, and rollback/cleanup receipts contain no secret material.
+
+## Implement the platform operator-write CCR contract and Fluid lane
+
+```task
+id: RPF-WP-0035-T03
+status: wait
+priority: high
+```
+
+Supersedes RPF-WP-0033-T02. Design:
+`docs/credential-lane-designs/fluid-telegram-operator-kv.md`.
+
+Platform owns the per-path capability schema/validator, exact OpenBao policy
+and accepted custody coordinates. MASON-WP-0005 owns construction coordination
+and engine integration; KeyCape/NetKingdom own OIDC/MFA and group membership;
+FT-WP-0002 owns client CAS, prefix correction, output containment and Telegram
+application acceptance. Retain the existing read-only CCR semantics.
+
+**Unblock:** accept tenant/path and per-entry field/capability matrix; confirm
+actual group/assurance and callbacks, reviewed construction contract and writer
+authority. Contract review can proceed without a live credential; the final
+schema cannot be treated as accepted solely because a draft exists.
+
+**Done when:** validation rejects broad/unsupported grants, the consumer proves
+CAS=0 first-write behavior and no value output, approved identities can perform
+only the exact matrix, negative/expiry/revocation checks pass, custody is seeded
+through the separate writer, and the verified route has a safe handoff receipt.
+The unattended adapter remains a separate demand and gets no operator session.
+
+## Accept the needed signing lane and deliver it to the owning runtime
+
+```task
+id: RPF-WP-0035-T04
+status: wait
+priority: medium
+```
+
+Supersedes RPF-WP-0034-T02. Design:
+`docs/credential-lane-designs/state-hub-preflight-signing.md`.
+
+Platform owns signing-key custody, exact read policy/role and scoped delivery
+acceptance. State Hub owns API chart/env wiring, all-replica rotation fencing
+and health. FLEX-WP-0020-T05 owns the rename preflight/cutover dependency;
+STATE-WP-0085-T09's adoption-plan delivery is already complete.
+
+**Unblock:** State Hub/repo-manager and the consuming migration owner confirm
+that this transitional State Hub lane is still needed during retirement;
+record the target runtime, namespace/SA/auth audience and an executable
+rotation fence, plus approved writer and deployment window. Do not broaden the
+lane into a general repository-rename authority or provision for a stale demand.
+
+**Done when:** protected one-time generation, API-only ESO delivery, negative
+access checks and a non-mutating signed preflight pass; every API replica uses
+the accepted version; rotation/invalidation and recovery are evidenced. No
+repository rename is part of S3 lane acceptance. If demand is withdrawn, record
+the owning decision and cancel this task explicitly rather than provision it.