Prepare bounded State Hub preflight signing lane

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a06ecb-456a-71c2-b41e-0755d336e883

credential-change-requests/CCR-2026-0015-state-hub-preflight-signing.yaml

@@ -0,0 +1,108 @@
+id: CCR-2026-0015
+kind: credential-change-request
+schema_version: 1
+request_type: workload-kv-read
+title: State Hub repository-rename preflight signing read lane
+status: proposed
+created: '2026-09-05'
+updated: '2026-09-05'
+requester:
+  agent: codex
+  reason: User requested RPF-WP-0035-T04. FLEX-WP-0020-T05 still needs signed State
+    Hub preflight; retirement has not replaced this transitional contract. No repository
+    rename is authorized.
+review:
+  required: true
+  required_approvers:
+  - platform-operator
+  - state-hub-owner
+  comments:
+  - at: '2026-09-05'
+    reviewer: codex
+    decision: binding_observed
+    comment: 'Live primary/railiance01: namespace/release/deployment state-hub, API
+      SA state-hub, one replica; ESO CRD supports serviceAccountRef.audiences. New
+      dedicated delivery identity requires live acceptance.'
+target:
+  domain: infotech
+  tenant: state-hub
+  workload: state-hub-api
+  environment: production
+  purpose: Deliver one HMAC signing key to the transitional State Hub API; no rename
+    execution, general credential vending, or second identity authority.
+openbao:
+  mount: platform
+  kv_path: platform/workloads/state-hub/repository-rename-preflight
+  fields:
+  - REPOSITORY_RENAME_PREFLIGHT_SECRET
+  metadata_read: false
+  policy_name: workload-kv-read-state-hub-rename-preflight
+  policy_file: openbao/policies/workload-kv-read-state-hub-rename-preflight.hcl
+  auth:
+    method: kubernetes
+    mount: kubernetes
+    role: state-hub-rename-preflight-eso
+    bound_claims:
+      service_account_names:
+      - state-hub-preflight-eso
+      service_account_namespaces:
+      - state-hub
+    bound_claims_confirmed: false
+    policies:
+    - workload-kv-read-state-hub-rename-preflight
+    ttl: 15m
+    audience: openbao
+    token_max_ttl: 15m
+    token_explicit_max_ttl: 15m
+    token_no_default_policy: true
+access_frontdoor:
+  type: external-secrets
+  catalog_id: state-hub-rename-preflight
+  selector: State Hub API preflight signing delivery only
+  readiness: pending-review
+  resolvable: false
+delivery:
+  surface: external-secrets
+  target: Namespace SecretStore openbao-state-hub-rename-preflight -> ExternalSecret/Secret
+    state-hub-rename-preflight; required explicit API-only secretKeyRef. Owner creation,
+    Retain deletion policy.
+  bootstrap_command: See docs/credential-lane-designs/state-hub-preflight-signing.md;
+    scripts/state_hub_preflight_lane.py stages the attended protected writer separately
+    from this read grant. Owner acceptance and the activation runbook remain pending.
+risk:
+  classification: high
+  notes:
+  - Signing key permits creation of preflight evidence; raw values and tokens must
+    never enter outputs, Git, or State Hub.
+  - All API replicas must be stopped before rotation; no rolling mixed-key population.
+    A bounded coordination API outage is the fence.
+  - ESO is already a trusted cluster-wide controller; no additional broad RBAC is
+    introduced.
+  - No metadata read, parent list, sibling read or workload write access.
+verification:
+  positive:
+  - Exact SA/namespace/audience login and native data GET succeed; ESO SecretSynced.
+  - All API replicas load the accepted version; non-mutating signed preflight and
+    health pass.
+  negative:
+  - Wrong SA, namespace and audience fail login; sibling/metadata/write access denied.
+  - Coding-agent deny wins over the new read policy; API SA cannot mint delivery tokens.
+  - Old signed fixture fails after fenced rotation; tamper, expiry, wrong-key and
+    no-key checks fail closed.
+  activation_conditions:
+  - Reviewed source and attended operator identity available.
+  - Demand remains FLEX-WP-0020-T05; target primary/railiance01 and fixture confirmed.
+  - CAS-zero protected generation, exact read grant, and API-only delivery verified.
+  - Controlled-outage fence and recovery exercised before completion.
+  evidence: []
+lifecycle:
+  deactivate: Fence API replicas, disable signing binding and ESO role, restart without
+    signing; retain KV history by explicit retention decision.
+  rotate: Stop every API replica and verify no matching pods before CAS rotation;
+    wait ESO, recreate API replicas with one version, verify old token invalidation
+    and health.
+  compromised: Stop every API replica immediately; replace key forward with CAS and
+    restart only after ESO verification. Never restore compromised key material.
+state_hub:
+  workplan_id: RPF-WP-0035
+  task_id: RPF-WP-0035-T04