Implement offline catalog lane scaffold generation

Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a10391-6355-7b41-b0fa-3e14e874f091

docs/catalog-lane-scaffold.md

@@ -0,0 +1,63 @@
+# Offline exact KV-v2 workload-read lane scaffold
+
+Owner: railiance-platform, RPF-WP-0050-T04. Warden pointer seam:
+`ops-warden/wiki/CatalogLaneScaffoldContract.md`, WARDEN-WP-0041.
+
+Run `python3 scripts/credential-change.py scaffold-lane --input <platform-request.yaml> --catalog-manifest <warden-request.yaml> --output-dir <new-external-staging-dir>`.
+The catalog manifest is optional for ordinary local preparation and required for
+cross-owner fixture acceptance. Both inputs are metadata only; this command has
+no execute, credential, network, approval or apply option. jsonschema and PyYAML
+are required, as used by the local validation environment.
+
+`schemas/catalog-lane-scaffold.schema.json` is the closed platform request v1.
+Explicit owner/consumer/lane, prospective Kubernetes SA/namespace/role/audience,
+exact KV mount/path/field names, namespace-restricted ESO destination, risk for the
+entire readable path and required review roles must be supplied. Missing claims
+and risk are not inferred. The first shape supports one prospective ESO reader,
+audience openbao and a maximum fifteen-minute token TTL. Tenant/dynamic secret,
+OIDC/ceremony, wildcard, metadata listing, self-lifecycle and executable fetching
+need separate reviewed extensions. No credential values or protected URLs belong
+in this input. Unknown fields, malformed/duplicate YAML keys, control characters,
+secret markers, invalid calendar dates and mismatched mappings are refused with
+safe errors. Warden's unknown workload identity remains unknown and does not
+confirm the prospective platform auth binding.
+
+The generator reuses `credential-change.py`'s `generated_policy_hcl` and
+`auth_payload`, preserving one exact data-read path and explicit policies/claims.
+It emits six draft review artifacts: a CCR under `credential-change-requests/`,
+its policy under `openbao/policies/`, auth payload under `openbao/auth/`, ESO review
+manifest under `manifests/`, a non-executed evidence checklist under
+`docs/evidence/`, and README. The policy path in the CCR is the eventual owner
+repository destination, relative to the staged bundle. Auth payloads are wrapped
+in draft metadata; no command executes them. No Secret object or value is emitted.
+
+CCR status is proposed, review comments empty, bound claims unconfirmed and
+frontdoor pending-review/unresolvable. Store/ExternalSecret annotations also say
+pending-review. The ExternalSecret target has explicit annotation metadata to
+contain source last-applied annotation copying. Evidence is not-executed and
+verified=false; it lists metadata/capability/negative/cleanup receipts the owner
+must produce later using its reviewed output-suppressing tools. It is a scaffold,
+not a successful verification receipt. Nothing is apply-ready authority.
+
+Generation requires a new output directory outside the platform or other owner
+repository, refuses existing paths including symlinks, and never overwrites any
+file. Caller-selected staging beneath the system temporary root is supported.
+Inputs remain immutable and artifacts are deterministic; explicit dates and
+request/catalog SHA256 bind provenance without clock/network reads.
+
+## Cross-owner fixture
+
+`examples/catalog-lane-scaffold/platform-request.yaml` and `warden-request.yaml`
+use synthetic lane example-workload-kv, consumer example-consumer, prospective
+reader example-consumer-eso and CCR-2099-9001. No published workload identity,
+existing client or credential is claimed. Warden manifest references the platform
+request and eventual CCR destination, includes explicit reviewed date and whole
+path risk. Platform checks shared schema/lane/title/consumer/owner/risk and exact
+CCR destination; Warden validates its own complete pointer schema.
+
+Run both owner scaffold commands into separate new temporary directories and
+compare the Warden draft catalog with the proposed CCR. Same lane and pointers,
+risk/owner/consumer parity, retained unknown identity, unconfirmed platform claims,
+unresolvable frontdoor and absence of executable fetch/approval state are required.
+The synthetic fixture does not admit an actual lane. Source parity remains distinct
+from any founder custody choice, attended dated window or production promotion.

docs/evidence/2026-10-04-catalog-lane-scaffold-offline.json

@@ -0,0 +1,33 @@
+{
+  "status": "passed",
+  "scope": "actual offline owner CLIs + independently verified deterministic cross-owner fixture; no admission or runtime act",
+  "platform_stage": "/tmp/p4-cross-platform-tj7_84lv/platform",
+  "warden_stage": "/tmp/warden-cross-owner-catalog",
+  "fixture_sha256": "38647d436ccfa8893974c4b88c93d3bd94a9c0a21a2603b54bd84c0195954e32",
+  "artifact_sha256": {
+    "README.md": "2f48aa6ef925f62722ca32d38283d746c0c386da751dec3f9a76fba125d24245",
+    "credential-change-requests/CCR-2099-9001.yaml": "e9db54694b966f186433aaf1f3de6685d8f34be166af9d966950bcca448f151f",
+    "docs/evidence/example-workload-kv.checklist.json": "7d9a58b160c958d8d46f7029398eef8e70f87f0d9423198fb789bdf8fe3a9f9a",
+    "manifests/example-workload-kv.draft.yaml": "2d23bee7451735e2a0aa74435c65a0968bd05e35c35625a4087e2f286a2408b5",
+    "openbao/auth/example-consumer-eso.draft.json": "545a03c95c50b68b0eb127ae5e72d904faf9f68ecfabe26deac27730905b476d",
+    "openbao/policies/workload-kv-read-example-consumer.hcl": "c2821cd6fe5bb16564366fb12fd37c559048841a41c6f2778ad2dad5901e4df4"
+  },
+  "new_scaffold_tests": 14,
+  "prior_window_tests": 7,
+  "unknown_workload_preserved": true,
+  "prospective_auth_claims_unconfirmed": true,
+  "frontdoor_pending_unresolvable": true,
+  "evidence_not_executed": true,
+  "source_sha256": {
+    "scripts/catalog_lane_scaffold.py": "96d60cc47aa78728f5ba96ce1fd63033adf23c05641de93ebbdda3902082d2d1",
+    "scripts/credential-change.py": "d78c493e7c75f3ad0e013745bc13e9f79b9fffc560e5c33ece62e982d800b391",
+    "schemas/catalog-lane-scaffold.schema.json": "8c2100052a86ebef021398bed662ed8a0fe6970506b785b22cec2398e75adaff",
+    "examples/catalog-lane-scaffold/platform-request.yaml": "2070fa0f937ee03add01d1e78b9dbdebf72472b3d8fcc8fae9a51436ec60ab8e",
+    "examples/catalog-lane-scaffold/warden-request.yaml": "38647d436ccfa8893974c4b88c93d3bd94a9c0a21a2603b54bd84c0195954e32",
+    "tests/test_catalog_lane_scaffold.py": "a4abc80b0a29362296208f7d233b9a206a299d0c47f244929f9851fb543911c6",
+    "docs/catalog-lane-scaffold.md": "f6b46acf6515fc13a7ce64b74306c9225c9384f73e63bc7b9723232b08ad3c3c"
+  },
+  "task_id": "RPF-WP-0050-T04",
+  "task_uuid": "6475d924-92c6-504a-b9a1-4f035273f0e1",
+  "recorded_date": "2026-10-04"
+}