32d5cf0211
RPF-WP-0035-T06. Adds CCR-2026-0019 (secrets-engine) and CCR-2026-0020 (approval-engine-operator) with their exact-path read policies, reusing the existing version-1 custody from the verifier activation. No reseed, rotation, shared reader or verifier Secret reuse; both requests are in_flight and nothing is applied. The two shapes were decided by read-only survey rather than assumed. secrets-engine consumes its client secret through an operator-run CLI reading a protected file, and its namespace holds no workload, so reader 1 is an attended operator-workstation OIDC lane rather than an ESO lane; its one missing input is the operator group claim, which NetKingdom and KeyCape own. approval-engine is not deployed and no owner source names who presents the operator client, so reader 2 records the undetermined actor instead of guessing one for the widest approval scope in the pair. Both declare openbao.auth missing rather than carrying a placeholder binding. T06 moves to wait on those two owner inputs. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01WLUjpv3ssxNRAEPPgLFnEB Assistant: claude-code Assistant-Model: opus Assistant-Process: 1275505@bnt-lap001 Assistant-Session: 97265baa-f08f-4032-b290-a1e2965a69c5
2.8 KiB
Pending credential lane designs
Reviewed against local owner source on 2026-09-05. These are proposed designs,
not approvals or executable CCRs. No live credentials or OpenBao objects were
created. Files here are deliberately outside the production CCR/policy scan, except the
KeyCape approval-client admission below, which carries executable CCRs
(CCR-2026-0017/0018) that remain proposed and unapplied.
| Design | Design workplan / current implementation task | Consumer dependency | Main unresolved input |
|---|---|---|---|
| Secrets-engine service JWT | RPF-WP-0032 (finished) / RPF-WP-0035-T02 | SECRETS-WP-0008-T06; SECRETS-WP-0007-T04 | Actual issuer/JWKS, live registration and scoped execution authority |
| Fluid-telegram operator KV | RPF-WP-0033 (finished) / RPF-WP-0035-T03 | MASON-WP-0005; FT-WP-0002 | Tenant acceptance, actual OIDC group, write-capable CCR support |
| State Hub preflight signing | RPF-WP-0034 (finished) / RPF-WP-0035-T04 | FLEX-WP-0020-T05; STATE-WP-0085-T09 delivered | Deployment binding, owner-approved custody and rotation window |
| KeyCape approval-engine clients | RPF-WP-0035-T05 | KEY-WP-0013-T02; GLAS-WP-0015 | Owner approval of CCR-2026-0017/0018, attended founder window, KeyCape reading build |
| Approval client-side readers | RPF-WP-0035-T06 | SECRETS-WP-0009-T03; APPROVAL-WP-0002 | Reader 1: exact operator group claim; Reader 2: the presenting actor is unnamed by any owner source |
The completed design workplans are archived. RPF-WP-0035 is the canonical
queue for owner review, implementation, and live acceptance still required.
State Hub retirement requires revalidating the signing demand before provisioning. Proposed object names can
be reviewed now; none represents a surveyed or active object. Before any secret
or access request, use warden route find / warden route show as required by
AGENTS.md. Keep values, bearer tokens and signing/preflight tokens out of Git,
State Hub, argv and captured logs. Only the final verified contract becomes
routable. No owner coordination messages were sent by this design work.
The source references use sibling checkout paths for review. Implementation approval must pin the actual revisions and rerun a metadata-only live survey.
Reviewed source revisions
| Owner repository | Revision |
|---|---|
key-cape |
30fa8570aaff6e03c35617b265201b2ebf2c0094 |
secrets-engine |
ebdff586fe60d165bc717f3fa1de8e037fd5502a |
ops-mason |
f920bcad1af688197c15417257b392aec42db9e7 |
fluid-telegram |
f7af151f37a7d652fe389daf43efc9be0d3e2bc0 |
state-hub |
2c60e5bcf76c31a2d2336f104ac9d5f01fc22e90 |