9f83e426c7
Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a06ecb-456a-71c2-b41e-0755d336e883
33 lines
2.2 KiB
Markdown
33 lines
2.2 KiB
Markdown
# Pending credential lane designs
|
|
|
|
Reviewed against local owner source on 2026-09-05. These are proposed designs,
|
|
not approvals or executable CCRs. No live credentials or OpenBao objects were
|
|
created. Files here are deliberately outside the production CCR/policy scan.
|
|
|
|
| Design | Design workplan / current implementation task | Consumer dependency | Main unresolved input |
|
|
| --- | --- | --- | --- |
|
|
| [Secrets-engine service JWT](secrets-engine-service-jwt.md) | RPF-WP-0032 (finished) / RPF-WP-0035-T02 | SECRETS-WP-0008-T06; SECRETS-WP-0007-T04 | Actual issuer/JWKS, live registration and scoped execution authority |
|
|
| [Fluid-telegram operator KV](fluid-telegram-operator-kv.md) | RPF-WP-0033 (finished) / RPF-WP-0035-T03 | MASON-WP-0005; FT-WP-0002 | Tenant acceptance, actual OIDC group, write-capable CCR support |
|
|
| [State Hub preflight signing](state-hub-preflight-signing.md) | RPF-WP-0034 (finished) / RPF-WP-0035-T04 | FLEX-WP-0020-T05; STATE-WP-0085-T09 delivered | Deployment binding, owner-approved custody and rotation window |
|
|
|
|
The completed design workplans are archived. RPF-WP-0035 is the canonical
|
|
queue for owner review, implementation, and live acceptance still required.
|
|
State Hub retirement requires revalidating the signing demand before provisioning. Proposed object names can
|
|
be reviewed now; none represents a surveyed or active object. Before any secret
|
|
or access request, use `warden route find` / `warden route show` as required by
|
|
AGENTS.md. Keep values, bearer tokens and signing/preflight tokens out of Git,
|
|
State Hub, argv and captured logs. Only the final verified contract becomes
|
|
routable. No owner coordination messages were sent by this design work.
|
|
|
|
The source references use sibling checkout paths for review. Implementation
|
|
approval must pin the actual revisions and rerun a metadata-only live survey.
|
|
|
|
## Reviewed source revisions
|
|
|
|
| Owner repository | Revision |
|
|
| --- | --- |
|
|
| `key-cape` | `30fa8570aaff6e03c35617b265201b2ebf2c0094` |
|
|
| `secrets-engine` | `ebdff586fe60d165bc717f3fa1de8e037fd5502a` |
|
|
| `ops-mason` | `f920bcad1af688197c15417257b392aec42db9e7` |
|
|
| `fluid-telegram` | `f7af151f37a7d652fe389daf43efc9be0d3e2bc0` |
|
|
| `state-hub` | `2c60e5bcf76c31a2d2336f104ac9d5f01fc22e90` |
|