railiance-platform/docs/credential-lane-designs

Pending credential lane designs

Reviewed against local owner source on 2026-09-05. These are proposed designs, not approvals or executable CCRs. No live credentials or OpenBao objects were created. Files here are deliberately outside the production CCR/policy scan.

Design	Owning platform workplan	Consumer dependency	Main unresolved input
Secrets-engine service JWT	RPF-WP-0032	SECRETS-WP-0008-T06; SECRETS-WP-0007-T04	Actual issuer/JWKS, live registration and scoped execution authority
Fluid-telegram operator KV	RPF-WP-0033	MASON-WP-0005; FT-WP-0002	Tenant acceptance, actual OIDC group, write-capable CCR support
State Hub preflight signing	RPF-WP-0034	STATE-WP-0085-T09	Deployment binding, owner-approved custody and rotation window

Each workplan separates completed design work from the owner review, implementation, and live acceptance still required. Proposed object names can be reviewed now; none represents a surveyed or active object. Before any secret or access request, use warden route find / warden route show as required by AGENTS.md. Keep values, bearer tokens and signing/preflight tokens out of Git, State Hub, argv and captured logs. Only the final verified contract becomes routable. No owner coordination messages were sent by this design work.

The source references use sibling checkout paths for review. Implementation approval must pin the actual revisions and rerun a metadata-only live survey.

Reviewed source revisions

Owner repository	Revision
key-cape	30fa8570aaff6e03c35617b265201b2ebf2c0094
secrets-engine	ebdff586fe60d165bc717f3fa1de8e037fd5502a
ops-mason	f920bcad1af688197c15417257b392aec42db9e7
fluid-telegram	f7af151f37a7d652fe389daf43efc9be0d3e2bc0
state-hub	2c60e5bcf76c31a2d2336f104ac9d5f01fc22e90