f3ba7ca882
Answers KEY-WP-0013-T02. Both proposed KV paths are confirmed unchanged; the field name is corrected to CLIENT_SECRET for the platform uppercase convention and the CCR validator. Kubernetes delivery references are confirmed against the live sso namespace. Attended authority is the governed openbao-platform-admin-login lane, and the rollout is one attended window ordered after the Authelia issuer precondition. Adds CCR-2026-0017/0018, two exact-path read policies, two namespace-limited ClusterSecretStores with Kubernetes auth, two ExternalSecrets, and RPF-WP-0035-T05. Nothing is applied and no value exists: both CCRs remain proposed. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01WLUjpv3ssxNRAEPPgLFnEB Assistant: claude-code Assistant-Model: opus Assistant-Process: 1275505@bnt-lap001 Assistant-Session: 97265baa-f08f-4032-b290-a1e2965a69c5
36 lines
2.5 KiB
Markdown
36 lines
2.5 KiB
Markdown
# Pending credential lane designs
|
|
|
|
Reviewed against local owner source on 2026-09-05. These are proposed designs,
|
|
not approvals or executable CCRs. No live credentials or OpenBao objects were
|
|
created. Files here are deliberately outside the production CCR/policy scan, except the
|
|
KeyCape approval-client admission below, which carries executable CCRs
|
|
(CCR-2026-0017/0018) that remain `proposed` and unapplied.
|
|
|
|
| Design | Design workplan / current implementation task | Consumer dependency | Main unresolved input |
|
|
| --- | --- | --- | --- |
|
|
| [Secrets-engine service JWT](secrets-engine-service-jwt.md) | RPF-WP-0032 (finished) / RPF-WP-0035-T02 | SECRETS-WP-0008-T06; SECRETS-WP-0007-T04 | Actual issuer/JWKS, live registration and scoped execution authority |
|
|
| [Fluid-telegram operator KV](fluid-telegram-operator-kv.md) | RPF-WP-0033 (finished) / RPF-WP-0035-T03 | MASON-WP-0005; FT-WP-0002 | Tenant acceptance, actual OIDC group, write-capable CCR support |
|
|
| [State Hub preflight signing](state-hub-preflight-signing.md) | RPF-WP-0034 (finished) / RPF-WP-0035-T04 | FLEX-WP-0020-T05; STATE-WP-0085-T09 delivered | Deployment binding, owner-approved custody and rotation window |
|
|
| [KeyCape approval-engine clients](keycape-approval-clients.md) | RPF-WP-0035-T05 | KEY-WP-0013-T02; GLAS-WP-0015 | Owner approval of CCR-2026-0017/0018, attended founder window, KeyCape reading build |
|
|
|
|
The completed design workplans are archived. RPF-WP-0035 is the canonical
|
|
queue for owner review, implementation, and live acceptance still required.
|
|
State Hub retirement requires revalidating the signing demand before provisioning. Proposed object names can
|
|
be reviewed now; none represents a surveyed or active object. Before any secret
|
|
or access request, use `warden route find` / `warden route show` as required by
|
|
AGENTS.md. Keep values, bearer tokens and signing/preflight tokens out of Git,
|
|
State Hub, argv and captured logs. Only the final verified contract becomes
|
|
routable. No owner coordination messages were sent by this design work.
|
|
|
|
The source references use sibling checkout paths for review. Implementation
|
|
approval must pin the actual revisions and rerun a metadata-only live survey.
|
|
|
|
## Reviewed source revisions
|
|
|
|
| Owner repository | Revision |
|
|
| --- | --- |
|
|
| `key-cape` | `30fa8570aaff6e03c35617b265201b2ebf2c0094` |
|
|
| `secrets-engine` | `ebdff586fe60d165bc717f3fa1de8e037fd5502a` |
|
|
| `ops-mason` | `f920bcad1af688197c15417257b392aec42db9e7` |
|
|
| `fluid-telegram` | `f7af151f37a7d652fe389daf43efc9be0d3e2bc0` |
|
|
| `state-hub` | `2c60e5bcf76c31a2d2336f104ac9d5f01fc22e90` |
|