32d5cf0211
RPF-WP-0035-T06. Adds CCR-2026-0019 (secrets-engine) and CCR-2026-0020 (approval-engine-operator) with their exact-path read policies, reusing the existing version-1 custody from the verifier activation. No reseed, rotation, shared reader or verifier Secret reuse; both requests are in_flight and nothing is applied. The two shapes were decided by read-only survey rather than assumed. secrets-engine consumes its client secret through an operator-run CLI reading a protected file, and its namespace holds no workload, so reader 1 is an attended operator-workstation OIDC lane rather than an ESO lane; its one missing input is the operator group claim, which NetKingdom and KeyCape own. approval-engine is not deployed and no owner source names who presents the operator client, so reader 2 records the undetermined actor instead of guessing one for the widest approval scope in the pair. Both declare openbao.auth missing rather than carrying a placeholder binding. T06 moves to wait on those two owner inputs. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01WLUjpv3ssxNRAEPPgLFnEB Assistant: claude-code Assistant-Model: opus Assistant-Process: 1275505@bnt-lap001 Assistant-Session: 97265baa-f08f-4032-b290-a1e2965a69c5
37 lines
2.8 KiB
Markdown
37 lines
2.8 KiB
Markdown
# Pending credential lane designs
|
|
|
|
Reviewed against local owner source on 2026-09-05. These are proposed designs,
|
|
not approvals or executable CCRs. No live credentials or OpenBao objects were
|
|
created. Files here are deliberately outside the production CCR/policy scan, except the
|
|
KeyCape approval-client admission below, which carries executable CCRs
|
|
(CCR-2026-0017/0018) that remain `proposed` and unapplied.
|
|
|
|
| Design | Design workplan / current implementation task | Consumer dependency | Main unresolved input |
|
|
| --- | --- | --- | --- |
|
|
| [Secrets-engine service JWT](secrets-engine-service-jwt.md) | RPF-WP-0032 (finished) / RPF-WP-0035-T02 | SECRETS-WP-0008-T06; SECRETS-WP-0007-T04 | Actual issuer/JWKS, live registration and scoped execution authority |
|
|
| [Fluid-telegram operator KV](fluid-telegram-operator-kv.md) | RPF-WP-0033 (finished) / RPF-WP-0035-T03 | MASON-WP-0005; FT-WP-0002 | Tenant acceptance, actual OIDC group, write-capable CCR support |
|
|
| [State Hub preflight signing](state-hub-preflight-signing.md) | RPF-WP-0034 (finished) / RPF-WP-0035-T04 | FLEX-WP-0020-T05; STATE-WP-0085-T09 delivered | Deployment binding, owner-approved custody and rotation window |
|
|
| [KeyCape approval-engine clients](keycape-approval-clients.md) | RPF-WP-0035-T05 | KEY-WP-0013-T02; GLAS-WP-0015 | Owner approval of CCR-2026-0017/0018, attended founder window, KeyCape reading build |
|
|
| [Approval client-side readers](keycape-approval-client-side-readers.md) | RPF-WP-0035-T06 | SECRETS-WP-0009-T03; APPROVAL-WP-0002 | Reader 1: exact operator group claim; Reader 2: the presenting actor is unnamed by any owner source |
|
|
|
|
The completed design workplans are archived. RPF-WP-0035 is the canonical
|
|
queue for owner review, implementation, and live acceptance still required.
|
|
State Hub retirement requires revalidating the signing demand before provisioning. Proposed object names can
|
|
be reviewed now; none represents a surveyed or active object. Before any secret
|
|
or access request, use `warden route find` / `warden route show` as required by
|
|
AGENTS.md. Keep values, bearer tokens and signing/preflight tokens out of Git,
|
|
State Hub, argv and captured logs. Only the final verified contract becomes
|
|
routable. No owner coordination messages were sent by this design work.
|
|
|
|
The source references use sibling checkout paths for review. Implementation
|
|
approval must pin the actual revisions and rerun a metadata-only live survey.
|
|
|
|
## Reviewed source revisions
|
|
|
|
| Owner repository | Revision |
|
|
| --- | --- |
|
|
| `key-cape` | `30fa8570aaff6e03c35617b265201b2ebf2c0094` |
|
|
| `secrets-engine` | `ebdff586fe60d165bc717f3fa1de8e037fd5502a` |
|
|
| `ops-mason` | `f920bcad1af688197c15417257b392aec42db9e7` |
|
|
| `fluid-telegram` | `f7af151f37a7d652fe389daf43efc9be0d3e2bc0` |
|
|
| `state-hub` | `2c60e5bcf76c31a2d2336f104ac9d5f01fc22e90` |
|