History

codex 5d6d8724b4 All checks were successful CI Smoke / host-smoke (push) Successful in 0s Details CI Smoke / container-smoke (push) Successful in 1s Details Complete live State Hub signing activation and rotation acceptance Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a06ecb-456a-71c2-b41e-0755d336e883		2026-09-05 18:12:37 +02:00
..
fluid-telegram-operator-kv.md	Document credential lane designs and adopt fast projection sync	2026-09-05 10:41:56 +02:00
README.md	Consolidate platform workplans and assess intent gaps	2026-09-05 11:14:42 +02:00
secrets-engine-service-jwt.md	Document credential lane designs and adopt fast projection sync	2026-09-05 10:41:56 +02:00
state-hub-preflight-activation.md	Complete live State Hub signing activation and rotation acceptance	2026-09-05 18:12:37 +02:00
state-hub-preflight-signing.md	Complete live State Hub signing activation and rotation acceptance	2026-09-05 18:12:37 +02:00

README.md

Pending credential lane designs

Reviewed against local owner source on 2026-09-05. These are proposed designs, not approvals or executable CCRs. No live credentials or OpenBao objects were created. Files here are deliberately outside the production CCR/policy scan.

Design	Design workplan / current implementation task	Consumer dependency	Main unresolved input
Secrets-engine service JWT	RPF-WP-0032 (finished) / RPF-WP-0035-T02	SECRETS-WP-0008-T06; SECRETS-WP-0007-T04	Actual issuer/JWKS, live registration and scoped execution authority
Fluid-telegram operator KV	RPF-WP-0033 (finished) / RPF-WP-0035-T03	MASON-WP-0005; FT-WP-0002	Tenant acceptance, actual OIDC group, write-capable CCR support
State Hub preflight signing	RPF-WP-0034 (finished) / RPF-WP-0035-T04	FLEX-WP-0020-T05; STATE-WP-0085-T09 delivered	Deployment binding, owner-approved custody and rotation window

The completed design workplans are archived. RPF-WP-0035 is the canonical queue for owner review, implementation, and live acceptance still required. State Hub retirement requires revalidating the signing demand before provisioning. Proposed object names can be reviewed now; none represents a surveyed or active object. Before any secret or access request, use warden route find / warden route show as required by AGENTS.md. Keep values, bearer tokens and signing/preflight tokens out of Git, State Hub, argv and captured logs. Only the final verified contract becomes routable. No owner coordination messages were sent by this design work.

The source references use sibling checkout paths for review. Implementation approval must pin the actual revisions and rerun a metadata-only live survey.

Reviewed source revisions

Owner repository	Revision
`key-cape`	`30fa8570aaff6e03c35617b265201b2ebf2c0094`
`secrets-engine`	`ebdff586fe60d165bc717f3fa1de8e037fd5502a`
`ops-mason`	`f920bcad1af688197c15417257b392aec42db9e7`
`fluid-telegram`	`f7af151f37a7d652fe389daf43efc9be0d3e2bc0`
`state-hub`	`2c60e5bcf76c31a2d2336f104ac9d5f01fc22e90`