secrets-engine/SCOPE.md

# SCOPE

> Lightweight boundary for agents and contributors.

## One-liner

secrets-engine is the workflow and automation interface for approved secret
custody, delivery, and lifecycle work across build, test, and production, with
OpenBao as the initial enforcement backend.

## Core Idea

OpenBao is the vault. secrets-engine is the day-to-day interaction layer that
connects cataloged secret lanes, approval decisions, stage-specific OpenBao
roles, safe delivery modes, and non-secret evidence.

## In Scope

- Non-secret catalog of secret lanes, grants, consumers, stages, and delivery
  modes.
- Decision-aware planning and apply flows for OpenBao policies, auth roles, and
  metadata.
- Build, test, and production privilege separation.
- Safe provisioning, verification, rotation, revocation, and deactivation
  workflows.
- Exec-time delivery to operators, agents, CI jobs, workloads, and ops-bridge
  tasks without printing raw values.
- ops-warden routing contract for non-SSH credentials.
- State Hub non-secret evidence and progress integration.
- Canonicalization of terms with info-tech-canon.

## Out of Scope

- Replacing OpenBao as custody, policy, lease, or audit backend.
- Replacing flex-auth authorization decisions.
- Replacing user-engine/key-cape identity and claim lifecycle.
- Issuing SSH certificates, which remains ops-warden responsibility.
- Owning tunnels or remote transport, which remains ops-bridge responsibility.
- Storing raw secret values in this repo, State Hub, chat, prompts, or logs.
- Broad platform-root or platform-admin automation as a steady-state model.

## Current State

The repo is in bootstrap. Seed intent, PRD, boundary documentation, and an MVP
workplan are present. The first worker should complete State Hub bootstrap,
validate the generated repo identity files, then begin the whynot-design npm
publish token pilot through the `SECRETS-WP-0002` workplan.