Manifest the lifecycle engine as a library, a one-stage CLI, and an in-process service.

Planning stays off the store client. The process binds one stage credential at start, serve runs the same lifecycle library, and a local allow flag does not authorize a protected call.

Assistant: grok
Assistant-Session: 01a1609f-72b8-7222-9dff-fae300115e42

SCOPE.md

@@ -10,13 +10,17 @@
 
 ## One-liner
 
-secrets-engine is the Lifecycle engine for cataloged credential work: a
-decision-gated Python CLI that validates non-secret lane metadata and
-orchestrates narrowly scoped OpenBao policy, AppRole, provisioning,
-verification, delivery, routing, handoff, and revocation actions.
+secrets-engine is the Lifecycle engine for cataloged credential work. Its
+library validates non-secret lane metadata and orchestrates narrowly scoped
+OpenBao policy, AppRole, provisioning, verification, delivery, routing,
+handoff, and revocation actions. The CLI is that library in one process. The
+process binds one stage, `build`, `test`, or `production`, and receives that
+stage's credential at start. `serve` keeps the same library running for that
+stage. Other engines may use OpenBao for other capabilities.
 
-It is a deterministic API over OpenBao, not a vault, not a policy decision
-point, not an identity provider, and not a general secrets API.
+It is a deterministic processor over OpenBao, not a vault, not a policy
+decision point, not an identity provider, and not a general secrets API.
+Exec-time delivery remains the default for a one-task caller.
 
 ## Implemented Capabilities
 
@@ -225,9 +229,25 @@ through the merge-safe write path. Persistent overlay states
 directory; they do not recreate OpenBao objects and do not rotate provider
 credentials.
 
+## One-stage process
+
+- Planning stays in the library and does not open the store. Apply still uses
+  the OpenBao client.
+- `instance` prints the one bound stage. The injected credential is not
+  printed, returned, or written to Git, State Hub, logs, or the workplan.
+- A second stage credential in the same process refuses startup.
+- `serve` keeps the lifecycle library the CLI uses running for that one stage.
+  It is the in-process manifestation of this library.
+- `--allow` and `SECRETS_ENGINE_LOCAL_ALLOW` do not authorize apply or the
+  service. Permission to use an instance is the access-engine claim in
+  `docs/engine-use-claim.md`. Protected side effects still require a decision
+  record or the published unreachable-engine stance.
+
 ## CLI Surface
 
 ```text
+secrets-engine instance
+secrets-engine serve <catalog-id> --operation suspend|deactivate|destroy
 secrets-engine catalog list|show
 secrets-engine decision inspect
 secrets-engine plan
@@ -262,7 +282,8 @@ metadata. `secrets-engine wrap` implements response-wrapped operator handoff.
 
 ## Not Implemented
 
-- A service API, daemon, UI, queue, scheduler, or remote multi-user service.
+- A remote multi-user API, UI, queue, or scheduler. `serve` is the kept-running
+  in-process manifestation of this library for one stage.
 - Engine-action authority for the `service-jwt` identity. The platform JWT
   role is login-only, and its CCR negative checks (RPF-WP-0035-T02) are open.
 - Provider-side / workload consumer rotation. Overlay lane state is local and
@@ -387,7 +408,9 @@ title: AppRole-scoped exec delivery
 description: Fetches one declared KV field through a lane AppRole and injects it into a child
   process using exec-env or a temporary npm config, with output redaction, explicit scoped-token
   self-revocation, and non-secret cleanup evidence. Adapters: exec-env, npm-config, exec-file;
-  `wrap` provides response-wrapped operator handoff. This is CLI-local delivery; service delivery is absent.
+  `wrap` provides response-wrapped operator handoff. Exec-time delivery remains
+  the default for a one-task caller. `serve` keeps the lifecycle library running
+  for one injected stage and does not deliver values.
 keywords: [secrets, delivery, exec, npm, injection, redaction, openbao]
 ```