Manifest the lifecycle engine as a library, a one-stage CLI, and an in-process service.

Planning stays off the store client. The process binds one stage credential at start, serve runs the same lifecycle library, and a local allow flag does not authorize a protected call.

Assistant: grok
Assistant-Session: 01a1609f-72b8-7222-9dff-fae300115e42

docs/engine-use-claim.md

@@ -0,0 +1,22 @@
+# Use claim consumed by secrets-engine
+
+Permission to start or call one secrets-engine stage instance is an
+access-engine decision. This engine consumes that claim. It does not decide it
+and it does not store a credential for it.
+
+## Claim
+
+- Decider: access-engine.
+- Subject: an operator allowed to use one stage instance.
+- Object: one secrets-engine process bound to exactly one stage.
+- Stage: `build`, `test`, or `production`.
+- Action: use.
+- Effect: the operator may call that instance for the bound stage.
+
+The stage credential is injected into the process at start and stays there.
+Use of the instance does not confer that credential. Delegation of a task
+transfers neither the use decision nor the injected credential.
+
+`--allow` and `SECRETS_ENGINE_LOCAL_ALLOW` are not this claim. They do not
+authorize apply or the service. A protected side effect still requires a
+decision record or the published unreachable-engine stance.