Harden secret provisioning and lifecycle controls

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a0217e-8c4c-7383-be6b-f50a6e485306

docs/cli.md

@@ -54,6 +54,9 @@ secrets-engine exec --catalog <catalog-id> [--field NAME] [--mode auto|npm-confi
 secrets-engine policy publication <catalog-id>
 secrets-engine route <catalog-id> [--json]
 secrets-engine revoke <catalog-id> [--dry-run]
+secrets-engine lifecycle suspend <catalog-id> [--dry-run]
+secrets-engine lifecycle deactivate <catalog-id> [--dry-run]
+secrets-engine lifecycle destroy <catalog-id> [--dry-run] [--confirm-destroy <catalog-id>]
 ```
 
 `policy publication` resolves a lane's effective publication scope and the env
@@ -70,6 +73,35 @@ fresh AppRole `secret_id` and writes `role_id` plus `secret_id` to caller-chosen
 mode-0600 files outside Git worktrees. It never prints the `secret_id`; use the
 resulting files only for attended out-of-band delivery.
 
+`revoke` currently means **deactivate native secrets-engine access**. For
+engine-managed delivery auth it deletes the lane AppRole and policy; it always
+preserves KV metadata/values, existing externally managed auth, and workload
+delivery. There is no general KV-destruction command. `provision` uses
+CAS-aware create/patch behavior with a strict temporary input reference: values
+are absent from argv, sibling fields are preserved, and stale writes fail.
+
+With no `--field`, `verify` checks every declared KV field positively and runs
+one path-level negative probe. `route` likewise requires every declared field
+and reports only missing field names. An explicit `--field` narrows positive
+verification; production use will bind such subsets to the action approval.
+
+Explicit lifecycle commands separate intent:
+
+- `suspend` removes the engine-managed AppRole but preserves policy and KV;
+- `deactivate` removes the engine-managed AppRole and policy but preserves KV;
+- `destroy --dry-run` renders deactivation plus irreversible KV metadata
+  deletion. Live execution is fail-closed even with exact catalog-id
+  confirmation until `SECRETS-WP-0007-T04` supplies the canonical exact-action
+  approval contract.
+
+All three preserve externally managed auth and workload delivery. The legacy
+`revoke` command is a compatibility alias for safe native deactivation, never
+KV destruction.
+
+Exec and verification AppRole logins are scoped sessions. The issued token
+self-revokes on every exit path before exec starts (or when verification ends),
+and evidence stores only a short accessor fingerprint plus cleanup outcome.
+
 ## Exit codes
 
 | Code | Meaning |

docs/hardening-backlog.md

@@ -49,8 +49,11 @@ contents in this repo.
 
 ## H4 — Rotation & lifecycle states
 
-- Implement `rotate`, and explicit `compromised` / `deactivated` lane states with
-  evidence, beyond the current `revoke` (metadata delete).
+- Implement `rotate` and persistent `compromised` / `deactivated` lane states
+  with evidence. Explicit suspend/deactivate/destroy plans now exist, and
+  ordinary `revoke` safely aliases native AppRole/policy deactivation, but lane
+  state and coordinated provider/workload rotation remain outstanding. Live
+  destroy remains disabled until exact-action authorization is available.
 
 ## H5 — Audit report command