Harden secret provisioning and lifecycle controls

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a0217e-8c4c-7383-be6b-f50a6e485306

workplans/SECRETS-WP-0007-production-lifecycle-hardening.md

@@ -4,7 +4,7 @@ type: workplan
 title: "Production-safe provisioning, authorization, and lifecycle hardening"
 domain: infotech
 repo: secrets-engine
-status: ready
+status: active
 owner: codex
 topic_slug: custodian
 created: "2026-08-23"
@@ -79,10 +79,20 @@ must not expose the current bootstrap and lifecycle shortcuts as an API.
 
 ```task
 id: SECRETS-WP-0007-T01
-status: todo
+status: done
 priority: high
 ```
 
+Completed 2026-08-23. During containment, existing multi-field provisioning
+failed before file read or backend access. Ordinary `revoke` builds one
+lifecycle plan used by both
+dry-run and live execution, deletes only engine-managed native AppRole/policy
+objects, and explicitly preserves KV custody, external delivery auth, and
+workload delivery. No destructive KV command remains on the ordinary CLI.
+Focused lifecycle, admission, auth-capability, and throwaway OpenBao integration
+tests pass. The temporary multi-field rejection was then superseded by the
+merge-safe primitive completed in T02.
+
 Add immediate fail-closed guards before implementing replacement primitives:
 
 - reject `provision` on an existing multi-field lane;
@@ -107,10 +117,18 @@ Acceptance:
 
 ```task
 id: SECRETS-WP-0007-T02
-status: todo
+status: done
 priority: high
 ```
 
+Completed 2026-08-23. Replaced raw `field=value` argv writes with a CAS-aware
+backend primitive: new paths use CAS-zero create; existing paths use server-side
+HTTP patch with the observed metadata version. Values travel through a
+mode-0600 temporary JSON reference removed in `finally`, and never appear in
+argv. Unit tests inspect the full request/cleanup; throwaway OpenBao integration
+proves sibling preservation and stale-CAS rejection. Stage policies now include
+the narrow KV `patch` capability needed by this operation.
+
 Replace the raw `field=value` subprocess call with a backend write primitive
 that never places the value in argv and safely updates one or more declared
 fields without removing unmentioned siblings. The design may use OpenBao CAS,
@@ -135,10 +153,19 @@ Acceptance:
 
 ```task
 id: SECRETS-WP-0007-T03
-status: todo
+status: progress
 priority: high
 ```
 
+Progress 2026-08-23. Added one lifecycle plan model shared by dry-run and live
+execution. Ordinary `revoke` safely aliases native deactivation; suspend and
+deactivate preserve KV custody and externally managed workload delivery.
+Destroy has an unmistakable dry-run plan and exact-id confirmation, but its live
+handler is deliberately fail-closed before coarse lane approval or backend
+access until T04 supplies distinct action authorization. Scoped issued-session
+self-revocation is implemented in T05; a general known-accessor operator command
+remains outstanding.
+
 Replace the overloaded `revoke` behavior with explicit lifecycle operations and
 plans. Define at least:
 
@@ -171,10 +198,16 @@ Acceptance:
 
 ```task
 id: SECRETS-WP-0007-T04
-status: todo
+status: wait
 priority: high
 ```
 
+Waiting 2026-08-23 on the canonical external contract rather than parsing
+decision prose or inventing authorization ownership locally. Contract requests
+were sent to State Hub (`24663321-0263-43fe-8d48-e9c7e06d7bb9`) and flex-auth
+(`ef8ff95d-6b4e-46f8-b1a9-497d06cf7c9a`). Until resolved, local fixtures cannot
+unlock the new destroy path and that live operation remains disabled.
+
 Define and enforce the decision contract needed by production commands. A
 resolved approval must bind at least:
 
@@ -209,10 +242,20 @@ Acceptance:
 
 ```task
 id: SECRETS-WP-0007-T05
-status: todo
+status: progress
 priority: high
 ```
 
+Progress 2026-08-23. AppRole login material now travels through strict temporary
+JSON input rather than argv. Exec and both verification kinds use a scoped
+session that self-revokes in `finally`, drops the in-memory token even when
+cleanup fails, and exposes only an accessor fingerprint plus cleanup booleans as
+evidence. Tests cover success and exception cleanup, idempotence, failed revoke
+visibility, and value/credential exclusion. Provider review requests were sent
+to railiance-platform (`8f910aff-3a94-43c6-8805-eb9276e46fc0`) and key-cape
+(`0627ca55-115e-43dc-b2f6-3195be3bc90d`); steady-state engine authentication
+remains external-contract work.
+
 Refactor AppRole login into a scoped session object that retains only the
 minimum non-secret lifecycle handle needed to revoke the issued token in a
 `finally` path. Apply it consistently to exec, KV verification, auth-capability
@@ -240,10 +283,20 @@ Acceptance:
 
 ```task
 id: SECRETS-WP-0007-T06
-status: todo
+status: progress
 priority: high
 ```
 
+Progress 2026-08-23. KV verification now checks every declared field by default,
+with one path-level negative probe, and route readiness reads once and requires
+all declared fields. Missing readiness evidence contains field names only. Tests
+prove a missing sibling makes readiness false. The real unrelated-identity
+negative contract, audit request correlation, durable evidence delivery, and
+lane audit summary remain outstanding.
+
+The complete repository suite passes with 103 tests after these changes,
+including throwaway OpenBao integration coverage.
+
 Make verification and routing truthful for multi-field and high-risk lanes:
 
 - verify every declared field unless the exact approved subset is explicit;