Prepare WP-0006 first-lane native cutover packet

Re-render admitted-lane plans as kv-mount-check plus exact-path AppRole.
Name openrouter-llm-connect as the first candidate. Document apply,
verify, and rollback without authorizing live mutation. T05 stays wait
on T04 serving and attended authority.

Assistant: grok
Assistant-Session: 01a05f07-ae72-7781-9fcb-19efd61add00

docs/native-lane-cutover.md

@@ -0,0 +1,68 @@
+# Native lane cutover (SECRETS-WP-0006-T05 / T06)
+
+Status: procedure only. Live apply is still fail-closed until
+`SECRETS-WP-0007-T04` serves an exact-action approval and railiance-platform
+grants scoped attended authority. CCR references below are workload-lane
+provenance, not executable authorization for the native AppRole.
+
+This document does not authorize production mutation.
+
+## Scope
+
+Five admitted KV lanes on the existing `platform` mount. Workload delivery
+(ESO/OIDC) stays with current owners. Native apply adds only an exact-path
+read policy and bounded AppRole.
+
+Do not batch-retire ops-warden interim proxies. T06 is per lane, after native
+evidence.
+
+## Cutover order
+
+Chosen for increasing blast radius, not CCR age.
+
+| Order | Lane | Why this position |
+| --- | --- | --- |
+| 1 | `openrouter-llm-connect` | One field, one ESO consumer besides operator exec |
+| 2 | `email-connect-transactional` | Three fields; ingest bearer shared with user-engine |
+| 3 | `issue-core-ingestion-api-key` | Two fields, two ESO consumers |
+| 4 | `reuse-surface-hub-write-token` | Hub write + webhook HMAC, two coordinated consumers |
+| 5 | `forgejo-admin-api-token` | Site-admin PAT; last on purpose |
+
+## What live apply would mutate (once approved)
+
+Re-rendered 2026-09-02 against current `build_plan`. Every lane:
+
+- `[kv-mount-check] platform` — no mount create
+- `[policy]` exact `platform/data/<path>` read + metadata read
+- `[approle]` 15m TTL, 30m max, 15m single-use secret_id, 8 token uses
+
+No KV put/patch, no ESO change, no provider rotation.
+
+## First-lane packet: `openrouter-llm-connect`
+
+Provenance CCR: `CCR-2026-0003` (existing workload lane only).
+
+Required before OpenBao:
+
+1. Canonical ActionAuthorization for `action=apply`, resource
+   `catalog:openrouter-llm-connect`, stage `prod`, exact policy/auth targets
+   `se-prod-openrouter-llm-connect`.
+2. Successful approval-engine CAS consume of that request digest
+   (`GH-DEC-2026-003`).
+3. Scoped attended production authority from railiance-platform (not a
+   standing bootstrap token).
+4. llm-connect owner ready to confirm ESO/application health after apply.
+
+Apply: `secrets-engine apply openrouter-llm-connect --stage prod`  
+then metadata-safe verify of field presence and unrelated-identity denial.
+No value in evidence. Delivery session must self-revoke.
+
+Rollback (native only): delete AppRole and policy
+`se-prod-openrouter-llm-connect`. Leave KV and ESO untouched. Keep the
+ops-warden proxy until T06.
+
+## Explicit non-goals for T05
+
+- Provision or rotate the live OpenRouter key.
+- Retire all five proxies in one batch.
+- Treat CCR status or a local fixture as apply authorization.