Answer the exec-path question: the front door reads the ungoverned duplicate.

ops-warden and railiance-platform asked, independently, which OpenBao location
`secrets-engine exec --catalog whynot-design-npm-publish` reads. Answered from
this repository's own code and catalog with no OpenBao read and no value.

It reads `secret/coulomb/whynot-design/npm/publish` — the legacy, ungoverned
duplicate. `_fetch_value` concatenates the catalog's `mount` and `path` with no
override or fallback, so the proven pilot published from the duplicate and the
lowercase `npm_token` field is the field there. ops-warden's front door names
this repository as exec_owner, so it currently routes callers at a path no CCR
covers.

Recorded in SECRETS-WP-0006 with what a move to the governed lane requires, and
flagged that the duplicate must not be destroyed until the lane moves. Whether
the two locations hold the same value is a value comparison and is not answered
here.

Also records GH-DEC-2026-017 against SECRETS-WP-0008: INTENT.md governs, the
sidecar is derived, the vocabulary is case-insensitive so nothing is re-spelled,
and standard_version comes out of layer.yaml once ops-warden updates the
reference form this repository copied.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 63291@bnt-lap001
Assistant-Session: 8bd77868-ca68-4f49-bb1e-d539ecc0d703

workplans/SECRETS-WP-0006-catalog-lane-adoption.md

@@ -328,3 +328,89 @@ routing/proxy retirement; SECRETS-WP-0007-T04/T07 retain general native readines
 Do not reuse the consumed approvals or treat the temporary key-check overlay as
 approval for a radar trial recipient. IR-WP-0005 owns radar delivery acceptance;
 IR-WP-0006 owns the outstanding USD 0.023712 billing reservation.
+
+
+### 2026-09-21 answered: the exec front door reads the ungoverned legacy path
+
+ops-warden (`abf27efc`) and railiance-platform (RPF-WP-0035-T07, `09b719fe`)
+asked the same location-only question. Answered from this repository's own code
+and catalog, with no OpenBao read and no value of any kind.
+
+**`secrets-engine exec --catalog whynot-design-npm-publish` reads
+`secret/coulomb/whynot-design/npm/publish`.** That is the legacy, ungoverned
+duplicate, not the governed lane.
+
+Derivation, which is short because there is no indirection to hide in:
+
+- `catalog/whynot-design-npm-publish.yaml` declares `mount: secret` and
+  `path: coulomb/whynot-design/npm/publish`.
+- `exec_with_secret` delegates the read to `_fetch_value` in
+  `src/secrets_engine/exec_delivery.py`, which issues
+  `kv get -format=json {entry.mount}/{entry.path}` inside the lane's AppRole
+  session. The path is the catalog pointer, concatenated, with no override,
+  fallback, alias, or environment substitution anywhere on the exec path.
+- `publication_policy.resolve` and `delivery_config.npm` decide the injected
+  env-var name and the npm registry. Neither touches the KV location. Nothing
+  in `routing.py`, `safe_paths.py`, or the policy layer rewrites mount or path.
+
+So railiance-platform's straightforward reading was the right one. The proven
+2026-07-03 `@whynot/design` pilot published by reading the legacy duplicate, and
+the lowercase `npm_token` field this repository has consistently reported is the
+field **there** — which is why it never appeared at the governed path and why
+nobody's record was wrong. ops-warden's `NPM_AUTH_TOKEN` and this repository's
+`npm_token` were each correct about the location each side was describing.
+
+The consequence is the one ops-warden named and it should be stated plainly
+rather than softened: ops-warden's routing catalog lists secrets-engine as
+`exec_owner` and routes callers here as the primary front door, so that front
+door currently points at a path no CCR covers, and CCR-2026-0001's acceptance
+evidence describes a path its consumer does not use. That is a real governance
+gap, not a bookkeeping mismatch.
+
+**Not answerable here, and not attempted:** whether the two locations hold the
+same value. That is a value comparison. This repository will not read, fetch,
+fingerprint, or compare either value, and has not. It is custody's question and
+needs no answer from us to proceed with the path move.
+
+#### What it would take to move to the governed path
+
+The move is a reviewed production lane change, not an edit. In order:
+
+1. **Custody confirms the governed lane is consumable by this lane's identity.**
+   `platform/workloads/coulomb/whynot-design/npm-publish` under CCR-2026-0001
+   grants read to the workload policy; the AppRole this engine's delivery
+   session assumes must be admitted on `platform/data/...` and
+   `platform/metadata/...` of exactly that path. Without that, the edit produces
+   a lane that denies on read.
+2. **Reconcile the field name in the same change.** The catalog declares
+   `npm_token`; the governed path was enumerated by railiance-platform on
+   2026-09-10 as holding exactly one field, `NPM_AUTH_TOKEN`. Moving the path
+   without moving `fields:` produces `field 'npm_token' absent in lane` from
+   `_fetch_value`. The injected env var is separately resolved and stays
+   `NPM_AUTH_TOKEN` while netkingdom is `maturity-build`; after the move the KV
+   field name and the injected env-var name coincide, which is a coincidence and
+   must be annotated as one so the category error corrected on 2026-09-09 is not
+   reintroduced.
+3. **Carry an approval.** The lane's `approval.model` is `decision`; this is a
+   production lane pointer change and takes its own approved decision, not the
+   existing `e6381a56` pilot decision.
+4. **Re-verify positive and negative.** The lane's declared expectations — the
+   approved consumer reads the field, an unrelated identity is denied — must be
+   re-run against the governed path before the old pointer is abandoned.
+5. **Update the derived records:** `docs/whynot-design-real-publish-closeout.md`
+   pointer table, `docs/hardening-backlog.md` (which already names both
+   locations), and `docs/cli.md`.
+6. **Only then is destruction of the duplicate safe.** RPF-WP-0035-T07 holds
+   destruction pending this confirmation, correctly. The confirmation it was
+   waiting for is now given, and it is the unwelcome one: the duplicate is the
+   live consumer path, so it must not be destroyed or wrapped until this lane
+   has moved and re-verified. Destroying it today breaks production publish.
+
+Note also `scripts/demo-e2e.sh:66`, which grants a policy on
+`secret/data/prod/coulomb/whynot-design/npm` — a third, demo-only spelling under
+a `prod/` prefix. It is a throwaway demo fixture and not a consumer lane, but it
+should be renamed away from `prod` when the lane moves so it cannot be mistaken
+for a fourth location.
+
+`SECRETS-WP-0006-T06` stays `wait`: this answer unblocks the question, not the
+lane change, which needs custody's step 1 and its own approval.