Harden production authorization and service auth

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a0217e-8c4c-7383-be6b-f50a6e485306

SCOPE.md

@@ -32,10 +32,16 @@ provider, credential broker, or general secrets API.
 ### Decision-gated planning and OpenBao metadata apply
 
 - Resolves a catalog lane by catalog id or `approval.decision_ref`.
-- Resolves an approval from State Hub by id, with tracked local YAML mirrors as
-  a pilot/offline fallback.
-- Fails privileged live commands closed when a required decision is missing,
-  unapproved, or superseded. Plans and `apply --dry-run` remain non-mutating.
+- Resolves legacy lane decisions from State Hub by id, with tracked local YAML
+  mirrors retained only for non-production and explicit throwaway demos.
+- Fails every production live command closed while State Hub lacks the durable
+  action-authorization endpoint. A local mirror can unlock a prod-labeled lane
+  only when an explicit unsafe-demo switch, disabled Hub URL, and loopback
+  OpenBao target are all present. Plans and `apply --dry-run` remain usable.
+- Builds and validates the flex-auth `ActionAuthorization` profile, including
+  exact lane/stage/action/target/actor/purpose matching, bounded validity,
+  State Hub authority, request digest and decision binding, accepted policy
+  package/version, and an independently required distinct-approver threshold.
 - Renders guarded OpenBao plans for exact consumer ACL policies and AppRoles.
 - Applies policy and AppRole metadata idempotently. Existing mounts render a
   non-mutating check and are never created by apply.
@@ -107,9 +113,10 @@ cannot be recovered through that AppRole.
   status, metadata/value-presence booleans, missing declared field names,
   readiness, and a safe next command. Every declared field must be present.
 - Records scrubbed local JSONL evidence and posts a minimal State Hub progress
-  event on a best-effort basis. Each requested State Hub delivery receives an
-  append-only local `delivered`, `failed`, or `skipped-no-topic` companion
-  record.
+  event on a best-effort basis. Posts carry stable idempotency/source headers.
+  Each requested State Hub delivery receives an append-only local `delivered`,
+  `queued`, `failed`, or `skipped-no-topic` companion record; edge-relay queued
+  receipts retain only the non-secret outbox id.
 - Every live privileged CLI handler records an attempt before lane-approval
   resolution and a terminal success, verification failure, rejection,
   interruption, or typed backend/input failure. Failure evidence contains the
@@ -119,9 +126,25 @@ cannot be recovered through that AppRole.
   delivery outcomes. It never re-emits arbitrary evidence detail.
 - Keeps OpenBao audit logs as the backend source of truth.
 
-State Hub evidence delivery is not queued or transactional; the local receipt
-makes failure visible but does not replay it. Route and audit do not replace
-exact-action authorization or OpenBao audit logs.
+The engine recognizes edge-relay queued receipts but does not own or initiate
+outbox replay. Direct State Hub failure remains locally visible. Route and audit
+do not replace exact-action authorization or OpenBao audit logs.
+
+### Steady-state service-auth scaffold
+
+- Implements an explicit KeyCape `client_credentials` exchange for the
+  accepted `secrets-engine-openbao` service identity.
+- Reads the confidential-client secret only from a mode-0600 file outside Git,
+  sends it through HTTP Basic authentication, and rejects ID/refresh tokens.
+- Preflights the exact issuer, subject, audience, principal type, tenant, role,
+  scope, assurance, RS256 algorithm, and 15-minute lifetime. The in-memory JWT
+  is excluded from object representations and is renewed at the three-minute
+  boundary.
+- Never retries into or falls back to bootstrap, operator, or AppRole auth.
+
+This provider is deliberately not connected to OpenBao. Signature verification
+and token issuance remain with the platform-owned exact-bound OpenBao JWT role,
+whose mount/role contract is still outstanding.
 Treat their output as operational guidance, not complete attestation for
 high-risk lanes.
 
@@ -181,14 +204,18 @@ verification, `approle-login` is auth-capability handoff metadata, and
 ## Not Implemented
 
 - A service API, daemon, UI, queue, scheduler, or remote multi-user service.
-- OpenBao OIDC/service-auth login for steady-state secrets-engine operation.
+- OpenBao JWT login and platform materialization for the implemented KeyCape
+  service-auth provider.
 - Native `exec-file` or response-wrapped delivery.
 - Provider-side rotation or coordinated multi-consumer rollout.
 - First-class rotate, compromise, reactivate, lease-status, or audit report
   commands; lifecycle operations currently execute plans without persistent
   lane state.
-- Dual-control enforcement beyond accepting the catalog label.
-- Direct flex-auth evaluation, claim validation, or identity authentication.
+- Resolution of a durable State Hub action authorization and wiring its
+  validated approval threshold to each production handler.
+- Direct flex-auth evaluation, JWT signature verification, or identity
+  authentication. KeyCape claims receive only a consumer preflight; OpenBao is
+  responsible for cryptographic JWT validation.
 - Runtime tenancy isolation; `org`, `repo`, consumers, and stages are catalog
   metadata plus local path/policy guards, not a tenant control plane.
 - Management or health verification of ESO, Kubernetes Secrets, deployments,