feat: admit existing OpenBao catalog lanes

catalog/reuse-surface-hub-write-token.yaml

@@ -0,0 +1,77 @@
+# NON-SECRET catalog metadata derived from railiance-platform CCR-2026-0005.
+id: reuse-surface-hub-write-token
+kind: kv
+org: coulomb
+repo: reuse-surface
+stage: prod
+description: >-
+  Production federation-hub write bearer and Forgejo webhook HMAC. ESO remains
+  the workload delivery path; native exec is a separate exact-path AppRole.
+
+mount: platform
+path: workloads/reuse/reuse-surface/runtime-secrets
+mount_management: existing
+fields:
+  - REUSE_SURFACE_TOKEN
+  - REUSE_SURFACE_FORGEJO_WEBHOOK_SECRET
+
+consumers:
+  - name: reuse-surface-runtime
+    auth: kubernetes
+    claim: serviceaccount:external-secrets/external-secrets
+    purpose: sync reuse-surface-env through the namespace-limited ESO store
+  - name: forgejo-coulomb-org-webhook
+    auth: shared-hmac
+    claim: forgejo-org:coulomb
+    purpose: share the webhook HMAC with the reuse-surface receiver
+  - name: secrets-engine-operator-exec
+    auth: approle
+    claim: catalog:reuse-surface-hub-write-token
+    purpose: approved hub tooling in a child process and non-secret verification
+
+workload_delivery:
+  - mode: external-secrets
+    owner: railiance-platform + reuse-surface + railiance-apps
+
+delivery_modes: [exec-env, read-check]
+delivery_auth:
+  method: approle
+  management: engine
+  policy_name: se-prod-reuse-surface-hub-write-token
+  role_name: se-prod-reuse-surface-hub-write-token
+  token_ttl: 15m
+  token_max_ttl: 30m
+  secret_id_ttl: 15m
+  secret_id_num_uses: 1
+  token_num_uses: 8
+
+approval:
+  model: ccr
+  decision_ref: CCR-2026-0005
+  notes: >-
+    CCR-2026-0005 approves the existing workload lane. A live native AppRole
+    apply remains gated by SECRETS-WP-0006-T05 review and operator approval.
+
+verification:
+  positive: approved delivery AppRole can read both declared fields without printing them
+  negative: unrelated token is denied on platform/data/workloads/reuse/reuse-surface/runtime-secrets
+
+risk:
+  classification: high
+  notes: hub writes affect the production federation index and the HMAC has two coordinated consumers
+
+rotation:
+  owner: railiance-platform + reuse-surface + railiance-apps
+  expectation: >-
+    Patch OpenBao, force ESO refresh, roll reuse-surface, and reconfigure the
+    Forgejo org webhook whenever its HMAC changes.
+  ttl: rotate-on-compromise
+
+deactivation:
+  owner: railiance-platform + reuse-surface
+  expectation: >-
+    Disable the front door, detach ESO access, and remove the materialized
+    Secret only after confirming decommission or break-glass posture.
+
+audit:
+  evidence: CCR id, actor, exact path, field names, ESO refresh timestamp, request ids, and pass/fail only