feat: admit existing OpenBao catalog lanes

tests/test_catalog.py

@@ -74,6 +74,86 @@ def test_unknown_delivery_mode_rejected():
         validate_entry(data)
 
 
+def test_existing_mount_and_workload_delivery_parse():
+    data = copy.deepcopy(VALID)
+    data["mount"] = "platform"
+    data["mount_management"] = "existing"
+    data["workload_delivery"] = [
+        {"mode": "external-secrets", "owner": "rapp-example"}
+    ]
+    entry = validate_entry(data)
+    assert entry.manages_mount is False
+    assert entry.manages_delivery_auth is True
+    assert entry.workload_delivery[0]["mode"] == "external-secrets"
+
+
+def test_existing_delivery_auth_requires_explicit_role():
+    data = copy.deepcopy(VALID)
+    data["delivery_auth"] = {"method": "approle", "management": "existing"}
+    with pytest.raises(CatalogError):
+        validate_entry(data)
+    data["delivery_auth"]["role_name"] = "existing-exact-role"
+    entry = validate_entry(data)
+    assert entry.manages_delivery_auth is False
+    assert entry.role_name == "existing-exact-role"
+
+
+def test_native_delivery_rejects_missing_auth():
+    data = copy.deepcopy(VALID)
+    data["delivery_auth"] = {"method": "none", "management": "none"}
+    with pytest.raises(CatalogError):
+        validate_entry(data)
+
+
+def test_workload_delivery_requires_mode_and_owner():
+    data = copy.deepcopy(VALID)
+    data["workload_delivery"] = [{"mode": "external-secrets"}]
+    with pytest.raises(CatalogError):
+        validate_entry(data)
+
+
+def test_high_risk_lane_requires_owners_and_non_bootstrap_approval():
+    data = copy.deepcopy(VALID)
+    data["risk"] = {"classification": "high"}
+    data["approval"] = {"model": "decision", "decision_ref": "d1"}
+    with pytest.raises(CatalogError):
+        validate_entry(data)
+    data["rotation"]["owner"] = "platform-owner"
+    data["deactivation"]["owner"] = "platform-owner"
+    assert validate_entry(data).risk["classification"] == "high"
+    data["approval"] = {"model": "bootstrap-only"}
+    with pytest.raises(CatalogError):
+        validate_entry(data)
+
+
+def test_admitted_existing_lanes_have_exact_safe_metadata():
+    entries = load_catalog(repo_root() / "catalog")
+    expected = {
+        "issue-core-ingestion-api-key": "workloads/issue-core/issue-core/issue-core-runtime",
+        "reuse-surface-hub-write-token": "workloads/reuse/reuse-surface/runtime-secrets",
+        "openrouter-llm-connect": "workloads/activity-core/llm-connect/llm-connect-provider-secrets",
+        "forgejo-admin-api-token": "workloads/forgejo/forgejo-admin",
+        "email-connect-transactional": "workloads/email-connect/transactional",
+    }
+    for lane_id, path in expected.items():
+        entry = entries[lane_id]
+        assert entry.mount == "platform"
+        assert entry.path == path
+        assert entry.manages_mount is False
+        assert entry.manages_delivery_auth is True
+        assert entry.risk["classification"] == "high"
+        assert entry.rotation["owner"]
+        assert entry.deactivation["owner"]
+        assert entry.workload_delivery
+        assert entry.approval["decision_ref"].startswith("CCR-2026-")
+
+
+def test_generic_and_identity_routes_are_not_catalog_lanes():
+    entries = load_catalog(repo_root() / "catalog")
+    assert "openbao-api-key" not in entries
+    assert "key-cape-oidc-login" not in entries
+
+
 def test_wildcard_path_rejected():
     data = copy.deepcopy(VALID)
     data["path"] = "test/*"

tests/test_decisions.py

@@ -1,6 +1,8 @@
 import pytest
+from types import SimpleNamespace
 
 from secrets_engine.catalog import validate_entry
+from secrets_engine.cli import _require_lane_approval
 from secrets_engine.decisions import Decision, require_approved, resolve_decision
 from secrets_engine.errors import DecisionError
 
@@ -50,3 +52,23 @@ def test_local_fixture_resolves(tmp_path):
 def test_missing_decision_raises(tmp_path):
     with pytest.raises(DecisionError):
         resolve_decision(hub_url="http://127.0.0.1:1", repo_root=tmp_path, decision_ref="nope")
+
+
+def test_privileged_lane_helper_fails_closed_without_decision(tmp_path, monkeypatch):
+    import secrets_engine.cli as cli
+
+    monkeypatch.setattr(cli, "repo_root", lambda: tmp_path)
+    with pytest.raises(DecisionError):
+        _require_lane_approval(SimpleNamespace(hub_url=""), _approved())
+
+
+def test_privileged_lane_helper_accepts_local_approval(tmp_path, monkeypatch):
+    import secrets_engine.cli as cli
+
+    (tmp_path / ".decisions").mkdir()
+    (tmp_path / ".decisions" / "x.yaml").write_text(
+        "id: x\ntitle: approved\nstatus: resolved\nsuperseded_by: null\n"
+    )
+    monkeypatch.setattr(cli, "repo_root", lambda: tmp_path)
+    decision = _require_lane_approval(SimpleNamespace(hub_url=""), _approved())
+    assert decision.id == "x"

tests/test_exec_delivery.py

@@ -1,4 +1,15 @@
-from secrets_engine.exec_delivery import _npm_userconfig, _registry_authkey
+import copy
+
+import pytest
+
+from secrets_engine.catalog import validate_entry
+from secrets_engine.errors import DeliveryError
+from secrets_engine.exec_delivery import (
+    _npm_userconfig,
+    _registry_authkey,
+    exec_with_secret,
+)
+from tests.test_catalog import VALID
 
 
 def test_registry_authkey_strips_scheme_and_trails_slash():
@@ -22,3 +33,40 @@ def test_npm_userconfig_writes_registry_and_token_ref_not_value():
         assert (path.stat().st_mode & 0o077) == 0
     # cleaned up on context exit
     assert not path.exists()
+
+
+def test_exec_env_injects_only_selected_declared_field(monkeypatch):
+    data = copy.deepcopy(VALID)
+    data["fields"] = ["primary", "selected_value"]
+    entry = validate_entry(data)
+
+    def fake_fetch(_client, got_entry, field):
+        assert got_entry == entry
+        assert field == "selected_value"
+        return "test-secret-value"
+
+    def fake_spawn(command, env, secret):
+        assert command == ["probe"]
+        assert secret == "test-secret-value"
+        assert env["SELECTED_VALUE"] == "test-secret-value"
+        assert "PRIMARY" not in env
+        return 0
+
+    monkeypatch.setattr("secrets_engine.exec_delivery._fetch_value", fake_fetch)
+    monkeypatch.setattr("secrets_engine.exec_delivery._spawn", fake_spawn)
+    assert (
+        exec_with_secret(
+            object(), entry, "selected_value", ["probe"], mode="exec-env"
+        )
+        == 0
+    )
+
+
+def test_exec_rejects_undeclared_field_before_fetch(monkeypatch):
+    entry = validate_entry(VALID)
+    monkeypatch.setattr(
+        "secrets_engine.exec_delivery._fetch_value",
+        lambda *_args, **_kwargs: pytest.fail("must not fetch undeclared field"),
+    )
+    with pytest.raises(DeliveryError):
+        exec_with_secret(object(), entry, "other_field", ["probe"], mode="exec-env")

tests/test_existing_lane_admission.py

@@ -0,0 +1,117 @@
+import copy
+import os
+
+from secrets_engine.apply import apply_plan
+from secrets_engine.catalog import load_catalog, validate_entry
+from secrets_engine.config import repo_root
+from secrets_engine.plan import build_plan
+from secrets_engine.provision import provision_from_file
+from secrets_engine.routing import route_lane
+from tests.test_catalog import VALID
+
+
+class RecordingApplyClient:
+    def __init__(self):
+        self.policy_writes = []
+        self.approle_writes = []
+
+    def kv_mount_exists(self, _mount):
+        raise AssertionError("existing mount must not be inspected for mutation")
+
+    def ensure_kv_mount(self, _mount):
+        raise AssertionError("existing mount must not be created")
+
+    def read_policy(self, _name):
+        return None
+
+    def write_policy(self, name, hcl):
+        self.policy_writes.append((name, hcl))
+
+    def ensure_approle_enabled(self):
+        pass
+
+    def write_approle(self, role_name, policies, ttl="30m", **_kwargs):
+        self.approle_writes.append((role_name, policies, ttl))
+
+
+class RecordingProvisionClient:
+    def __init__(self):
+        self.puts = []
+
+    def ensure_kv_mount(self, _mount):
+        raise AssertionError("existing mount must not be created during provision")
+
+    def kv_put(self, mount, path, field, value):
+        self.puts.append((mount, path, field, value))
+
+
+def _existing_mount_entry():
+    data = copy.deepcopy(VALID)
+    data.update(
+        {
+            "stage": "prod",
+            "mount": "platform",
+            "path": "workloads/example/runtime",
+            "mount_management": "existing",
+            "workload_delivery": [
+                {"mode": "external-secrets", "owner": "rapp-example"}
+            ],
+        }
+    )
+    return validate_entry(data)
+
+
+def test_apply_existing_mount_only_adds_approved_delivery_auth():
+    entry = _existing_mount_entry()
+    plan = build_plan(entry, "prod", decision_id="approved")
+    client = RecordingApplyClient()
+    result = apply_plan(client, entry, plan)
+    assert any("externally managed; no mutation" in item for item in result.skipped)
+    assert len(client.policy_writes) == 1
+    assert len(client.approle_writes) == 1
+
+
+def test_apply_existing_delivery_auth_is_fully_non_mutating():
+    data = copy.deepcopy(VALID)
+    data["mount_management"] = "existing"
+    data["delivery_auth"] = {
+        "method": "approle",
+        "management": "existing",
+        "role_name": "existing-exact-role",
+        "policy_name": "existing-exact-policy",
+    }
+    entry = validate_entry(data)
+    plan = build_plan(entry, "test", decision_id="approved")
+    client = RecordingApplyClient()
+    result = apply_plan(client, entry, plan)
+    assert client.policy_writes == []
+    assert client.approle_writes == []
+    assert len(result.skipped) == 3
+    assert all("no mutation" in item for item in result.skipped[:2])
+
+
+def test_provision_existing_mount_never_attempts_mount_creation(tmp_path):
+    entry = _existing_mount_entry()
+    value_file = tmp_path / "value"
+    value_file.write_text("test-only-value", encoding="utf-8")
+    os.chmod(value_file, 0o600)
+    client = RecordingProvisionClient()
+    provision_from_file(client, entry, "api_token", value_file)
+    assert client.puts == [
+        ("platform", "workloads/example/runtime", "api_token", "test-only-value")
+    ]
+
+
+def test_admitted_lanes_fail_closed_without_resolved_ccr(tmp_path):
+    entries = load_catalog(repo_root() / "catalog")
+    for lane_id in (
+        "issue-core-ingestion-api-key",
+        "reuse-surface-hub-write-token",
+        "openrouter-llm-connect",
+        "forgejo-admin-api-token",
+        "email-connect-transactional",
+    ):
+        result = route_lane(entries[lane_id], hub_url="", repo_root=tmp_path, client=None)
+        assert result.ready is False
+        assert result.missing.startswith("approved decision for 'CCR-2026-")
+        assert result.next_command.startswith("secrets-engine decision inspect CCR-2026-")

tests/test_guards.py

@@ -65,3 +65,52 @@ def test_valid_plan_builds():
     assert plan.policy_name == "se-test-test-lane"
     assert any(a.kind == "approle" for a in plan.actions)
     assert "secret/data/test/team/thing" in plan.policy_hcl
+
+
+def test_existing_mount_plan_has_check_not_mount_mutation():
+    e = _entry(
+        stage="prod",
+        mount="platform",
+        path="workloads/example/runtime",
+        mount_management="existing",
+    )
+    plan = build_plan(e, "prod", decision_id="d1")
+    assert any(a.kind == "kv-mount-check" for a in plan.actions)
+    assert not any(a.kind == "kv-mount" for a in plan.actions)
+    assert "platform/data/workloads/example/runtime" in plan.policy_hcl
+
+
+def test_existing_auth_plan_has_checks_not_auth_mutations():
+    e = _entry(
+        delivery_auth={
+            "method": "approle",
+            "management": "existing",
+            "role_name": "existing-exact-role",
+            "policy_name": "existing-exact-policy",
+        }
+    )
+    plan = build_plan(e, "test", decision_id="d1")
+    assert any(a.kind == "policy-check" for a in plan.actions)
+    assert any(a.kind == "approle-check" for a in plan.actions)
+    assert not any(a.kind == "policy" for a in plan.actions)
+    assert not any(a.kind == "approle" for a in plan.actions)
+
+
+def test_every_admitted_lane_renders_existing_mount_check_and_exact_policy():
+    from secrets_engine.catalog import load_catalog
+    from secrets_engine.config import repo_root
+
+    entries = load_catalog(repo_root() / "catalog")
+    for lane_id in (
+        "issue-core-ingestion-api-key",
+        "reuse-surface-hub-write-token",
+        "openrouter-llm-connect",
+        "forgejo-admin-api-token",
+        "email-connect-transactional",
+    ):
+        entry = entries[lane_id]
+        plan = build_plan(entry, "prod", decision_id=entry.approval["decision_ref"])
+        assert [a.kind for a in plan.actions] == ["kv-mount-check", "policy", "approle"]
+        assert f'path "{entry.kv_data_path}"' in plan.policy_hcl
+        assert "*" not in entry.kv_data_path
+        assert plan.role_name.startswith("se-prod-")

tests/test_integration_bao.py

@@ -44,7 +44,7 @@ def bao_dev():
     addr = f"http://127.0.0.1:{port}"
     token = "se-test-root"
     proc = subprocess.Popen(
-        [bao, "server", "-dev", f"-dev-root-token-id={token}",
+        [bao, "server", "-dev", "-dev-no-store-token", f"-dev-root-token-id={token}",
          f"-dev-listen-address=127.0.0.1:{port}"],
         stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL,
     )

tests/test_safe_paths.py

@@ -0,0 +1,21 @@
+from secrets_engine.safe_paths import containing_git_worktree
+
+
+def test_empty_git_named_directory_is_not_a_worktree(tmp_path):
+    (tmp_path / ".git").mkdir()
+    assert containing_git_worktree(tmp_path / "secret-file") is None
+
+
+def test_git_directory_with_head_is_a_worktree(tmp_path):
+    repo = tmp_path / "repo"
+    marker = repo / ".git"
+    marker.mkdir(parents=True)
+    (marker / "HEAD").write_text("ref: refs/heads/main\n", encoding="utf-8")
+    assert containing_git_worktree(repo / "secret-file") == repo
+
+
+def test_git_file_marks_linked_worktree(tmp_path):
+    repo = tmp_path / "linked"
+    repo.mkdir()
+    (repo / ".git").write_text("gitdir: /outside/worktrees/linked\n", encoding="utf-8")
+    assert containing_git_worktree(repo / "secret-file") == repo