Align the lifecycle intent with the accepted engine blueprint.

INTENT.md now describes one enabling library over the store, manifested
as a CLI or a single-stage service. SECRETS-WP-0016 is the implementation
workplan. The accepted layer statute is still v0.8.

Assistant: grok
Assistant-Session: 01a1609f-72b8-7222-9dff-fae300115e42

workplans/SECRETS-WP-0016-engine-manifestations.md

@@ -0,0 +1,116 @@
+---
+id: SECRETS-WP-0016
+type: workplan
+title: "Manifest the lifecycle engine as one library, a CLI, and a single-stage service"
+domain: infotech
+repo: secrets-engine
+status: ready
+owner: secrets-engine
+topic_slug: custodian
+created: "2026-10-22"
+updated: "2026-10-22"
+flavor: implementation
+depends_on: []
+related: [SECRETS-WP-0008, SECRETS-WP-0014]
+---
+
+Implements the engine shape in `INTENT.md` after gate-house ADR-015
+(accepted 2026-10-22) and `ArchitectureBlueprint.md` §2.2.
+
+Reviewed against the tree on 2026-10-22. `secrets_engine.plan.build_plan`
+already renders a plan without an OpenBao client. `secrets_engine.cli` is the
+process. `SCOPE.md` records that service delivery is absent, and that a
+service API or daemon is not implemented. `service-jwt` can log in and cannot
+yet carry engine actions. Accepted security-layer-model v0.8 still governs
+PEP behavior. Proposed v0.9 §3.3 carries the same engine wording and does not
+yet govern.
+
+This workplan does not add a release-unit declaration, does not deploy a
+workload, and does not make this engine the only client of OpenBao or a
+decider of who may use it.
+
+## Lock the library boundary
+
+```task
+id: SECRETS-WP-0016-T01
+status: todo
+priority: high
+```
+
+`build_plan` and the catalog validation it depends on stay free of the OpenBao
+client. Add a test that calls the shipped `build_plan` for a fixture lane and
+asserts no OpenBao client is constructed. If a plan path constructs one, move
+that call to the process that applies the plan.
+
+Done when that test passes against `src/secrets_engine/plan.py` and the apply
+path still performs the OpenBao calls.
+
+## Inject one stage credential at process start
+
+```task
+id: SECRETS-WP-0016-T02
+status: todo
+priority: high
+depends_on: [SECRETS-WP-0016-T01]
+```
+
+The CLI process binds to exactly one stage, `build`, `test`, or `production`.
+That stage's OpenBao credential is supplied to the process at start and is not
+printed, returned, or written to Git, State Hub, logs, or the workplan. A
+second stage credential present in the same process is a startup failure.
+
+Done when a test starts the shipped CLI entry against fixture configuration,
+shows one stage bound, shows the credential value absent from stdout and
+stderr, and shows startup failure when two stage credentials are present.
+
+## Manifest the same library as a single-stage service
+
+```task
+id: SECRETS-WP-0016-T03
+status: todo
+priority: medium
+depends_on: [SECRETS-WP-0016-T02]
+```
+
+Add a service manifestation of the same library and the same one-stage
+injection. It is a kept-running process, not a second implementation and not a
+Deployment. It does not accept another stage's credential.
+
+Done when an in-process test starts that manifestation for one stage and a
+lifecycle call goes through the shipped library functions used by the CLI.
+
+## Consume use, do not decide it
+
+```task
+id: SECRETS-WP-0016-T04
+status: todo
+priority: medium
+depends_on: [SECRETS-WP-0016-T03]
+```
+
+Permission to start or call an instance is an access-engine decision. This
+repository documents the claim it will consume and does not invent a local
+allow-list. A caller-supplied flag or config key must not authorize apply or
+the service. Protected side effects keep the existing rule: a decision record
+or the published unreachable-engine stance. v0.8 PEP obligations stay.
+
+Done when a test shows a local allow flag does not authorize a protected call,
+and the claim shape is written in `docs/` without storing a credential.
+
+## Record the manifestations in SCOPE
+
+```task
+id: SECRETS-WP-0016-T05
+status: todo
+priority: low
+depends_on: [SECRETS-WP-0016-T03, SECRETS-WP-0016-T04]
+```
+
+Update `SCOPE.md` so it describes the library, the one-stage CLI, and the
+service manifestation that the code then contains. State that other engines
+may use OpenBao for other capabilities. Remove the claim that service delivery
+is absent only for the manifestation this workplan adds. Leave exec-time
+delivery as the default for a one-task caller.
+
+Done when `SCOPE.md` matches the shipped commands and tests, and does not
+describe a cluster Deployment this workplan did not add.