Name the secrets-engine-openbao consumer custody coordinates.

Adds the consumer custody packet for KEY-WP-0037-T02 / RPF-WP-0035-T02,
strict value-free client-secret file checks with a check-secret-file CLI,
synthetic tests, and SECRETS-WP-0012 tracking founder decisions and the
attended delivery as needs_human wait tasks.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 132360@bnt-lap001
Assistant-Session: 769b1afd-4330-4c86-96b2-e510e26db42b

src/secrets_engine/cli.py

@@ -957,6 +957,43 @@ def cmd_evidence_classify(cfg: Config, args) -> int:
 # -- parser ----------------------------------------------------------------
 
 
+def cmd_service_auth_check_secret_file(cfg: Config, args) -> int:
+    """Value-free acceptance check of the KeyCape consumer secret file."""
+    import json as _json
+
+    from secrets_engine.service_auth import check_client_secret_file
+
+    raw = args.path or (
+        str(cfg.keycape_client_secret_file) if cfg.keycape_client_secret_file else ""
+    )
+    if not raw:
+        print(
+            "error: no path; pass --path or set SECRETS_ENGINE_KEYCAPE_CLIENT_SECRET_FILE",
+            file=sys.stderr,
+        )
+        return 2
+    checks = check_client_secret_file(Path(raw))
+    ok = bool(checks) and all(c.ok for c in checks)
+    if args.json:
+        print(
+            _json.dumps(
+                {
+                    "path": raw,
+                    "ok": ok,
+                    "checks": [
+                        {"name": c.name, "ok": c.ok, "detail": c.detail} for c in checks
+                    ],
+                },
+                sort_keys=True,
+            )
+        )
+    else:
+        for c in checks:
+            print(f"{'ok  ' if c.ok else 'FAIL'} {c.name}{': ' + c.detail if c.detail else ''}")
+        print("accepted" if ok else "refused")
+    return 0 if ok else 1
+
+
 def build_parser() -> argparse.ArgumentParser:
     p = argparse.ArgumentParser(prog="secrets-engine", description=__doc__.splitlines()[0])
     p.add_argument("--version", action="version", version=f"secrets-engine {__version__}")
@@ -1171,6 +1208,16 @@ def build_parser() -> argparse.ArgumentParser:
     cl.add_argument("--json", action="store_true")
     cl.set_defaults(func=cmd_evidence_classify)
 
+    sa = sub.add_parser("service-auth", help="KeyCape service-auth consumer checks")
+    sasub = sa.add_subparsers(dest="subcmd", required=True)
+    sacheck = sasub.add_parser(
+        "check-secret-file",
+        help="value-free check of the client-secret file (never reads it out)",
+    )
+    sacheck.add_argument("--path", default="")
+    sacheck.add_argument("--json", action="store_true")
+    sacheck.set_defaults(func=cmd_service_auth_check_secret_file)
+
     return p