From a3eb6634aa040f4eac365cb12fbd87928125ddd8 Mon Sep 17 00:00:00 2001
From: tegwick <bernd.worsch@gmail.com>
Date: Sun, 6 Sep 2026 01:27:17 +0200
Subject: [PATCH] docs: publish the authoritative gated-action list for
 flex-auth

flex-auth (FLEX-DEC-2026-005 / FLEX-WP-0021-T01) reserved the coordinate
secrets-engine.catalog-lane.lifecycle v1 and stated an action they infer is
a blocker, not a default. This is the enforced set read out of cli.py.

Includes the traps an inferred list would hit: `revoke` gates as the
`deactivate` action and is not itself an action value; `destroy` is defined
but unreachable live; `compromise`/`reactivate` gate overlay state only.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01M65ovP3eiiPHubibvWs9mD

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 393550@bnt-lap001
Assistant-Session: 4bb359f9-1f12-4410-9e76-079cf23c82e4
---
 docs/gated-actions.md | 48 +++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 48 insertions(+)
 create mode 100644 docs/gated-actions.md

diff --git a/docs/gated-actions.md b/docs/gated-actions.md
new file mode 100644
index 0000000..07471f0
--- /dev/null
+++ b/docs/gated-actions.md
@@ -0,0 +1,48 @@
+# Gated actions over `secret-catalog-lane`
+
+Authoritative list of the `action` values secrets-engine passes to the shared
+authorization gate (`_require_lane_approval` → `resolve_consume_binding` →
+`require_production_consume`). Supplied to flex-auth for
+`secrets-engine.catalog-lane.lifecycle` (FLEX-WP-0021-T01 / FLEX-DEC-2026-005).
+
+This is the enforced set read out of `cli.py`, not the
+`secrets-engine.lifecycle`/`v1` example vocabulary. `resource.type` is
+`secret-catalog-lane` and `resource.system` is `secrets-engine`; the catalog id
+is `request.resource.id`.
+
+| action | Reached by | Side effect |
+| --- | --- | --- |
+| `apply` | `apply` | writes consumer ACL policy + AppRole metadata |
+| `provision` | `provision` | writes one declared KV field |
+| `rotate` | `rotate` | replaces one declared KV field |
+| `verify` | `verify` | AppRole login + bounded read/capability probe |
+| `handoff` | `handoff` | mints role-id/secret-id to mode-0600 files |
+| `wrap` | `wrap` | response-wrapped operator handoff |
+| `exec` | `exec` | fetches one field into a child process |
+| `deactivate` | `revoke` **and** `lifecycle deactivate` | removes managed AppRole/policy; preserves KV |
+| `suspend` | `lifecycle suspend` | removes managed AppRole; preserves policy |
+| `destroy` | `lifecycle destroy` | irreversible KV metadata deletion |
+| `compromise` | `lifecycle compromise` | marks lane compromised; blocks delivery |
+| `reactivate` | `lifecycle reactivate` | clears overlay state |
+
+## Things a package author would otherwise get wrong
+
+- **`revoke` is not an action.** The CLI verb `revoke` gates as `deactivate`.
+  There is no `revoke` action value. Do not add one.
+- **`destroy` is defined but currently unreachable live.** The handler raises
+  before the gate; only `--dry-run` renders. Keep it in the package as the
+  dual-control-capable case, but no live `destroy` Check will arrive until the
+  exact-action approval contract lands (`SECRETS-WP-0007-T04`).
+- **`compromise` and `reactivate` mutate local overlay state only.** They touch
+  no OpenBao object. They are gated because they change delivery posture, not
+  because they write to the backend.
+- **`plan`, `apply --dry-run`, `route`, `audit`, `catalog`, `decision inspect`
+  and `evidence` never reach the gate** and must not appear in the package.
+- Build and test stages remain fail-open relative to approval-engine; only
+  `stage: prod` reaches consume.
+
+## Request attributes carried today
+
+`resource.attributes` carries `stage`, and sorted `fields`, `policy_targets`,
+and `auth_targets`. `fields` is populated for `provision`, `rotate`, `verify`,
+and `exec`; the others send an empty list rather than a guess.