---
id: capability.security.credential-lifecycle
owner: secrets-engine
status: draft
domain: infotech
maturity:
  discovery:
    current: D3
    target: D5
    confidence: medium
    rationale: Owner scope, neighboring responsibilities, concrete use cases and limitations
      are documented; no exhaustive or generalized maturity claim.
  availability:
    current: A2
    target: A2
    confidence: medium
    rationale: 'Source interface assessed 2026-10-14: CLI catalog, plan, exact OpenBao
      metadata apply, provisioning, verification, delivery and revoke. Availability
      describes the delivery form, not production acceptance. Production protected
      execution and independently anchored PDP authentication remain incomplete.'
external_evidence:
  completeness:
    level: C1
    confidence: low
    basis: Source artifacts establish a bounded capability; no independent consumer-completeness
      assessment in this review.
  reliability:
    level: R0
    confidence: low
    basis: No longitudinal consumer reliability measurement established by this review.
name: Cataloged credential lifecycle
summary: Decision-gated CLI for cataloged OpenBao lanes covering catalog, plan, exact metadata
  apply, provisioning, verification, exec delivery (exec-env/npm-config/exec-file), wrapped
  handoff, rotate, revoke and lifecycle, with founder-signed trust admission and a local
  evidence outbox.
tags:
- security
- netkingdom
- framework-reuse
discovery:
  intent: CLI catalog, plan, exact OpenBao metadata apply, provisioning, verification,
    delivery and revoke
  includes:
  - CLI catalog, plan, exact OpenBao metadata apply, provisioning, verification, delivery
    and revoke
  excludes:
  - Production protected execution and independently anchored PDP authentication remain
    incomplete
  use_cases:
  - 'U04: Protected operation obtains and consumes exact human approval before its
    side effect'
  - 'U05: Operator provisions and delivers a scoped workload credential through the
    approved owner lane'
  - 'U07: Owner inventories, rotates, revokes and detects exposure of credentials'
availability:
  current_level: A2
  target_level: A2
  current_artifacts:
  - SCOPE.md
  - src/secrets_engine/decision_check.py
  - src/secrets_engine/founder_admission.py
  - docs/founder-admission.md
  - tools/verify_service_jwt_boundary.py
  - tools/check-keycape-recovery-selector.py
  consumption_modes:
  - CLI
  - source
relations:
  related_to:
  - capability.security.approval-lifecycle
  - capability.authorization.policy-evaluate
  - capability.railiance.platform-services
  - capability.security.ssh-certificate-issuance
evidence:
  documentation:
  - SCOPE.md
  - src/secrets_engine/decision_check.py
  - src/secrets_engine/founder_admission.py
  - docs/founder-admission.md
  - tools/verify_service_jwt_boundary.py
  - tools/check-keycape-recovery-selector.py
consumer_guidance:
  recommended_for:
  - Protected operation obtains and consumes exact human approval before its side
    effect
  - Operator provisions and delivers a scoped workload credential through the approved
    owner lane
  - Owner inventories, rotates, revokes and detects exposure of credentials
  not_recommended_for:
  - Production protected execution and independently anchored PDP authentication remain
    incomplete
  known_limitations:
  - Production protected execution and independently anchored PDP authentication remain
    incomplete
  - 'Founder-signed admission of the PDP trust file and recovery attempts is source only
    (2026-10-21); the real producer key admission (SECRETS-WP-0014-T04) and native rollout
    (T03) are outstanding.'
  - service-jwt is login-only; it cannot carry engine actions yet.
  - 2026-10-14 architecture review estimates operational maturity separately; a registry
    entry does not authorize execution or establish deployment.
---

# Cataloged credential lifecycle

Decision-gated CLI for cataloged OpenBao lanes covering catalog, plan, exact metadata apply, provisioning, verification, exec delivery (exec-env/npm-config/exec-file), wrapped handoff, rotate, revoke and lifecycle, with founder-signed trust admission and a local evidence outbox.

## Reuse boundary

Production protected execution and independently anchored PDP authentication remain incomplete.

## Supported use cases

- U04: Protected operation obtains and consumes exact human approval before its side effect
- U05: Operator provisions and delivers a scoped workload credential through the approved owner lane
- U07: Owner inventories, rotates, revokes and detects exposure of credentials

## Evidence and integration

- [SCOPE.md](../../SCOPE.md)
- [src/secrets_engine/decision_check.py](../../src/secrets_engine/decision_check.py)
- [docs/founder-admission.md](../../docs/founder-admission.md)
- [tools/verify_service_jwt_boundary.py](../../tools/verify_service_jwt_boundary.py)

Assessment: CUST-WP-0081, 2026-10-14; summary and artifacts refreshed 2026-10-21 (maturity unchanged). Relations identify interfaces to compose; they do not certify native integration. Existing external evidence levels are retained where present. New entries use conservative C1/R0 until consumer assessment exists.