---
id: SECRETS-WP-0016
type: workplan
title: "Manifest the lifecycle engine as one library, a CLI, and a single-stage service"
domain: infotech
repo: secrets-engine
status: ready
owner: secrets-engine
topic_slug: custodian
created: "2026-10-22"
updated: "2026-10-22"
flavor: implementation
depends_on: []
related: [SECRETS-WP-0008, SECRETS-WP-0014]
---

Implements the engine shape in `INTENT.md` after gate-house ADR-015
(accepted 2026-10-22) and `ArchitectureBlueprint.md` §2.2.

Reviewed against the tree on 2026-10-22. `secrets_engine.plan.build_plan`
already renders a plan without an OpenBao client. `secrets_engine.cli` is the
process. `SCOPE.md` records that service delivery is absent, and that a
service API or daemon is not implemented. `service-jwt` can log in and cannot
yet carry engine actions. Accepted security-layer-model v0.8 still governs
PEP behavior. Proposed v0.9 §3.3 carries the same engine wording and does not
yet govern.

This workplan does not add a release-unit declaration, does not deploy a
workload, and does not make this engine the only client of OpenBao or a
decider of who may use it.

## Lock the library boundary

```task
id: SECRETS-WP-0016-T01
status: todo
priority: high
```

`build_plan` and the catalog validation it depends on stay free of the OpenBao
client. Add a test that calls the shipped `build_plan` for a fixture lane and
asserts no OpenBao client is constructed. If a plan path constructs one, move
that call to the process that applies the plan.

Done when that test passes against `src/secrets_engine/plan.py` and the apply
path still performs the OpenBao calls.

## Inject one stage credential at process start

```task
id: SECRETS-WP-0016-T02
status: todo
priority: high
depends_on: [SECRETS-WP-0016-T01]
```

The CLI process binds to exactly one stage, `build`, `test`, or `production`.
That stage's OpenBao credential is supplied to the process at start and is not
printed, returned, or written to Git, State Hub, logs, or the workplan. A
second stage credential present in the same process is a startup failure.

Done when a test starts the shipped CLI entry against fixture configuration,
shows one stage bound, shows the credential value absent from stdout and
stderr, and shows startup failure when two stage credentials are present.

## Manifest the same library as a single-stage service

```task
id: SECRETS-WP-0016-T03
status: todo
priority: medium
depends_on: [SECRETS-WP-0016-T02]
```

Add a service manifestation of the same library and the same one-stage
injection. It is a kept-running process, not a second implementation and not a
Deployment. It does not accept another stage's credential.

Done when an in-process test starts that manifestation for one stage and a
lifecycle call goes through the shipped library functions used by the CLI.

## Consume use, do not decide it

```task
id: SECRETS-WP-0016-T04
status: todo
priority: medium
depends_on: [SECRETS-WP-0016-T03]
```

Permission to start or call an instance is an access-engine decision. This
repository documents the claim it will consume and does not invent a local
allow-list. A caller-supplied flag or config key must not authorize apply or
the service. Protected side effects keep the existing rule: a decision record
or the published unreachable-engine stance. v0.8 PEP obligations stay.

Done when a test shows a local allow flag does not authorize a protected call,
and the claim shape is written in `docs/` without storing a credential.

## Record the manifestations in SCOPE

```task
id: SECRETS-WP-0016-T05
status: todo
priority: low
depends_on: [SECRETS-WP-0016-T03, SECRETS-WP-0016-T04]
```

Update `SCOPE.md` so it describes the library, the one-stage CLI, and the
service manifestation that the code then contains. State that other engines
may use OpenBao for other capabilities. Remove the claim that service delivery
is absent only for the manifestation this workplan adds. Leave exec-time
delivery as the default for a one-task caller.

Done when `SCOPE.md` matches the shipped commands and tests, and does not
describe a cluster Deployment this workplan did not add.