# Gated actions over `secret-catalog-lane`

Authoritative list of the `action` values secrets-engine passes to the shared
authorization gate (`_require_lane_approval` → `resolve_consume_binding` →
`require_production_consume`). Supplied to flex-auth for
`secrets-engine.catalog-lane.lifecycle` (FLEX-WP-0021-T01 / FLEX-DEC-2026-005).

This is the enforced set read out of `cli.py`, not the
`secrets-engine.lifecycle`/`v1` example vocabulary. `resource.type` is
`secret-catalog-lane` and `resource.system` is `secrets-engine`; the catalog id
is `request.resource.id`.

| action | Reached by | Side effect |
| --- | --- | --- |
| `apply` | `apply` | writes consumer ACL policy + AppRole metadata |
| `provision` | `provision` | writes one declared KV field |
| `rotate` | `rotate` | replaces one declared KV field |
| `verify` | `verify` | AppRole login + bounded read/capability probe |
| `handoff` | `handoff` | mints role-id/secret-id to mode-0600 files |
| `wrap` | `wrap` | response-wrapped operator handoff |
| `exec` | `exec` | fetches one field into a child process |
| `deactivate` | `revoke` **and** `lifecycle deactivate` | removes managed AppRole/policy; preserves KV |
| `suspend` | `lifecycle suspend` | removes managed AppRole; preserves policy |
| `destroy` | `lifecycle destroy` | irreversible KV metadata deletion |
| `compromise` | `lifecycle compromise` | marks lane compromised; blocks delivery |
| `reactivate` | `lifecycle reactivate` | clears overlay state |

## Things a package author would otherwise get wrong

- **`revoke` is not an action.** The CLI verb `revoke` gates as `deactivate`.
  There is no `revoke` action value. Do not add one.
- **`destroy` is defined but currently unreachable live.** The handler raises
  before the gate; only `--dry-run` renders. Keep it in the package as the
  dual-control-capable case, but no live `destroy` Check will arrive until the
  exact-action approval contract lands (`SECRETS-WP-0007-T04`).
- **`compromise` and `reactivate` mutate local overlay state only.** They touch
  no OpenBao object. They are gated because they change delivery posture, not
  because they write to the backend.
- **`plan`, `apply --dry-run`, `route`, `audit`, `catalog`, `decision inspect`
  and `evidence` never reach the gate** and must not appear in the package.
- Build and test stages remain fail-open relative to approval-engine; only
  `stage: prod` reaches consume.

## Request attributes carried today

`resource.attributes` carries `stage`, and sorted `fields`, `policy_targets`,
and `auth_targets`. `fields` is populated for `provision`, `rotate`, `verify`,
and `exec`; the others send an empty list rather than a guess.