# Native lane cutover (SECRETS-WP-0006-T05 / T06)

Status: procedure only. Live apply is still fail-closed until
`SECRETS-WP-0007-T04` serves an exact-action approval and railiance-platform
grants scoped attended authority. CCR references below are workload-lane
provenance, not executable authorization for the native AppRole.

This document does not authorize production mutation.

## Scope

Five admitted KV lanes on the existing `platform` mount. Workload delivery
(ESO/OIDC) stays with current owners. Native apply adds only an exact-path
read policy and bounded AppRole.

Do not batch-retire ops-warden interim proxies. T06 is per lane, after native
evidence.

## Cutover order

Chosen for increasing blast radius, not CCR age.

| Order | Lane | Why this position |
| --- | --- | --- |
| 1 | `openrouter-llm-connect` | One field, one ESO consumer besides operator exec |
| 2 | `email-connect-transactional` | Three fields; ingest bearer shared with user-engine |
| 3 | `issue-core-ingestion-api-key` | Two fields, two ESO consumers |
| 4 | `reuse-surface-hub-write-token` | Hub write + webhook HMAC, two coordinated consumers |
| 5 | `forgejo-admin-api-token` | Site-admin PAT; last on purpose |

## What live apply would mutate (once approved)

Re-rendered 2026-09-02 against current `build_plan`. Every lane:

- `[kv-mount-check] platform` — no mount create
- `[policy]` exact `platform/data/<path>` read + metadata read
- `[approle]` 15m TTL, 30m max, 15m single-use secret_id, 8 token uses

No KV put/patch, no ESO change, no provider rotation.

## First-lane packet: `openrouter-llm-connect`

Provenance CCR: `CCR-2026-0003` (existing workload lane only).

Required before OpenBao:

1. Canonical ActionAuthorization for `action=apply`, resource
   `catalog:openrouter-llm-connect`, stage `prod`, exact policy/auth targets
   `se-prod-openrouter-llm-connect`.
2. Successful approval-engine CAS consume of that request digest
   (`GH-DEC-2026-003`).
3. Scoped attended production authority from railiance-platform (not a
   standing bootstrap token).
4. llm-connect owner ready to confirm ESO/application health after apply.

Apply: `secrets-engine apply openrouter-llm-connect --stage prod`  
then metadata-safe verify of field presence and unrelated-identity denial.
No value in evidence. Delivery session must self-revoke.

Rollback (native only): delete AppRole and policy
`se-prod-openrouter-llm-connect`. Leave KV and ESO untouched. Keep the
ops-warden proxy until T06.

## Explicit non-goals for T05

- Provision or rotate the live OpenRouter key.
- Retire all five proxies in one batch.
- Treat CCR status or a local fixture as apply authorization.