secrets-engine/workplans/SECRETS-WP-0017-bounded-executor-lanes.md

id	type	title	domain	repo	status	flavor	owner	topic_slug	created	updated	depends_on	related	state_hub_workstream_id
SECRETS-WP-0017	workplan	Catalog and guard bounded-executor CAS rotation lanes (NK-WP-0056 pilot)	infotech	secrets-engine	ready	implementation	secrets-engine	custodian	2026-10-31	2026-10-31		SECRETS-WP-0013	c0ca67a0-4404-5ceb-bdcd-7c9f33ece5eb

Owner answer to NK-WP-0056-T02 (hub message 16adf344). Design and proposed lane shapes: docs/bounded-executor-credential-lanes.md. The engine catalogs and statically guards the executor lane. railiance-platform applies the Kubernetes auth role and policy through its own CCR, and the executor holds only its own 15-minute token. Nothing here is a grant or a live change.

Model an existing-auth CAS rotation lane in the catalog

id: SECRETS-WP-0017-T01
status: todo
needs_human: true
decision_id: c29c6eda-fa13-4d53-8293-17261eb437c1
priority: high
state_hub_task_id: "d921d92f-38ed-5da7-8820-8a9e614c84de"

Add an explicit lane access mode, for example access: rotate-cas, for kv lanes with delivery_auth.management: existing. It renders ["read", "update"] on the exact data path and no create, metadata, delete, destroy or undelete paths. It requires the cas_required declaration, a 15m maximum TTL, risk high, and rotation and deactivation owners. Kubernetes auth is recorded as existing-auth metadata only. Keep the default read-only lane_policy_paths unchanged. Add tests for the rendered policy and for refusal of wildcard, extra capability and metadata variants.

Check a platform policy file against the catalog-rendered policy

id: SECRETS-WP-0017-T02
status: todo
priority: medium
state_hub_task_id: "2b1572b3-10d9-54ff-a1e2-047ae36826f8"

Add a static, offline comparison of a railiance-platform policy HCL with the engine-rendered policy for a lane, reported as non-secret pass/fail. Platform can run it on the CCR policy file before an attended apply. No OpenBao call.

Add catalog entries for the pilot executor

id: SECRETS-WP-0017-T03
status: todo
needs_human: true
decision_id: 3d0c8f86-7b9c-456b-8951-5ae889829118
priority: medium
state_hub_task_id: "2b751e4c-6cbc-54b9-8cb2-0e78d4a59739"

Add nk-bind-executor-svc-authelia (rotate-cas) and the syn-journey check read as non-secret entries that reference the platform CCR and NK-WP-0056. If the founder chooses the fallback LLDAP account, also add nk-bind-executor-lldap-credential (high risk). Use route for readiness pointers only.

Founder decision 2026-10-31

Approved by the founder (proposed -> ready) after the NK-WP-0056-T02 owner answers (hub decision 19afd15e). Founder choices: the executor write role is window-scoped (hub c29c6eda; CCR-2026-0058 approved as amended) and the bind rotates its own password (hub 3d0c8f86), so no lldap_password_manager lane is needed; T01 and T03 are unblocked.