secrets-engine/registry/capabilities/capability.security.credential-lifecycle.md

id	owner	status	domain	maturity	external_evidence	name	summary	tags	discovery	availability	relations	evidence	consumer_guidance
capability.security.credential-lifecycle	secrets-engine	draft	infotech	discovery availability current target confidence rationale D3 D5 medium Owner scope, neighboring responsibilities, concrete use cases and limitations are documented; no exhaustive or generalized maturity claim. current target confidence rationale A2 A2 medium Source interface assessed 2026-10-14: CLI catalog, plan, exact OpenBao metadata apply, provisioning, verification, delivery and revoke. Availability describes the delivery form, not production acceptance. Production protected execution and independently anchored PDP authentication remain incomplete.	completeness reliability level confidence basis C1 low Source artifacts establish a bounded capability; no independent consumer-completeness assessment in this review. level confidence basis R0 low No longitudinal consumer reliability measurement established by this review.	Cataloged credential lifecycle	Decision-gated CLI for cataloged OpenBao lanes covering catalog, plan, exact metadata apply, provisioning, verification, exec delivery (exec-env/npm-config/exec-file), wrapped handoff, rotate, revoke and lifecycle, with founder-signed trust admission and a local evidence outbox.	security netkingdom framework-reuse	intent includes excludes use_cases CLI catalog, plan, exact OpenBao metadata apply, provisioning, verification, delivery and revoke CLI catalog, plan, exact OpenBao metadata apply, provisioning, verification, delivery and revoke Production protected execution and independently anchored PDP authentication remain incomplete U04: Protected operation obtains and consumes exact human approval before its side effect U05: Operator provisions and delivers a scoped workload credential through the approved owner lane U07: Owner inventories, rotates, revokes and detects exposure of credentials	current_level target_level current_artifacts consumption_modes A2 A2 SCOPE.md src/secrets_engine/decision_check.py src/secrets_engine/founder_admission.py docs/founder-admission.md tools/verify_service_jwt_boundary.py tools/check-keycape-recovery-selector.py CLI source	related_to capability.security.approval-lifecycle capability.authorization.policy-evaluate capability.railiance.platform-services capability.security.ssh-certificate-issuance	documentation SCOPE.md src/secrets_engine/decision_check.py src/secrets_engine/founder_admission.py docs/founder-admission.md tools/verify_service_jwt_boundary.py tools/check-keycape-recovery-selector.py	recommended_for not_recommended_for known_limitations Protected operation obtains and consumes exact human approval before its side effect Operator provisions and delivers a scoped workload credential through the approved owner lane Owner inventories, rotates, revokes and detects exposure of credentials Production protected execution and independently anchored PDP authentication remain incomplete Production protected execution and independently anchored PDP authentication remain incomplete Founder-signed admission of the PDP trust file and recovery attempts is source only (2026-10-21); the real producer key admission (SECRETS-WP-0014-T04) and native rollout (T03) are outstanding. service-jwt is login-only; it cannot carry engine actions yet. 2026-10-14 architecture review estimates operational maturity separately; a registry entry does not authorize execution or establish deployment.

Cataloged credential lifecycle

Decision-gated CLI for cataloged OpenBao lanes covering catalog, plan, exact metadata apply, provisioning, verification, exec delivery (exec-env/npm-config/exec-file), wrapped handoff, rotate, revoke and lifecycle, with founder-signed trust admission and a local evidence outbox.

Reuse boundary

Production protected execution and independently anchored PDP authentication remain incomplete.

Supported use cases

• U04: Protected operation obtains and consumes exact human approval before its side effect
• U05: Operator provisions and delivers a scoped workload credential through the approved owner lane
• U07: Owner inventories, rotates, revokes and detects exposure of credentials

Evidence and integration

• SCOPE.md
• src/secrets_engine/decision_check.py
• docs/founder-admission.md
• tools/verify_service_jwt_boundary.py

Assessment: CUST-WP-0081, 2026-10-14; summary and artifacts refreshed 2026-10-21 (maturity unchanged). Relations identify interfaces to compose; they do not certify native integration. Existing external evidence levels are retained where present. New entries use conservative C1/R0 until consumer assessment exists.