secrets-engine/workplans/SECRETS-WP-0015-original-keycape-recovery-selector.md

id	type	title	domain	repo	status	owner	topic_slug	created	updated	flavor	depends_on	related	state_hub_workstream_id
SECRETS-WP-0015	workplan	Prepare original KeyCape service selector and isolated consumer continuity	infotech	secrets-engine	ready	codex	custodian	2026-10-17	2026-10-17	implementation		CUST-WP-0080 NK-WP-0049 SECRETS-WP-0012 SECRETS-WP-0008 SECRETS-WP-0013	68a0642e-4908-5260-89c9-3adce60e6a4d

Needed source-owner work for NK-WP-0049-T36/T18. Reviewed against current Lifecycle INTENT, explicit consumer constants/custody source and dated historical proof. Ready means work can proceed, not native assent. Finished0012 remains finished; functional adoption/backend entitlement stay0008T06/0013. No new grant, secret fetch, provider login, production redirect or external message occurred.

Establish exact current intended source selector

id: SECRETS-WP-0015-T01
status: done
priority: high
assignee: codex
state_hub_task_id: "a3e0e243-edac-5ade-a3d5-f58dac41633a"

Completed 2026-10-17 as source review. Current consumer constants and config guards agree with secrets-engine-openbao client/audience, service:secrets-engine, tenant:platform, role secrets-engine and only openbao:login. Producer env selector and historical denied openbao:admin case are independently referenced, without accepting the producer's native role. Prior native issuance7Oct and consumer probe10Oct predate reviewed archive16Oct; they neither prove exact archived bytes nor current native assent. Recorded docs/keycape-isolated-recovery-selector.md. Evidence: Custodian recovery-owner-handoffs-r1 and prior17-source review.

Deliver bounded offline public source selector preflight

id: SECRETS-WP-0015-T02
status: done
priority: high
assignee: codex
state_hub_task_id: "eab3b758-10ce-5464-b5f7-3a152ee1327a"

Completed 2026-10-17 as isolated source preparation. Prepared AST-only source-hash and all-eight-selector-field checker with bounded strict JSON, source drift, duplicate, oversize and symlink negatives. It imports no backend/credential client and never exchanges a token. Tests use public/synthetic metadata only. Canonical integration/publication/projection must be recorded separately; successful output is source correspondence, not native acceptance or a new secret source.

Prepare outage-compatible original consumer proof without custody bypass

id: SECRETS-WP-0015-T03
status: todo
priority: high
assignee: codex
state_hub_task_id: "6262a915-7655-50be-b9f7-481f816d7335"

Next: map the exact original archive-delivered registration and producer-native checker result to the intended consumer, then prepare a source-reviewed isolated proof/custody plan. Current consumer source requires attended OpenBao memory read and refuses files; ordinary OpenBao/KeyCape outage is therefore a real dependency. Do not add a fallback, persistent consumer copy or unreviewed injection source. Clarify which continuity claim can be proved offline and which requires an exact accepted owner custody/provider path. Bind current original selectors, image/ source/TLS metadata, negative cases, timeout/abort and cleanup; retain protected backend operation entitlement in existing0008/0013. Done when that exact plan and remaining owner dependencies are reviewable, without retrieving any value.

Verify the separately admitted actual isolated consumer result

id: SECRETS-WP-0015-T04
status: wait
priority: high
assignee: codex
needs_human: true
depends_on: [SECRETS-WP-0015-T03, NK-WP-0049-T33]
blocking_reason: "Await exact consumer proof/custody plan plus original TLS/private admission readiness; actual attended owner path/authority remains required."
state_hub_task_id: "aeec6eb0-39e2-5f7c-8f5d-778133edfc73"

Only a separately admitted owner action can establish actual archived registration, issuer trust, native negative checks and consumer continuity. Source selector and historical provider proof do not fill this gate. No production consumer redirect, new grant, live OpenBao read, backend write or retained-factor MFA is authorized. Return exact bounded evidence to NK49T36/T18; MFA remains NK49T19. Human gate is never a worker wakeup. Cross-owner dependency is attached to derived case secrets15-nk49-readiness in the packet; do not strand the wait or invent a driver.