secrets-engine/workplans/SECRETS-WP-0016-engine-manifestations.md

id	type	title	domain	repo	status	owner	topic_slug	created	updated	reviewed_at	reviewed_against_commit	quality_dor	quality_dor_at	quality_dor_by	flavor	depends_on	related	state_hub_workstream_id
SECRETS-WP-0016	workplan	Manifest the lifecycle engine as one library, a CLI, and a single-stage service	infotech	secrets-engine	finished	secrets-engine	custodian	2026-10-22	2026-10-22	2026-10-22	39314c18b6	DoR-Ok	2026-10-22	grok	implementation		SECRETS-WP-0008 SECRETS-WP-0014	5f5e0a89-176d-5482-b388-a42685065cd0

Implements the engine shape in INTENT.md after gate-house ADR-015 (accepted 2026-10-22) and ArchitectureBlueprint.md §2.2.

Reviewed against the tree on 2026-10-22. secrets_engine.plan.build_plan renders a plan without an OpenBao client. secrets_engine.cli is the process, bound to one stage credential at start. serve keeps that same library running for the bound stage. SCOPE.md records the library, the one-stage CLI, and that in-process manifestation. Exec-time delivery remains the default for a one-task caller. service-jwt can log in and cannot yet carry engine actions. Accepted security-layer-model v0.8 still governs PEP behavior. Proposed v0.9 §3.3 carries the same engine wording and does not yet govern.

This workplan does not add a release-unit declaration, does not deploy a workload, and does not make this engine the only client of OpenBao or a decider of who may use it.

Lock the library boundary

id: SECRETS-WP-0016-T01
status: done
priority: high
state_hub_task_id: "4319d9c6-f7e1-500c-9011-a58c216d555d"

build_plan and the catalog validation it depends on stay free of the OpenBao client. Add a test that calls the shipped build_plan for a fixture lane and asserts no OpenBao client is constructed. If a plan path constructs one, move that call to the process that applies the plan.

Done when that test passes against src/secrets_engine/plan.py and the apply path still performs the OpenBao calls.

Inject one stage credential at process start

id: SECRETS-WP-0016-T02
status: done
priority: high
depends_on: [SECRETS-WP-0016-T01]
state_hub_task_id: "f5d5e9ba-ba56-56cc-8920-1417d70beb1d"

The CLI process binds to exactly one stage, build, test, or production. That stage's OpenBao credential is supplied to the process at start and is not printed, returned, or written to Git, State Hub, logs, or the workplan. A second stage credential present in the same process is a startup failure.

Done when a test starts the shipped CLI entry against fixture configuration, shows one stage bound, shows the credential value absent from stdout and stderr, and shows startup failure when two stage credentials are present.

Manifest the same library as a single-stage service

id: SECRETS-WP-0016-T03
status: done
priority: medium
depends_on: [SECRETS-WP-0016-T02]
state_hub_task_id: "c37280f3-e9d0-5cdd-ba15-a95ec5f9aa0c"

Add a service manifestation of the same library and the same one-stage injection. It is a kept-running process, not a second implementation and not a Deployment. It does not accept another stage's credential.

Done when an in-process test starts that manifestation for one stage and a lifecycle call goes through the shipped library functions used by the CLI.

Consume use, do not decide it

id: SECRETS-WP-0016-T04
status: done
priority: medium
depends_on: [SECRETS-WP-0016-T03]
state_hub_task_id: "89b71b5b-a2ce-57d6-b16b-0f94d76e0104"

Permission to start or call an instance is an access-engine decision. This repository documents the claim it will consume and does not invent a local allow-list. A caller-supplied flag or config key must not authorize apply or the service. Protected side effects keep the existing rule: a decision record or the published unreachable-engine stance. v0.8 PEP obligations stay.

Done when a test shows a local allow flag does not authorize a protected call, and the claim shape is written in docs/ without storing a credential.

Record the manifestations in SCOPE

id: SECRETS-WP-0016-T05
status: done
priority: low
depends_on: [SECRETS-WP-0016-T03, SECRETS-WP-0016-T04]
state_hub_task_id: "6b013ea1-4a04-57e8-bab2-acb196303e0a"

Update SCOPE.md so it describes the library, the one-stage CLI, and the service manifestation that the code then contains. State that other engines may use OpenBao for other capabilities. Remove the claim that service delivery is absent only for the manifestation this workplan adds. Leave exec-time delivery as the default for a one-task caller.

Done when SCOPE.md matches the shipped commands and tests, and does not describe a cluster Deployment this workplan did not add.