Integrate declared secret lifecycle with production provider dispatch #725

Proposal

Connect the existing declared secret-lifecycle contract to production provider dispatch, preserving exact selected-account authority and adapter confinement.

Background and evidence

At main fa0c79b9ae38eca2c59b2b1911becfe1a6b3c9ab, src/secret_lifecycle.rs:6-9 explicitly leaves caller credential handoff integration outside the lifecycle library. Source search finds no production SecretVault or SecretPlanBinding consumers outside that module and its exports.

account-manager/core/src/providers/mod.rs:365-423 resolves launch material lazily and injects the process environment; src/account_authority/grok.rs:22-30,283-308 supplies exact account binding/use leases; adapters also enforce their environment confinement. These controls are valuable, but they do not connect the generic declaration/expiry/revocation/rotation/finalization contract to a production run.

#336/#352 delivered the lifecycle foundation. This proposal concerns its production handoff, not another lifecycle library or a claim that current credentials were exposed.

Acceptance criteria

• Bind each supported launch to a declared lifecycle reference or an equivalent closed lifecycle operation with the run and exact account incarnation.
• Make inherited environment and provider credential handoffs explicit without putting raw values into plans, checkpoints, reports or IPC.
• Apply documented expiry/revocation/rotation semantics at launch and define active-child coordination.
• Finalize on spawn failure, cancellation, normal exit and abnormal exit.
• Test those lifecycle transitions with synthetic material through a real production construction path and a deterministic child fixture.
• Coordinate with Verify Grok 4.7 ACP credential-confined Linux managed execution #616/Qualify real managed writable execution for Cursor, Claude Code, and Gemini CLI #693 provider qualification and the desktop use-lease correction; avoid separate duplicate integration Issues per provider.

Advantages

Provides a common lifecycle audit contract across supported dispatch paths while retaining provider-specific account authority.

Disadvantages and costs

Requires bridging provider stores, operation/use leases and generic lifecycle references. Active-child rotation and revocation need explicit semantics; merely adding an in-memory wrapper must not be reported as completed integration.

Affected scope and verification

Lifecycle references, provider dispatch and environment construction, authority operation handling and supervisor finalization. Source-level inspection only; no real credential access or provider execution was performed.