Operator ask: a better method for minting/saving credentials, plus "a durable
rule to make sure when accounts are created there is a consolidation that
happens every time so credentials aren't misplaced or lost."

PROPOSED only -- no tooling built, no enforcement wired, no SEC-009 demotion.
Three forks are presented for ruling, one exchange each (GA-R5).

Measured diagnosis: the existing SEC-009 control CANNOT DETECT THE FAILURE
CLASS IT WAS BUILT FOR, because creds-audit is DECLARATION-based -- the
manifest IS the declaration, so an undeclared secret is structurally
invisible and a green CLEAN is not evidence nothing was missed.
- creds-audit vr1-office1 read CLEAN on 2026-07-15 while four secrets minted
  on the region VM on 2026-07-13 (site-headend-install.sh:416-455) sat
  undeclared; admin.pass surfaced only 2026-07-25 (SEC-020), 12 days later,
  and only because a task went looking.
- No --all (creds-audit.sh:25 takes one mandatory site).
- Enforcement is PROSE in exactly one place (phase-3 runbook:498), absent from
  preflight/cloud-assert/repo-lint/gauntlet -- and it did not fire at EITHER
  DC standup (dc0 3 + dc1 1 undeclared at this session's open).
- No D governs credential mint/custody generally (D-069 = Vault unseal keys,
  D-126 = per-env key isolation), so the rule lives only in the security
  ledger -- a register of exposures, which no gate can cite as authority.

Proposal: mint-and-consolidate as ONE operation (creds-mint.sh), plus the
DISCOVERY inversion (creds-audit --all/--remote against declared VM secret
locations -- the only piece that would have caught admin.pass), plus gate
wiring, plus a site-headend-install.sh amendment at the source.

The SEC-020 identity-conflation question stays SEPARATE (not batched, GA-R5)
and remains D-unassigned.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HvCyrwvYTTcDYnRErfMsNf