Generated keys, written by the Vault policy job #445

Parent

#444

What to build

A grant's key may declare generate, and the Vault policy job creates every generated key that is missing, so a session or HMAC key needs no manual step. generate: {} means 32 random bytes, hex encoded; bytes and encoding (hex, base64, base64url) override it. The job writes a key only when it is absent and never changes one. It runs per render, as today, and also on an hourly schedule, so a restored Vault gets its generated keys back with no human step.

Acceptance criteria

• Spec chapters 10 and 30 state the field, the defaults, what the policy job writes and when, and the refusals: a generated key outside secret/data/<project>-system/, a generated key on a path another Process or the Identity Provider writes, and two Projects generating one path.
• CONTEXT.md defines Generated key, and an ADR records why the policy job writes generated keys rather than a seed Job per Project.
• Both implementations and their oracles, with a worked example and a refusal example per refusal.
• The policy job, given a fake Vault, writes absent keys and leaves present ones unchanged.
• npm run verify and the emf build pass.

Blocked by

• None (can start immediately)