feat: add production capability foundations

docs/registries/secrets-classification.yaml

@@ -89,6 +89,18 @@ secrets:
     compatibility_impact: breaking
     required_test: secrets-contract:redis-password-no-leak
 
+  - name: APP_CACHE_REDIS_TRUST_PEM
+    # Public CA bundle content, but integrity-sensitive and supplied by the mounted environment.
+    classification: sensitive-config
+    source: mounted-env
+    rotation_policy: restart-only
+    prod_default: null
+    dev_sentinel_prefix: __LOCAL_DEV_
+    owner_branch: redis-production-capability
+    masking_rule: full
+    compatibility_impact: additive
+    required_test: secrets-contract:redis-trust-reference-no-leak
+
   - name: APP_CACHE_REDIS_KEY_HMAC_SECRET
     # Stable cache-key HMAC material. It is distinct from the Redis authentication credential.
     classification: secret
@@ -101,6 +113,102 @@ secrets:
     compatibility_impact: breaking
     required_test: secrets-contract:redis-key-hmac-no-leak
 
+  - name: APP_RATE_LIMIT_REDIS_PASSWORD
+    # Dedicated coordination-role Redis credential. It is never inherited from cache Redis.
+    classification: secret
+    source: secret-manager
+    rotation_policy: restart-only
+    prod_default: null
+    dev_sentinel_prefix: __LOCAL_DEV_
+    owner_branch: redis-distributed-rate-limit
+    masking_rule: full
+    compatibility_impact: additive
+    required_test: secrets-contract:rate-limit-redis-password-no-leak
+
+  - name: APP_RATE_LIMIT_REDIS_TRUST_PEM
+    # Coordination-role CA bundle content; integrity-sensitive but not credential material.
+    classification: sensitive-config
+    source: mounted-env
+    rotation_policy: restart-only
+    prod_default: null
+    dev_sentinel_prefix: __LOCAL_DEV_
+    owner_branch: redis-production-capability
+    masking_rule: full
+    compatibility_impact: additive
+    required_test: secrets-contract:rate-limit-redis-trust-reference-no-leak
+
+  - name: APP_RATE_LIMIT_REDIS_KEY_HMAC_SECRET
+    # Stable private-key derivation material for rate-limit subjects and policy revisions.
+    classification: secret
+    source: secret-manager
+    rotation_policy: dual-read-restart-only
+    prod_default: null
+    dev_sentinel_prefix: __LOCAL_DEV_
+    owner_branch: redis-distributed-rate-limit
+    masking_rule: full
+    compatibility_impact: additive
+    required_test: secrets-contract:rate-limit-redis-key-hmac-no-leak
+
+  - name: APP_SESSION_REDIS_PASSWORD
+    # Dedicated session-role ACL credential; never shared implicitly with cache or coordination.
+    classification: secret
+    source: secret-manager
+    rotation_policy: restart-only
+    prod_default: null
+    dev_sentinel_prefix: __LOCAL_DEV_
+    owner_branch: redis-production-capability
+    masking_rule: full
+    compatibility_impact: additive
+    required_test: secrets-contract:session-redis-password-no-leak
+
+  - name: APP_SESSION_REDIS_TRUST_PEM
+    # Session-role CA bundle content; integrity-sensitive but not credential material.
+    classification: sensitive-config
+    source: mounted-env
+    rotation_policy: restart-only
+    prod_default: null
+    dev_sentinel_prefix: __LOCAL_DEV_
+    owner_branch: redis-production-capability
+    masking_rule: full
+    compatibility_impact: additive
+    required_test: secrets-contract:session-redis-trust-reference-no-leak
+
+  - name: APP_SESSION_REDIS_KEY_HMAC_SECRET
+    # Stable private derivation material for pseudonymous Redis session keys.
+    classification: secret
+    source: secret-manager
+    rotation_policy: dual-read-restart-only
+    prod_default: null
+    dev_sentinel_prefix: __LOCAL_DEV_
+    owner_branch: redis-production-capability
+    masking_rule: full
+    compatibility_impact: additive
+    required_test: secrets-contract:session-redis-key-hmac-no-leak
+
+  - name: APP_IDEMPOTENCY_REDIS_KEY_HMAC_SECRET
+    # Owner-safe request-replay keys must not expose tenant/scope/request identifiers.
+    classification: secret
+    source: secret-manager
+    rotation_policy: cold-cutover-restart-only
+    prod_default: null
+    dev_sentinel_prefix: __LOCAL_DEV_
+    owner_branch: redis-production-capability-completion
+    masking_rule: full
+    compatibility_impact: additive
+    required_test: secrets-contract:idempotency-redis-key-hmac-no-leak
+
+  - name: APP_LEASE_REDIS_KEY_HMAC_SECRET
+    # Efficiency-lease resource and owner scopes use a dedicated derivation key.
+    classification: secret
+    source: secret-manager
+    rotation_policy: cold-cutover-restart-only
+    prod_default: null
+    dev_sentinel_prefix: __LOCAL_DEV_
+    owner_branch: redis-production-capability-completion
+    masking_rule: full
+    compatibility_impact: additive
+    required_test: secrets-contract:lease-redis-key-hmac-no-leak
+
   - name: APP_PRIVACY_PSEUDONYMIZATION_SALT
     # source: feature-data-retention-privacy-contract 2026-05-22
     # "pseudonymization key = HMAC-SHA-256 with rotating salt. salt rotation interval = 90일.