feat(stage2): add Lab2 credential backend binding policy

docs/automation_readiness/stage2_vrrp_readonly_s2_ro_04_windows_credential_backend.md

@@ -2,11 +2,12 @@
 
 ## Decision summary
 
-S2-RO-04 implements one bounded Windows Credential Manager read capability for
-the exact immutable S2-RO-03 binding. The credential target is trusted runtime
-configuration supplied outside Git, and the operational caller can request only
-`read(binding)`. The implementation has no enumeration, mutation, persistence,
-subprocess, network, or live-device capability.
+S2-RO-04 extends only the trusted policy wrapper to accept the two exact
+S2-RO-03 target/credential bindings, each with its matching trusted locator.
+Legacy `read(binding)` remains Lab1-only; `read_for_target(target_ref, binding)`
+checks the exact pair through S2-RO-03 before comparing configuration identity.
+The native Windows reader is unchanged. This is an **offline policy extension**,
+not permission to read a credential store or contact either lab.
 
 Status: implementation candidate ready for independent review after validation.
 
@@ -28,29 +29,53 @@ bounded ephemeral credential material
 future transport (not implemented)
 ```
 
-S2-RO-04 owns credential retrieval only. Target selection, authorization,
+S2-RO-04 owns bounded credential retrieval policy only. Endpoint selection, authorization,
 Owner verification, replay protection, host-key trust, network transport,
 command execution, runtime composition, and live-device access remain outside
 this slice.
 
 ## Accepted input and trusted target boundary
 
-The backend accepts only the S2-RO-03 binding whose values are:
+The target-aware API accepts only these exact relationships, as resolved by
+`Stage2FixedCredentialResolver.resolve_for_target`:
 
-- `credential_ref`: `credential.mikrotik.lab01`
-- `backend_kind`: `WINDOWS_CREDENTIAL_MANAGER`
-- `locator_ref`: `locator.stage2.mikrotik.lab01.readonly`
+| Logical target | Credential identity | Required trusted configuration |
+| --- | --- | --- |
+| `target.mikrotik.lab01` | `credential.mikrotik.lab01` | Existing Lab1 locator, equal to the Lab1 binding locator |
+| `target.mikrotik.lab02` | `credential.mikrotik.lab02` | Distinct externally provisioned Lab2 credential locator, equal to the Lab2 binding locator |
 
-Backend and locator identity are validated before any Windows boundary call.
-Invalid objects, alternate backends, alternate locators, and altered credential
-references fail closed without a read attempt.
+Both bindings use `WINDOWS_CREDENTIAL_MANAGER`; sharing the native read primitive
+does not share credential authority. S2-RO-03 remains the authority for the
+target/credential relationship. S2-RO-04 does not maintain a second pair registry.
+
+Before any Windows boundary call, the policy requires an exact binding object,
+the fixed backend kind, a resolver-approved target/credential pair, a binding
+locator equal to that resolver result, and a trusted configuration locator equal
+to the same result. Cross-lab credentials or locators, unknown identities,
+aliases, prefixes, case-confused values, and malformed objects fail closed with
+zero reader calls. Valid pairs perform exactly one read, without retries.
+
+`read(binding)` retains its original signature and Lab1-only identity checks;
+it then applies the same target-aware policy with the fixed Lab1 target. It
+cannot read a Lab2 binding or use a Lab2 configuration for Lab1. Existing Lab1
+configuration, error sanitization, reader call semantics, and output fields are
+unchanged. No S2-RO-05 or later production consumer is modified or enabled for
+Lab2 by this extension.
 
 The real Windows Credential Manager target name is not present in Git. A future
 trusted composition layer must supply exactly one target through the redacted
 `Stage2TrustedWindowsCredentialConfiguration`. The request and operational
-`read(binding)` call cannot select or override a Windows target, backend,
+`read(binding)` and `read_for_target(target_ref, binding)` calls cannot select or
+override a Windows target, backend,
 locator, username, secret, credential type, or read flags.
 
+Each backend instance has one immutable trusted configuration, with no default
+locator. The actual Windows record name must be separately provisioned and
+supplied by the trusted owner outside Git. This offline policy neither probes
+record existence nor verifies external provisioning; distinct real Lab2 record
+provisioning remains separately authorized work. Logical locators are not stored
+secret values or evidence that an actual credential record exists.
+
 This trusted configuration boundary is not S2-RO-10 runtime composition and
 does not discover configuration from files, environment variables, command
 line input, or a remote provider.
@@ -123,7 +148,12 @@ alternate target, or fallback lookup.
 Focused tests use only a synthetic target, username, and secret with an injected
 fake API. They prove:
 
-- the exact accepted binding performs exactly one read;
+- both exact target-bound identities perform exactly one read;
+- the 16-case target/credential/binding-locator/configuration-locator matrix
+  admits only the two fully matched combinations, with zero calls otherwise;
+- legacy Lab1 calls still work and cannot retrieve Lab2 credentials;
+- unknown, alias, prefix, case-confused, malformed, and caller-override inputs
+  reject before the reader, without a default or fallback;
 - the binding is not mutated and returned material is immutable;
 - wrong backend, locator, or malformed binding rejects before the API boundary;
 - callers cannot override target, backend, locator, credential type, or flags;
@@ -134,11 +164,24 @@ fake API. They prove:
 - no retry, enumeration, mutation, cache, persistence, subprocess, DPAPI,
   network, transport, or command-execution surface exists;
 - non-Windows invocation fails before a Windows library is loaded;
-- tests use the fake boundary and never call the real adapter.
-
-Validation also includes the accepted S2-RO-01, S2-RO-02, and S2-RO-03 focused
-regression suites, full pytest, report-index, complete-diff review, and tracked
-file verification.
+- behavioral tests inject a fake reader; the existing native-layout tests use
+  a fake DLL and test-owned memory, never the real credential store. An autouse
+  test guard denies real Windows library loading unless a test installs its
+  deterministic fake boundary.
+
+Validation order is focused S2-RO-04 tests, all `tests/stage2`, full pytest,
+report-index, and `git diff --check`. Python runs use `-B`; pytest disables its
+cache provider. Validation uses an external disposable copy of the exact
+candidate, without dependency downloads or source-worktree runtime artifacts.
+The source worktree must retain its pre-validation HEAD/tree, clean status, and
+file content/size/mtime during sandbox validation. Only the three authorized
+backend/test/document files are applied afterward, before the separately
+authorized single local implementation commit.
+
+Every test suite requires zero failures. Existing platform-specific skips are
+acceptable. Report-index may retain WARN only for optional missing artifacts,
+with no mandatory failure. This policy extension does not remediate unrelated
+CI maintenance warnings or constitute independent review PASS.
 
 ## Explicit exclusions
 
@@ -148,5 +191,9 @@ RESTCONF, HTTP, live commands, live-device access, evidence serialization, or
 S2-RO-05 and later capabilities.
 
 No real Credential Manager target, username, password, or secret is committed.
-No real credential store was probed. Commit, push, pull request, merge, branch
-cleanup, and the start of S2-RO-05 require separate Owner authorization.
+No real credential store was probed. The bounded implementation authorization
+permits one local commit only after validation passes. Push, pull request,
+merge, branch/worktree cleanup, and S2-RO-05 or later Lab2 work still require
+separate Owner authorization. No Lab2 credential record, known-host data,
+authorization package, replay access, private-key access, live attempt, or
+Stage-3 work is authorized here.