Runbook packs no longer carry exercise_status; note in the attended-procedure standard

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: sonnet
Assistant-Process: 295952@bnt-lap001
Assistant-Session: e93f64ad-516c-46eb-9666-aad8d300c477

docs/attended-procedure-standard.md

@@ -43,6 +43,10 @@ Every attended procedure carries this in its runbook, in the header:
 Exercise status: exercised 2026-08-27 by <operator> | unexercised
 ```
 
+> **Runbook packs (2026-09-29).** For runbook packs run by the `runbook-tutorials` engine this label is no longer a field in the
+> pack: the same idea is *maturity*, derived from clean runs in named environments and bound to the pack revision
+> (`runbook-tutorials/docs/maturity-and-projects.md`). Markdown procedures keep the header below.
+
 An unexercised procedure may still be the approved path — sometimes the incident
 *is* the first run. What it may not do is present itself as routine. Naming the
 status sets the operator's expectations correctly: run it expecting to debug it,

runbooks/openbao-operating-path/pack.yaml

@@ -3,7 +3,6 @@ id: nk.openbao-operating-path
 title: "OpenBao: consume, attend, recover"
 owner: net-kingdom
 outcome: You can reach the already-deployed private OpenBao, know which owner serves a credential, know the custody model and the attended recovery path, and have seen the ceremony-record validator refuse a secret marker.
-exercise_status: unexercised
 engine: native
 parameters:
   - {id: need, label: The credential you need, type: text, default: read a database password, help: Plain words; used only to look up the owner.}

runbooks/protected-system-flex-auth/pack.yaml

@@ -3,7 +3,6 @@ id: nk.protected-system-flex-auth
 title: Add a protected system to flex-auth
 owner: net-kingdom
 outcome: You have seen a protected system's manifests and policy evaluated offline, and a live flex-auth pin refuse callers with no credential, the wrong ServiceAccount, and the wrong audience. Expired-token refusal (negative N4) is not exercised here because it needs a ten-minute wait.
-exercise_status: unexercised
 engine: native
 parameters:
   - {id: flexauth_home, label: flex-auth checkout, type: path, default: ~/flex-auth}

runbooks/security-bootstrap-console/pack.yaml

@@ -3,7 +3,6 @@ id: nk.security-bootstrap-console
 title: NetKingdom guided security bootstrap (existing console)
 owner: net-kingdom
 outcome: The platform-root custody, OpenBao ceremony evidence, and identity bootstrap gates are walked through in the existing guided console.
-exercise_status: unexercised
 engine: legacy-command
 legacy:
   command: [make, security-bootstrap-ui]

runbooks/ssh-certificates/pack.yaml

@@ -3,7 +3,6 @@ id: nk.ssh-certificates
 title: Short-lived SSH credentials for admins, agents and automations
 owner: net-kingdom
 outcome: An actor obtains a short-lived CA-signed SSH certificate and uses it through an ops-bridge tunnel, with no static key doing the work.
-exercise_status: unexercised
 engine: native
 parameters:
   - {id: actor, label: Actor name, type: string, default: agt-claude-railiance01, pattern: "(adm|agt|atm)-[a-z0-9-]+", help: "Actor type prefix decides the maximum TTL: adm 48h, agt 24h, atm 8h."}