diff --git a/tools/service-identity/declarations/openbao.yaml b/tools/service-identity/declarations/openbao.yaml
index 006f50f..0e510ae 100644
--- a/tools/service-identity/declarations/openbao.yaml
+++ b/tools/service-identity/declarations/openbao.yaml
@@ -39,7 +39,7 @@ identities:
     principal_type: HUMAN
     federated_role: true
     purpose: "OIDC role: fluid-telegram operators with aal2"
-    grants: [{mode: unknown, scope: openbao, note: "policy not established in the repository"}]
+    grants: [{mode: OPERATE, scope: "kv: fluid-telegram/hall-of-helix, 4 exact entries", activation: STANDING, environments: [PRODUCTION], note: "rpf bd8ca57: create/read/update, no list/delete; TTL 15m, max 30m"}]
     assurance_claim_bound: true
     interactive_login: true
     second_factor: required
@@ -65,7 +65,7 @@ identities:
     federated_role: true
     agent: {mode: unknown, presents_principal_type: service, max_token_ttl_seconds: 900, boundary_policy: agent-high-risk-boundary}
     purpose: "JWT role and AppRole for the coding agent; policies agent-high-risk-boundary and workload-kv-read-issue-core-runtime, fifteen minutes"
-    grants: [{mode: unknown, scope: openbao, note: "boundary policy content not established"}]
+    grants: [{mode: OBSERVE, scope: "kv metadata, token self", activation: STANDING, environments: [PRODUCTION], note: "rpf bd8ca57: boundary deny wins; no KV data read"}]
     interactive_login: false
     second_factor: not_applicable
     custody: [none]
diff --git a/workplans/NK-WP-0040-execution-attribution-receipt.md b/workplans/NK-WP-0040-execution-attribution-receipt.md
index 541f7f2..e91cc9c 100644
--- a/workplans/NK-WP-0040-execution-attribution-receipt.md
+++ b/workplans/NK-WP-0040-execution-attribution-receipt.md
@@ -60,8 +60,8 @@ schema, and validator are explicitly left to T02.
 ```task
 id: NK-WP-0040-T02
 status: wait
-blocked_on: message-from:railiance-master
-blocking_reason: "Audit-core accepted evidence custody and published field/admission requirements in AUDIT-WP-0014-T01. Still needs Railiance owner confirmation of exact emitter and wire binding before canonical schema/validator implementation, followed by actual emission/readback and attribution/clock/unknown-case acceptance."
+blocked_on: message-from:railiance-infra
+blocking_reason: "railiance-platform (RPF-WP-0067-T01, bd8ca57) has no playbook runner; the runner owner (railiance-infra for S1 Ansible) must name the emitter and its audit-core sender before schema/validator work."
 priority: medium
 state_hub_task_id: "963120c1-7c72-5806-942b-6f49e4c66e54"
 ```
@@ -78,6 +78,17 @@ agreement) and Railiance (emitter confirmation) via State Hub messages
 validator once both reply; nothing here can be finished unilaterally
 without pre-empting their agreement.
 
+**2026-10-28:** railiance-platform answered from source (RPF-WP-0067-T01, `bd8ca57`): it runs no
+playbooks, so it is not the emitter; the contract's reference declaration is railiance-infra's
+S1 Ansible `bootstrap-host`. Wire binding to reuse: `POST /v1/events` to audit-core with an
+`Idempotency-Key` equal to the envelope id, `correlation_id` = run id, a per-sender bearer from
+`platform/workloads/audit-core/senders` delivered by ESO, envelope `source` = sender name, no
+per-message signature. Recommended emission: every terminal outcome keyed by `run_id`. Not
+truthfully fillable today: `initiator.iss/sub` and `delegation` (shell-started runs carry no
+token), `executing_workload` (workload binding only proposed), `artifact_digest` (Ansible has
+no packaged artifact), `decision_refs`, `time_interval.bound`. Next: railiance-infra names the
+runner and emitter; a sender credential then goes to railiance-platform as a change request.
+
 ## Infrastructure review — 2026-09-28
 
 Use accepted IAM Profile v0.3 and Playbook Capability Contract v0.1 as the
diff --git a/workplans/NK-WP-0054-service-identity-policy.md b/workplans/NK-WP-0054-service-identity-policy.md
index de5a6c3..fa7b9c3 100644
--- a/workplans/NK-WP-0054-service-identity-policy.md
+++ b/workplans/NK-WP-0054-service-identity-policy.md
@@ -217,6 +217,14 @@ admin (scope of T05, KEY-WP-0045-T03); `approval-engine-operator` is withdrawn b
 (SI-11, KEY-WP-0013-T02). The founder's live view streams the deployed config through the
 exporter without writing it to disk; the exact command is in key-cape KEY-WP-0045-T02.
 
+**2026-10-28 (OpenBao, PostgreSQL):** railiance-platform `bd8ca57` (RPF-WP-0067-T02) adds a
+value-safe metadata exporter (`scripts/service_identity_metadata_export.py`, 10 tests) for
+OpenBao auth roles/policies with effective rules and PostgreSQL role flags and memberships.
+Declared from source: `fluid-telegram-operators` OPERATE on four exact KV entries;
+`coding-agent` OBSERVE only (its boundary policy denies the KV path its second policy grants,
+which is therefore inert). `coding-agent` `agent.mode` stays unknown (KeyCape KEY-WP-0043).
+The founder's live export commands are in RPF-WP-0067-T03.
+
 ## Split the directory bind from the human admin
 
 ```task