Retire the markdown tutorial verifier; close NK-WP-0044 and NK-WP-0009 on rehearsal receipts

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: sonnet
Assistant-Process: 6969@bnt-lap001
Assistant-Session: e8ae73f2-8385-4c9c-b714-94c3c52cdbc0

docs/tutorials/README.md

@@ -1,41 +1,21 @@
 # NetKingdom Security Pattern Tutorials
 
-Hands-on paths for operating the canonical NetKingdom security patterns
-(NK-WP-0009). Each tutorial is a file in this directory, written from
-[`TEMPLATE.md`](TEMPLATE.md) and checked by `make tutorials-verify`.
+The tutorials are now **runbook packs** in [`runbooks/`](../../runbooks/) for the
+`runbook-tutorials` engine (NK-WP-0009, NK-WP-0044). Run them through the engine's UI
+or `rtut`; check them with `make runbooks-validate`. The markdown verifier is retired.
 
-> **Moving.** Tutorials are becoming runbook packs in `runbooks/` for the
-> `runbook-tutorials` engine (NK-WP-0044). Packs: `runbooks/ssh-certificates/`, `runbooks/openbao-operating-path/`,
-> `runbooks/protected-system-flex-auth/`.
-> These markdown files stay until their packs are exercised.
+| Pack | Replaces | Status |
+| --- | --- | --- |
+| `runbooks/object-storage-sts/` | (new) vend temporary S3 credentials | rehearsed 2026-10-02 |
+| `runbooks/ssh-certificates/` | [ssh-certificates-and-tunnels.md](ssh-certificates-and-tunnels.md) | rehearsed 2026-10-02 |
+| `runbooks/openbao-operating-path/` | [openbao-operating-path.md](openbao-operating-path.md) | rehearsed 2026-10-02 |
+| `runbooks/protected-system-flex-auth/` | [protected-system-flex-auth.md](protected-system-flex-auth.md) | rehearsed 2026-10-02 |
 
-## Rules
+Maturity is derived by the engine from run history, not declared here. The three markdown
+files are kept as superseded reference. The flex-auth one still holds check N4 (an expired
+token is refused), which needs a ten-minute wait and is not in the pack.
 
-1. **Exercise status is mandatory.** Per
-   [`docs/attended-procedure-standard.md`](../attended-procedure-standard.md), a
-   tutorial header says `exercised <date> by <operator>` or `unexercised`.
-   Nothing is labelled exercised until someone has run it.
-2. **Every concrete step names its owning repo.** This repo owns canon and
-   reference tooling only (see `SCOPE.md`); deployment belongs to owners.
-3. **Verification and rollback are required**, not optional happy-path extras.
-4. **No secrets, ever.** Tutorials show paths and commands, never values.
-5. **Consume, don't copy.** Link owner runbooks; do not paste runtime
-   manifests. Use the named `openbao-ui-railiance01` tunnel, never a public
-   Bao URL (`bao.coulomb.social` is retired).
-
-## Index
-
-| Tutorial | Workplan task | Owners | Status |
-| --- | --- | --- | --- |
-| [OpenBao: consume, attend, recover](openbao-operating-path.md) | T03 | railiance-platform, net-kingdom | unexercised |
-| [Short-lived SSH credentials](ssh-certificates-and-tunnels.md) | T04 | ops-warden, ops-bridge | unexercised |
-| [Add a protected system to flex-auth](protected-system-flex-auth.md) | T05 | flex-auth, package owner | unexercised (offline part run) |
-
-Deferred (see NK-WP-0009): T02 object-storage STS (needs an owner-backed
-issuer and refusal/lease proof — ADR-0008 is architecture, not evidence).
-
-## Pattern mapping
-
-NK-WP-0008 (the pattern library) has no file in this repo, so tutorials map to
-the canonical documents directly: `docs/platform-identity-security-architecture.md`,
-`docs/responsibility-map.md`, `docs/platform-root-custody.md`.
+Rules that still apply to every pack: name the owning repo for each step, include
+verification and rollback, never put secrets in a pack, link owner runbooks instead of
+copying manifests, and use the named `openbao-ui-railiance01` tunnel, never a public Bao
+URL (`bao.coulomb.social` is retired).

docs/tutorials/TEMPLATE.md

@@ -1,41 +0,0 @@
-# <Tutorial title>
-
-Exercise status: unexercised
-Workplan task: NK-WP-NNNN-TNN
-Pattern(s): <canonical doc and section this teaches>
-
-## Outcome
-
-<One sentence: what is true when you are done.>
-
-## Prerequisites
-
-- <Access, tools, and state required. Name the owner of each.>
-
-## Architecture context
-
-<Who owns what. Which boundaries this crosses.>
-
-## Steps
-
-1. **[owner: <repo>]** <step and command>
-
-## Verification
-
-Done when:
-
-- <Observable, repeatable check. Command plus expected result.>
-
-## Rollback
-
-- <How to undo each step, or "not reversible" and why.>
-
-## Threat checks
-
-- <What could go wrong; what must never be logged, committed, or pasted.>
-
-## Ownership notes
-
-| Concern | Owner |
-| --- | --- |
-| <concern> | <repo> |

docs/tutorials/openbao-operating-path.md

@@ -1,6 +1,6 @@
 # OpenBao: consume, attend, recover
 
-Exercise status: unexercised
+Status: superseded by the runbook pack `runbooks/openbao-operating-path/` (rehearsed 2026-10-02). Kept as reference; the pack is authoritative.
 Workplan task: NK-WP-0009-T03
 Pattern(s): platform-root custody (`docs/platform-root-custody.md`); credential routing
 

docs/tutorials/protected-system-flex-auth.md

@@ -1,6 +1,6 @@
 # Add a protected system to flex-auth
 
-Exercise status: unexercised
+Status: superseded by the runbook pack `runbooks/protected-system-flex-auth/` (rehearsed 2026-10-02). Kept as reference; the pack is authoritative.
 Workplan task: NK-WP-0009-T05
 Pattern(s): authorization boundary (`docs/platform-identity-security-architecture.md`, ADR-0006); IAM Profile v0.3 consumption
 

docs/tutorials/ssh-certificates-and-tunnels.md

@@ -1,6 +1,6 @@
 # Short-lived SSH credentials for admins, agents and automations
 
-Exercise status: unexercised
+Status: superseded by the runbook pack `runbooks/ssh-certificates/` (rehearsed 2026-10-02). Kept as reference; the pack is authoritative.
 Workplan task: NK-WP-0009-T04
 Pattern(s): credential routing; ops-warden `AccessManagementDirective`