docs: record the answers received and the questions routed

Six inbound messages attended, three of them carrying real asks.

flex-auth FLEX-DEC-2026-004 answers WARDEN-WP-0034-T05's decision-lifetime
question: a decision lifetime shorter than the certificate TTL is meaningful,
but only as authority to ISSUE, never to USE an already-issued certificate.
The question had mistaken a decision lifetime for a credential lifetime. They
declined to move the §9.7.2 revocation residue to their side; that refusal is
right and the stance map is unchanged. T05 still waits on ops-mason and
railiance-infra.

WARDEN-WP-0039-T03 routed to flex-auth: is there an admitted contract for a
delegated credential read where caller and resource owner differ? Three
outcomes named as equally acceptable, including that there should be no such
contract and the interim proxy transport is itself the defect -- which would
shorten WP-0033 rather than block it. Two easy fixes ruled out in writing:
broadening the caller binding, and relabelling resource.system as ops-warden
so the binding matches. The second would make the audit trail assert we own
credentials we deliberately do not, by editing a field instead of making an
argument.

WARDEN-WP-0037: npm path routed to railiance-platform, catalog unchanged
pending their answer. secrets-engine refused to resolve it from a
coordination message and was right; asserting our own pointer is
authoritative because it is ours would route around that. The ask names a
location only, and flags that a `bao kv get` answer would be the 2026-07-16
disclosure vector on a risk: high lane.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013EPuTc18FjU5WFqoSEKH3C

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 1276224@bnt-lap001
Assistant-Session: 426ec497-e1c4-4dd3-b417-dfce1ca1dbc3

workplans/WARDEN-WP-0034-layer-model-v07-conformance.md

@@ -198,6 +198,36 @@ current access-engine implementation, received the decision-lifetime semantics
 question (message `02c99a74`). No implementation or policy decision was assigned
 to another owner by these messages.
 
+**One of three answered, 2026-09-09.** `flex-auth` answered the decision-lifetime
+question as `FLEX-DEC-2026-004` (flex-auth commit `6a6464f`), and answered it
+rather than declining it: a decision lifetime shorter than the certificate TTL is
+meaningful, but only as authority to **issue**, never as authority to **use** an
+already-issued certificate. The action is `sign` and it completes at issuance, so
+the decision is consumed once the certificate exists and no field in the decision
+record reaches the artifact. 15m against a 48h `adm` certificate was never an
+inconsistency to reconcile — the question mistook a decision lifetime for a
+credential lifetime.
+
+Two obligations land on this side and are accepted: no replay of an allow past
+`expires_at`, and a fresh Check per sign. The second is where the value is, and it
+is real rather than nominal because claims are not cached PDP-side (deadline 0 for
+the claim class), so a revoked principal stops obtaining *new* certificates
+immediately.
+
+`pep-stance.yaml` §9.7.2 is unchanged and stays here: flex-auth explicitly declined
+to move the residue to their side, on the ground that a PDP recalling an issued
+credential would be "the same shape of lie as fail-open". Declining it was the
+right call even though absorbing it would have made their record look tidier.
+
+The TTL lever they named — capping requested TTL per actor class or zone, already a
+policy input since `ttl_out_of_bounds` is denied before OpenBao is reached — is
+noted and deliberately not requested. Shortening `adm` from 48h has an operator
+cost, and issuance on this lane is too sparse (3 signature records across 79 days,
+`pep-stance.yaml` `emission_cadence`) to price it from intuition.
+
+T05 stays `wait` on the remaining two: `ops-mason` (no stance map published) and
+`railiance-infra` (KRL distribution versus TTL expiry). Neither has replied.
+
 ## Related
 
 Review 2026-09-05: reviewed the pending implementation and fixed the identity

workplans/WARDEN-WP-0037-whynot-design-forgejo-npm-lane.md

@@ -79,3 +79,33 @@ authenticated exact-version lookup proved that Forgejo's remote integrity
 matches the local dry-run. T03 waits only on rotating the dedicated package
 token and proving the next fresh version through `whynot-design-npm-publish`;
 the package migration itself is complete.
+
+**2026-09-09 — field claim corrected, path routed.** `secrets-engine` (msg
+`15f0c0ca`) corrected two things and declined a third, all correctly.
+
+The KV field is `npm_token`. `NPM_AUTH_TOKEN` is the environment variable their
+publication-scope policy injects, and ops-warden had copied the env var in as the
+field name — so the catalog's `fetch_command` named a field that does not exist
+and could only ever have failed. Corrected in `registry/routing/catalog.yaml` and
+`wiki/playbooks/whynot-design-npm-publish.md` from the owner's statement rather
+than re-derived here. This was `ADR-0001`'s failure mode rather than a typo: a
+pointer layer restating an owner's procedure and getting a detail wrong.
+
+The endpoint claim already agreed; `delivery_config.npm.registry` has been the
+Forgejo URL throughout.
+
+The **path** is routed to `railiance-platform` and the catalog is unchanged pending
+their answer. Which location backs the lane for reads is custody state they own;
+`secrets-engine` has no lane read authority to confirm it and refused to rewrite a
+production lane pointer from a coordination message (`SECRETS-WP-0006-T06`). Their
+reasoning is right, and asserting our own pointer is authoritative because it is
+ours would route around it. The ask names a location only and flags that a
+`bao kv get` answer would be the 2026-07-16 disclosure vector on a `risk: high`
+lane.
+
+`ready: false` is not being read as path evidence: a source checkout with no
+production authority reports not-ready regardless of which path the catalog names.
+
+T03 still waits on the human rotation of the dedicated Forgejo package token; the
+path question does not block that, it determines whether the pointer is correct
+once it rotates.

workplans/WARDEN-WP-0039-explicit-policy-refusal.md

@@ -74,3 +74,31 @@ authorized by this workplan alone. HFACT-WP-0001-T03 consumes this return.
 Validation: 429 tests passed (4 integration tests deselected by the repository default); Ruff passed for changed Python files. Full tests used the declared phase-memory source and an isolated temporary memory store. The focused policy/proxy suite passed 69 tests. The existing authenticated SSH policy probe still returns HTTP 200/ALLOW, decision:f3f7c88f9585582a; the credential-owner request returns 403. No CA issue or credential read was performed by these probes.
 
 Installed verification: source guard present after refreshed owner installation (`19bb75c`). `warden access forgejo-admin-api-token --exec --field API_TOKEN -- true` exits 4 with explicit HTTP 403 before credential transport or child execution. The previous fail-open warning is absent. The probe requested no output value; no credential was fetched. T01/T02 are complete; T03 owns the remaining exact policy-binding admission.
+
+**T03 routed 2026-09-09.** Asked `flex-auth` whether an admitted contract exists
+for a delegated credential read where the caller (ops-warden) and the resource
+owner differ, since that is exactly the shape drawing the live 403. Three outcomes
+were named as equally acceptable answers, with no preference stated between the
+first two: an existing contract to conform to; no contract yet, making this a
+design question they should raise rather than one ops-warden invents a shape for;
+or that there should be **no** such contract — the interim proxy transport is
+itself the defect and the answer is to finish the native handoff
+(`WARDEN-WP-0033` / `SECRETS-WP-0006`).
+
+The third is a real possibility and was not argued against. Eleven catalog lanes
+are ops-warden proxies with a named intended owner precisely because no owner
+front door exists; if delegated reads should not be made policy-admissible, that
+shortens WP-0033 rather than blocking it.
+
+Two fixes were explicitly ruled out in the message rather than left unmentioned:
+broadening the ops-warden caller binding so it may read other systems' resources,
+and relabelling `resource.system` as ops-warden so the existing binding matches.
+The second is worse — it would make the audit trail assert ops-warden owns
+credentials it deliberately does not, which is the claim `ADR-0002` exists to
+prevent, achieved by editing a field instead of making an argument.
+
+The refusal stays in place until an answer yields positive evidence plus
+wrong-caller, wrong-owner and wrong-tenant negatives. No grant was requested.
+`secrets-engine` was told this bears on SECRETS-WP-0007-T04 and on how many lanes
+stay proxied; `gate-house` was told it may reach how the signing lane's
+approval-consume is built (GH-DEC-2026-005).