docs: project remaining WP0027 owner gates

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a0290b-3241-74c3-b868-6049545af836

docs/evidence/WARDEN-WP-0027-T02-drill-preparation-checklist-2026-08-22.md

@@ -0,0 +1,73 @@
+# WARDEN-WP-0027-T02 attended drill preparation checklist
+
+Status: `preparing` — `authorizes_execution: false`.
+
+## Immutable scenario basis
+
+- Scenario: `WARDEN-WP-0027-T02-DRILL-20260822-01`
+- Scenario artifact:
+  `docs/evidence/WARDEN-WP-0027-T02-drill-scenario-2026-08-22.md`
+- Scenario SHA-256:
+  `ffa69764ad391db633f57ac70444e5781eee698bf9e362dfef31614fa43152dc`
+- Preparation approval decision:
+  `9da57559-712a-4521-b46e-a4c69729f9d2`
+- Preparation approved at: `2026-08-22T21:43:11Z`
+- Scenario expires: `2026-08-23T20:00:00Z`
+- Maximum live duration after a later exact GO: 45 minutes
+
+The scenario artifact is intentionally unchanged after railiance-infra approved
+its pinned digest. This checklist records later preparation evidence without
+invalidating that receipt.
+
+## Exact prepared live scope
+
+The only prepared live sequence is one intentional OpenBao seal followed by the
+existing attended 2-of-3 Shamir unseal ceremony and value-safe post-unseal
+verification.
+
+Preparation and owner receipts authorize no live action. The scope excludes a
+host reboot, re-key, snapshot restore, policy change, PVC mutation, credential
+disclosure, general workload restart, and every action not named above.
+
+## Owner review gates
+
+| Gate | Contract | State |
+| --- | --- | --- |
+| Independent provider console and distinct abort authority | `WARDEN-WP-0027-T02-DRILL-20260822-01-INFRA` | satisfied; receipt `01a02b4b-7295-7836-b288-f29407008524` |
+| Fresh encrypted, verified, off-host Raft snapshot and platform driver acceptance | `WARDEN-WP-0027-T02-DRILL-20260822-01-PLATFORM` | pending |
+| Two distinct custodians available for the current 2-of-3 barrier | `WARDEN-WP-0027-T02-DRILL-20260822-01-QUORUM` | pending |
+
+Every receipt is metadata-only. No receipt may include a provider credential,
+OpenBao token, unseal share, recovery value, decrypted snapshot, custody
+location, custodian identity, or value-derived fingerprint.
+
+## Final read-only preflight
+
+After both pending contracts are satisfied, ops-warden runs the platform-owned
+`scripts/audit-core-recovery-preflight.py node-reboot` interface with:
+
+- approved window id `WARDEN-WP-0027-T02-DRILL-20260822-01`;
+- the platform owner's current snapshot evidence file;
+- the railiance-master quorum attestation;
+- the accepted railiance-infra provider-console and abort role;
+- the existing RAILIANCE-WP-0024 procedure-owner acknowledgements.
+
+The interface name reflects its superset recovery checklist; it does not add a
+reboot to this scenario. Its result must report all of:
+
+- `preflight_only: true`;
+- `automated_checks_passed: true`;
+- `ready_for_live_execution: true`;
+- `secret_values_observed: false`.
+
+Any changed cluster identity, invalid/stale snapshot receipt, missing owner
+receipt, overlapping mutation, failed automated check, observed secret value,
+or expired scenario is a NO-GO.
+
+## Final human hold point
+
+Only after the green preflight may ops-warden ask:
+
+`GO WARDEN-WP-0027-T02-DRILL-20260822-01?`
+
+No prior approval or conversational “go” crosses this hold point.

interfaces/reviews/WARDEN-WP-0027-T02-DRILL-20260822-01-railiance-master.json

@@ -0,0 +1,74 @@
+{
+  "schema_version": "review-contract/v1",
+  "contract_key": "WARDEN-WP-0027-T02-DRILL-20260822-01-QUORUM",
+  "subject": {
+    "kind": "task",
+    "id": "WARDEN-WP-0027-T02"
+  },
+  "scenario_id": "WARDEN-WP-0027-T02-DRILL-20260822-01",
+  "preparation_decision_id": "9da57559-712a-4521-b46e-a4c69729f9d2",
+  "expires_at": "2026-08-23T20:00:00Z",
+  "authorizes_execution": false,
+  "evidence_boundary": "metadata_only",
+  "allowed_dispositions": [
+    "approve",
+    "request_changes"
+  ],
+  "artifacts": {
+    "docs/evidence/WARDEN-WP-0027-T02-drill-scenario-2026-08-22.md": {
+      "algorithm": "sha256",
+      "digest": "ffa69764ad391db633f57ac70444e5781eee698bf9e362dfef31614fa43152dc"
+    },
+    "docs/evidence/WARDEN-WP-0027-T02-drill-preparation-checklist-2026-08-22.md": {
+      "algorithm": "sha256",
+      "digest": "5462b69104d31849cd73c308bb092c16e1a38b7d7e0a48c492a87e8207fdd3fa"
+    }
+  },
+  "owners": [
+    {
+      "id": "railiance-master",
+      "artifact_ids": [
+        "docs/evidence/WARDEN-WP-0027-T02-drill-scenario-2026-08-22.md",
+        "docs/evidence/WARDEN-WP-0027-T02-drill-preparation-checklist-2026-08-22.md"
+      ],
+      "assertions": [
+        {
+          "id": "scenario-decision-and-expiry-bound",
+          "statement": "This receipt applies only to scenario WARDEN-WP-0027-T02-DRILL-20260822-01 under preparation decision 9da57559-712a-4521-b46e-a4c69729f9d2 and expires at 2026-08-23T20:00:00Z."
+        },
+        {
+          "id": "two-distinct-custodians-available",
+          "statement": "The custody authority confirms that two distinct custodians for the current 2-of-3 OpenBao Shamir barrier are available for this attended scenario through approved out-of-band custody paths."
+        },
+        {
+          "id": "custody-values-remain-out-of-band",
+          "statement": "Custodian identities, share values, custody locations, and all value-derived fingerprints remain outside Git, State Hub, logs, shell history, and chat."
+        },
+        {
+          "id": "exact-live-scope-reviewed",
+          "statement": "The possible live scope is exactly one intentional OpenBao seal followed by the existing 2-of-3 unseal ceremony; it excludes host reboot, re-key, restore, policy change, PVC mutation, credential disclosure, and general workload restart."
+        },
+        {
+          "id": "execution-not-authorized",
+          "statement": "Approval is quorum-availability evidence only and authorizes no OpenBao seal or unseal, reboot, or other live execution."
+        }
+      ],
+      "check_ids": [
+        "scenario-artifact-sha256",
+        "preparation-checklist-sha256",
+        "two-distinct-custodians-availability-attestation",
+        "out-of-band-custody-boundary",
+        "metadata-only-boundary"
+      ]
+    }
+  ],
+  "gates": [
+    {
+      "id": "WARDEN-WP-0027-T02-DRILL-20260822-01-QUORUM",
+      "policy": "all_required",
+      "owners": [
+        "railiance-master"
+      ]
+    }
+  ]
+}

interfaces/reviews/WARDEN-WP-0027-T02-DRILL-20260822-01-railiance-platform.json

@@ -0,0 +1,78 @@
+{
+  "schema_version": "review-contract/v1",
+  "contract_key": "WARDEN-WP-0027-T02-DRILL-20260822-01-PLATFORM",
+  "subject": {
+    "kind": "task",
+    "id": "WARDEN-WP-0027-T02"
+  },
+  "scenario_id": "WARDEN-WP-0027-T02-DRILL-20260822-01",
+  "preparation_decision_id": "9da57559-712a-4521-b46e-a4c69729f9d2",
+  "expires_at": "2026-08-23T20:00:00Z",
+  "authorizes_execution": false,
+  "evidence_boundary": "metadata_only",
+  "allowed_dispositions": [
+    "approve",
+    "request_changes"
+  ],
+  "artifacts": {
+    "docs/evidence/WARDEN-WP-0027-T02-drill-scenario-2026-08-22.md": {
+      "algorithm": "sha256",
+      "digest": "ffa69764ad391db633f57ac70444e5781eee698bf9e362dfef31614fa43152dc"
+    },
+    "docs/evidence/WARDEN-WP-0027-T02-drill-preparation-checklist-2026-08-22.md": {
+      "algorithm": "sha256",
+      "digest": "5462b69104d31849cd73c308bb092c16e1a38b7d7e0a48c492a87e8207fdd3fa"
+    }
+  },
+  "owners": [
+    {
+      "id": "railiance-platform",
+      "artifact_ids": [
+        "docs/evidence/WARDEN-WP-0027-T02-drill-scenario-2026-08-22.md",
+        "docs/evidence/WARDEN-WP-0027-T02-drill-preparation-checklist-2026-08-22.md"
+      ],
+      "assertions": [
+        {
+          "id": "scenario-decision-and-expiry-bound",
+          "statement": "This receipt applies only to scenario WARDEN-WP-0027-T02-DRILL-20260822-01 under preparation decision 9da57559-712a-4521-b46e-a4c69729f9d2 and expires at 2026-08-23T20:00:00Z."
+        },
+        {
+          "id": "current-snapshot-receipt-valid",
+          "statement": "railiance-platform has created a fresh encrypted, verified, off-host OpenBao Raft snapshot through its approved custody path, and its metadata-only receipt passes the platform validator against the live railiance01 cluster id and a possible applied index."
+        },
+        {
+          "id": "platform-driver-role-accepted",
+          "statement": "railiance-platform accepts the attended snapshot, seal/unseal driver, and value-safe post-unseal verification role for this scenario."
+        },
+        {
+          "id": "exact-live-scope-reviewed",
+          "statement": "The possible live scope is exactly one intentional OpenBao seal followed by the existing 2-of-3 unseal ceremony; it excludes host reboot, re-key, restore, policy change, PVC mutation, credential disclosure, and general workload restart."
+        },
+        {
+          "id": "metadata-only-evidence",
+          "statement": "The receipt and its checks disclose no snapshot data, decryption material, credential, token, recovery share, secret value, custody location, or value-derived fingerprint."
+        },
+        {
+          "id": "execution-not-authorized",
+          "statement": "Approval is preparation evidence only and authorizes no OpenBao seal or unseal, snapshot restore, reboot, or other live execution."
+        }
+      ],
+      "check_ids": [
+        "scenario-artifact-sha256",
+        "preparation-checklist-sha256",
+        "openbao-snapshot-receipt-validator",
+        "platform-driver-scope-review",
+        "metadata-only-boundary"
+      ]
+    }
+  ],
+  "gates": [
+    {
+      "id": "WARDEN-WP-0027-T02-DRILL-20260822-01-PLATFORM",
+      "policy": "all_required",
+      "owners": [
+        "railiance-platform"
+      ]
+    }
+  ]
+}

workplans/WARDEN-WP-0027-credential-governance-lockdown.md

@@ -177,6 +177,18 @@ It binds the exact scenario artifact and expiry, requires explicit independent
 provider-console and distinct-abort attestations, permits metadata-only evidence,
 and states `authorizes_execution: false`.
 
+**Preparation approved 2026-08-22.** Decision
+`9da57559-712a-4521-b46e-a4c69729f9d2` authorizes preparation only and narrows
+the possible live scope to one intentional OpenBao seal followed by the existing
+2-of-3 unseal ceremony. It excludes a host reboot, re-key, restore, policy
+change, PVC mutation, credential disclosure, and general workload restart.
+Railiance-infra satisfied its direct contract with receipt
+`01a02b4b-7295-7836-b288-f29407008524`. The revisioned, non-authorizing gate
+matrix is in
+`docs/evidence/WARDEN-WP-0027-T02-drill-preparation-checklist-2026-08-22.md`;
+platform snapshot/driver and master quorum contracts remain required before the
+fully parameterized read-only preflight.
+
 ## Task: Tamper-evident policy governance + reconcile
 
 ```task