Fix attended login result auditing and reconcile blocked workplans

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a0e6ef-4273-7fc2-8741-dc96b3e5fe0d

src/warden/cli.py

@@ -1212,6 +1212,7 @@ def _access_proxy(
     goes to stderr so --fetch stdout carries only the secret.
     """
     from warden.proxy import (
+        AttendedLoginError,
         ProxyError,
         build_wrapped_fetch,
         caller_auth_present,
@@ -1350,6 +1351,8 @@ def _access_proxy(
         f"[dim]proxy {action}: {entry.id} → {entry.owner_repo} "
         f"(caller identity; value not persisted)[/dim]"
     )
+    rc = 10 if is_login else 5
+    outcome = "login_failed" if is_login else "error"
     try:
         if is_login:
             rc = proxy_attended_login_exec(resolved, child_argv=child_argv)
@@ -1381,9 +1384,12 @@ def _access_proxy(
             rc = 0
         else:
             rc = proxy_fetch(resolved)
+        outcome = "ok" if rc == 0 else "error"
     except ProxyError as e:
+        if isinstance(e, AttendedLoginError):
+            rc, outcome = e.exit_code, e.outcome
         err.print(f"[red]{e}[/red]")
-        raise typer.Exit(5)
+        raise typer.Exit(rc)
     finally:
         try:
             write_audit(
@@ -1393,6 +1399,8 @@ def _access_proxy(
                 domain=domain,
                 action=action,
                 decision_id=decision_id,
+                exit_code=rc,
+                outcome=outcome,
             )
         except OSError as e:
             err.print(f"[yellow]audit write failed:[/yellow] {e}")
@@ -1564,6 +1572,10 @@ def access(
                 f"  {label:<8} : [dim]{proxy} --exec -- <reviewed-command>[/dim]  "
                 "[yellow](contained login + command; output suppressed)[/yellow]"
             )
+            console.print(
+                "  contract : reviewed command must be silent; any stdout/stderr "
+                "fails closed. Redirect both streams inside the reviewed command."
+            )
         else:
             console.print(
                 f"  {label:<8} : [dim]{proxy} --fetch[/dim]  "