WARDEN-WP-0029: implement plan front door, org posture, desk, freshness

Ship posture-aware access planning: organization_posture=build (axis C),
catalog freshness warnings, warden plan verdicts, localhost founder desk,
and playbook/agent guidance that retire /tmp file-drop patterns.

Compose route catalog + handoff rather than a second routing layer.

wiki/playbooks/forgejo-admin-api-token.md

@@ -1,6 +1,6 @@
 # Forgejo Admin API Token (PAT)
 
-Date: 2026-07-12 (verified 2026-07-13)  
+Date: 2026-07-12 (verified 2026-07-13; file-drop retired 2026-07-18, WARDEN-WP-0029 T04)  
 Catalog: `forgejo-admin-api-token` (status `active`, `resolvable: true`)  
 Owner: `railiance-platform` (CCR-2026-0006)
 
@@ -8,6 +8,9 @@ Forgejo site-admin personal access token for operator and automation tooling.
 Sibling to `forgejo-mailer` (SMTP via ESO); phase 1 is workstation + activity-core
 worker fetch only — no cluster ExternalSecret delivery.
 
+**Ask first:** `warden plan "forgejo admin api token" --json` — agents must not
+draft founder credential steps without a plan verdict.
+
 ---
 
 ## OpenBao pointers
@@ -31,30 +34,41 @@ worker fetch only — no cluster ExternalSecret delivery.
 
 ## Worker checklist
 
-1. **Login** (caller identity — ops-warden adds no credential):
+1. **Plan** (agents — always):
 
    ```bash
-   bao login -method=oidc -path=netkingdom role=forgejo-admin-workload-kv-read
+   warden plan "forgejo admin api token" --json
+   # expect verdict=autonomous, lane=forgejo-admin-api-token
    ```
 
-2. **Export for a Forgejo API run** (value streams to your shell — never paste into chat):
+2. **Login** if needed (caller identity — ops-warden adds no credential):
 
    ```bash
-   export FORGEJO_ADMIN_TOKEN=$(
-     bao kv get -field=API_TOKEN platform/workloads/forgejo/forgejo-admin
-   )
+   warden plan "oidc login forgejo admin" --json
+   # or: bao login -method=oidc -path=netkingdom role=forgejo-admin-workload-kv-read
    ```
 
-3. **Or proxy via warden access** (catalog lane is `active`):
+3. **Use the token via sanctioned transports** (never file-drop steady state):
 
    ```bash
-   warden access forgejo-admin-api-token --no-policy --fetch --field API_TOKEN
+   # Preferred: inject into child only
+   warden access forgejo-admin-api-token --exec --field API_TOKEN -- \
+     env | grep -c FORGEJO   # example; real consumers use the env name they need
+
+   # Or write mode-0600 for a single tool invocation (you own deletion)
+   warden access forgejo-admin-api-token --out "$XDG_RUNTIME_DIR/forgejo-admin.token" --field API_TOKEN
+
+   # Or wrapping token (unwrap in your own context)
+   warden access forgejo-admin-api-token --wrap
    ```
 
-4. **Run consumers**:
+   High-risk lane: with `WARDEN_AGENT_ID` set, raw stdout fetch is refused —
+   use `--out` / `--exec` / `--wrap` only.
+
+4. **Run consumers** (railiance-platform / railiance-apps — keep env out of chat):
 
    ```bash
-   # Package prune (railiance-platform)
+   # Package prune (railiance-platform) — prefer credential exec / warden access --exec
    make forgejo-package-prune-dry-run
    make forgejo-package-prune
 
@@ -64,27 +78,33 @@ worker fetch only — no cluster ExternalSecret delivery.
    make reuse-forgejo-webhook
    ```
 
-5. **Retire workstation file drop** once downstream `load_token()` paths read
-   OpenBao when env is unset:
+**Retired steady-state paths (do not use):**
 
-   - `/tmp/forgejo-tegwick-api-token` — legacy; do not use as steady state
-   - `FORGEJO_ADMIN_TOKEN` env — acceptable for one-off sessions after fetch
+- `/tmp/forgejo-tegwick-api-token` — legacy file drop
+- Pasting the PAT into chat, workplans, or shell history
+
+`FORGEJO_ADMIN_TOKEN` in the process environment is acceptable only as a
+short-lived injection via `--exec` (or equivalent owner-native exec), not as a
+durable workstation file.
 
 ---
 
-## Operator provisioning (attended)
+## Operator provisioning (attended founder act)
 
-After CCR approval and policy apply:
+After CCR approval and policy apply — **one founder act**, not agent file drops:
 
 1. Forgejo UI: `tegwick` → Settings → Applications → Generate New Token
-2. Store in OpenBao (do not echo the value):
+2. Store via desk paste-once (preferred) or platform helper:
 
    ```bash
-   # PAT in a mode-0600 single-line file — never on argv
-   install -m 600 /dev/null /tmp/forgejo-admin-pat.input
-   # paste token into the file, then:
-   ~/railiance-platform/scripts/forgejo-admin-pat-provision.sh /tmp/forgejo-admin-pat.input
-   shred -u /tmp/forgejo-admin-pat.input
+   # Preferred: plan + desk (value never in shell history)
+   warden plan "provision forgejo admin api token" --json > /tmp/plan-forgejo.json
+   warden desk --plan-json /tmp/plan-forgejo.json \
+     --path platform/workloads/forgejo/forgejo-admin --field API_TOKEN
+   # shred plan file (metadata only, but still): shred -u /tmp/plan-forgejo.json
+
+   # Alternative: platform provision script (stdin/file owned by operator)
+   ~/railiance-platform/scripts/forgejo-admin-pat-provision.sh <mode-0600-input-file>
    ```
 
 3. Verify field presence without printing values:
@@ -114,22 +134,26 @@ bao token capabilities "$DEFAULT_TOKEN" platform/data/workloads/forgejo/forgejo-
 #   → expect: deny
 ```
 
-Confirming the PAT works against Forgejo is a separate, value-using action — fetch
-`--field API_TOKEN` into an env var and call `/api/v1/user`; never paste the token.
+Confirming the PAT works against Forgejo is a separate, value-using action — use
+`warden access … --exec` and call `/api/v1/user`; never paste the token.
 
 ---
 
 ## Consumers (downstream wiring — after lane verified)
 
-| Consumer | Repo |
-| --- | --- |
-| `tools/cmd/forgejo-package-prune` | `railiance-platform` |
-| `weekly-forgejo-package-prune` activity | `activity-core` |
-| `forgejo-operator-bootstrap`, `forgejo-npm-smoke`, `reuse-forgejo-webhook` | `railiance-apps` |
+| Consumer | Repo | Notes |
+| --- | --- | --- |
+| `tools/cmd/forgejo-package-prune` | `railiance-platform` | Prefer OpenBao / `warden access --exec`; no `/tmp` token file |
+| `weekly-forgejo-package-prune` activity | `activity-core` | |
+| `forgejo-operator-bootstrap`, `forgejo-npm-smoke`, `reuse-forgejo-webhook` | `railiance-apps` | |
+| binky-control cutover | `binky-control` | Use `warden plan` for deploy-key / admin needs; no founder file drops |
 
 Docs: `railiance-platform/docs/forgejo-package-prune.md`,
 `railiance-apps/docs/forgejo-on-railiance01.md`.
 
+**Cross-repo follow-up (WP-0029 T04):** update consumer docs that still mention
+`/tmp/forgejo-tegwick-api-token` to `warden access` / credential exec.
+
 ---
 
 ## See also
@@ -137,4 +161,5 @@ Docs: `railiance-platform/docs/forgejo-package-prune.md`,
 - `railiance-platform/credential-change-requests/CCR-2026-0006-forgejo-admin-api-token-lane.yaml`
 - `railiance-platform/openbao/policies/workload-kv-read-forgejo-admin.hcl`
 - `wiki/playbooks/railiance-backup-offsite-lane.md` (OIDC workstation read pattern)
-- `forgejo-mailer` lane — SMTP only; unchanged
+- `forgejo-mailer` lane — SMTP only; unchanged
+- WARDEN-WP-0029 — `warden plan` / `warden desk`