Draft the flex-auth envelope-signing credential route.

Pointer-only, warden_executes false. Shape lives in flex-auth;
OpenBao path is not built yet. Testdata keys are not this lane.

Assistant: grok
Assistant-Session: 01a09dc1-b21e-77e1-919e-fcad2f82b267

registry/routing/catalog.yaml

@@ -684,6 +684,29 @@ entries:
         - "Verify capabilities-safe on the data path (`bao token capabilities`); run a restore drill against a re-encrypted artifact."
         - "After rotation, clear EXPOSED taint: remove custom_metadata exposed_at/exposed_version (see `warden taint railiance-backup-offsite-lane`)."
 
+  - id: flex-auth-decision-envelope-signing-key
+    title: Ed25519 key that signs flex-auth decision envelopes
+    risk: high
+    workload_ref:
+      applicability: applicable
+      unknown_reason: "flex-auth has not published an authoritative workload identity declaration for envelope signing."
+    need_keywords: [flex-auth, decision, envelope, signing, signature, ed25519, responder, authenticity, FLEX-WP-0024]
+    owner_repo: railiance-platform
+    subsystem: OpenBao + flex-auth
+    warden_executes: false
+    wiki_ref: wiki/playbooks/flex-auth-decision-envelope-signing-key.md#worker-checklist
+    canon_ref: flex-auth/docs/decision-envelope-signature.md
+    reviewed: "2026-09-14"
+    status: draft
+    delegation:
+      mode: interim
+      intended_owner: railiance-platform
+      blocked_on: "Shape is chosen in flex-auth (FLEX-WP-0024-T02). OpenBao KV path, Kubernetes auth role, and paste_once_provision of the private seed are not built. Testdata key in flex-auth is not this lane."
+      reviewed: "2026-09-14"
+      verified: unverified
+    auth_method: "Kubernetes auth from the flex-auth pin (to be bound); not a static secret in git"
+    path_template: "platform/workloads/flex-auth/envelope-signing (fields ED25519_PRIVATE_KEY, ED25519_PUBLIC_KEY, kid)"
+
   - id: state-hub-forge-derivation-read
     title: Forgejo read-only token for State Hub projection derivation
     risk: high