Draft the flex-auth envelope-signing credential route.

Pointer-only, warden_executes false. Shape lives in flex-auth;
OpenBao path is not built yet. Testdata keys are not this lane.

Assistant: grok
Assistant-Session: 01a09dc1-b21e-77e1-919e-fcad2f82b267

wiki/playbooks/flex-auth-decision-envelope-signing-key.md

@@ -0,0 +1,35 @@
+# flex-auth decision-envelope signing key
+
+Date: 2026-09-14
+Catalog: `flex-auth-decision-envelope-signing-key` (status `draft` until the OpenBao lane exists)
+Owner of **shape**: `flex-auth` (`docs/decision-envelope-signature.md`)
+Owner of **key material**: OpenBao / `railiance-platform` — flex-auth does not mint this key
+
+Detached Ed25519 key used to sign `flex-auth.decision-record.v1` envelopes so a
+stored allow remains attributable after the HTTP connection is gone
+(`FLEX-WP-0024`, `FLEX-DEC-2026-010`).
+
+**This lane is a pointer.** ops-warden routes it and executes nothing.
+
+**Ask first:** `warden plan "decision envelope signing key" --json`.
+
+---
+
+## Worker checklist
+
+1. Do **not** generate a key in `flex-auth` or paste a seed into Git, State Hub, or chat.
+2. The proposed KV path is `platform/workloads/flex-auth/envelope-signing`.
+   Fields: `ED25519_PRIVATE_KEY` (secret), `ED25519_PUBLIC_KEY` and `kid` (public).
+3. flex-auth loads the private key the same way it loads TokenReview credentials.
+   With no key configured it emits `signature.mode=unsigned`.
+4. Consumers verify with `kid` against the published public key list, not a pinned
+   single key. Rotation overlap is the allow TTL (default 15m) plus a short margin.
+
+## Verify (capabilities-safe)
+
+```bash
+bao token capabilities <lane-token> platform/data/workloads/flex-auth/envelope-signing
+# expect: read on the workload identity; deny for unrelated paths
+```
+
+Do not print the private field.