SCOPE/docs: WARDEN-WP-0045 per-actor limits; OpenBao via bridge tunnel; editable install

Record the per-actor extension allow-list and max_ttl_hours ceiling with the
agt-custodian profile. Point production examples at the ops-bridge OpenBao
tunnel (127.0.0.1:18200) now that bao.coulomb.social is no longer public, and
document the editable install.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 605711@bnt-lap001
Assistant-Session: 1f5e2256-181f-49ed-b7b1-a1c34bf37a61

README.md

@@ -64,6 +64,13 @@ uv sync
 uv tool install . --with-editable ../phase-memory --force
 ```
 
+For a working checkout, an editable install keeps the `warden` CLI in step
+with `git pull`. This avoids stale-wheel builds:
+
+```bash
+uv tool install -e . --with-editable ../phase-memory --force
+```
+
 Or run without installing:
 
 ```bash

SCOPE.md

@@ -21,8 +21,9 @@ access guidance aligned with NetKingdom canon.
 
 ops-warden **issues short-lived SSH certificates and routes every other credential
 need to the subsystem that owns it.** SSH signing is **production-verified** on
-Railiance OpenBao (`warden sign` against `https://bao.coulomb.social`, host CA trust
-deployed).
+Railiance OpenBao (`warden sign`, host CA trust deployed). Since public
+`bao.coulomb.social` was retired, production signing reaches OpenBao through
+the ops-bridge tunnel (`http://127.0.0.1:18200`).
 
 **Access routing** is shipped: `wiki/AccessRouting.md`, credential routing wiki,
 NetKingdom security map, machine-readable pointer catalog
@@ -414,6 +415,11 @@ Remaining production distance is also in other repos' lanes (see Known gaps).
   repos' lanes (and retiring interim covers as those owners ship front doors)
 - **Integration docs:** cert_command migration, token hygiene (broker-first), principals
   drift (`wiki/playbooks/`)
+- **Per-actor issuance limits:** WARDEN-WP-0045. The issuance contract carries a
+  per-actor extension allow-list and a `max_ttl_hours` ceiling. The new profile
+  `agt-custodian` (12h, `permit-pty` only) has the attended lane
+  `agt-custodian-ssh-cert`. Its first issuance was done by the founder on
+  2026-10-20 for the supervised interactive agents (CUST-WP-0073).
 - **Latest assessment:** `history/2026-08-11-delegation-surface-assessment.md`
 - **Latest workplans:** WP-0029 (policy front door) shipped July 2026; WP-0030
   (delegation register) shipped August 2026
@@ -478,7 +484,9 @@ type: security
 title: SSH certificate issuance
 description: Issues short-lived CA-signed SSH certificates for adm/agt/atm actors via a
   pluggable cert_command interface; documents NetKingdom operational access routing;
-  supports local CA and OpenBao/Vault-compatible SSH engine backends.
+  supports local CA and OpenBao/Vault-compatible SSH engine backends. Per-actor
+  extension allow-lists and max_ttl_hours ceilings bound each profile (e.g.
+  agt-custodian: 12h, permit-pty only).
 keywords: [ssh, certificate, ca, credential, warden, ops-warden, pki, openbao, vault, netkingdom]
 ```
 

examples/warden.production.example.yaml

@@ -4,7 +4,9 @@
 backend: vault
 
 vault:
-  addr: https://bao.coulomb.social
+  # OpenBao via the ops-bridge tunnel (railiance01). bao.coulomb.social is no
+  # longer public; it serves a notice, not the API.
+  addr: http://127.0.0.1:18200
   mount: ssh
   role_map:
     adm: adm-role

registry/capabilities/capability.security.ssh-certificate-issuance.md

@@ -45,6 +45,7 @@ external_evidence:
     - principals inventory and cert-side scorecard
     - signatures audit log and stale-cert cleanup
     - cert_command stdout contract for ops-bridge
+    - per-actor extension allow-list and max_ttl_hours ceiling (WARDEN-WP-0045)
     broken_expectations:
     - host-side principal deployment not owned here
     - OpenBao SSH engine mount not deployed from this repo

registry/indexes/capabilities.yaml

@@ -1,5 +1,5 @@
 version: 1
-updated: '2026-10-14'
+updated: '2026-10-21'
 domain: helix_forge
 capabilities:
 - id: capability.security.ssh-certificate-issuance

wiki/OpenBaoSshEngineChecklist.md

@@ -14,7 +14,7 @@ Cluster bootstrap and unseal are **not** ops-warden scope — see
 - [ ] `bao status` reports initialized and **unsealed**
 - [ ] Operator has **scoped token** — not root token in `VAULT_TOKEN` for daily warden use
 - [ ] `warden.yaml` points `vault.addr` at correct endpoint:
-  - Workstation: `https://bao.coulomb.social`
+  - Workstation: `http://127.0.0.1:18200` (ops-bridge tunnel; public `bao.coulomb.social` is retired)
   - In-cluster: `http://openbao.openbao.svc.cluster.local:8200`
 - [ ] Actor exists in inventory — `wiki/ActorInventoryPatterns.md`
 - [ ] Test pubkey available (mode 600 private key, never commit)
@@ -87,7 +87,7 @@ path "ssh/sign/agt-role" {
 ```yaml
 backend: vault
 vault:
-  addr: https://bao.coulomb.social
+  addr: http://127.0.0.1:18200  # ops-bridge tunnel
   mount: ssh
   role_map:
     adm: adm-role

wiki/OpsWardenConfig.md

@@ -79,8 +79,10 @@ engine that implements the Vault signing API (`POST /v1/<mount>/sign/<role>`).
 backend: vault
 
 vault:
-  # OpenBao UI/API (KeyCape OIDC). Prefer short-lived tokens from policy, not root.
-  addr: https://bao.coulomb.social
+  # OpenBao API through the ops-bridge tunnel (railiance01). The public
+  # https://bao.coulomb.social endpoint is retired and serves a notice only.
+  # Prefer short-lived tokens from policy, not root.
+  addr: http://127.0.0.1:18200
 
   mount: ssh
 

wiki/playbooks/reuse-surface-hub-write-token.md

@@ -15,7 +15,7 @@ ops-warden does not vend this token — custody belongs to `railiance-platform`
 
 | Field | Value |
 | --- | --- |
-| OpenBao server | `https://bao.coulomb.social` (railiance01, `92.205.62.239`) |
+| OpenBao server | railiance01 (`92.205.62.239`); operator access via the ops-bridge tunnel `http://127.0.0.1:18200` — public `bao.coulomb.social` is retired |
 | KV path | `platform/workloads/reuse/reuse-surface/runtime-secrets` |
 | Hub write field | `REUSE_SURFACE_TOKEN` |
 | Webhook HMAC field | `REUSE_SURFACE_FORGEJO_WEBHOOK_SECRET` |