docs: close Warden credential workplans

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a058f3-8ba0-7692-a042-9a870fc3d663

workplans/WARDEN-WP-0035-policy-nexus-forgejo-source-read-route.md

@@ -4,7 +4,7 @@ type: workplan
 title: "Register the Policy Nexus Forgejo source-read route"
 domain: infotech
 repo: ops-warden
-status: active
+status: finished
 owner: codex
 topic_slug: policy-nexus-forgejo-source-read
 created: "2026-09-01"
@@ -27,10 +27,17 @@ resolvable while remaining subject to Warden's high-risk agent read boundary.
 
 ```task
 id: WARDEN-WP-0035-T02
-status: progress
+status: done
 priority: high
 ```
 
 Pass catalog, route-selection, proxy, and policy tests; reinstall the CLI; prove
 the installed route resolves and can hand the value only to a sanctioned child
 transport without printing or persisting it.
+
+Completed 2026-09-01. All 406 selected tests passed, including the generated
+high-risk data-path boundary. The no-cache installed CLI resolves the exact
+lane, and `warden plan` returns only sanctioned `--exec`, `--out`, and `--wrap`
+transports for an agent caller. Policy Nexus Actions run 32 separately proved
+the installed credential against the complete private-source fetch and release
+path without exposing the value.

workplans/WARDEN-WP-0036-attended-login-openbao-output.md

@@ -1,5 +1,5 @@
 ---
-id: WARDEN-WP-0034
+id: WARDEN-WP-0036
 type: workplan
 title: "Accept contained OpenBao login output only after helper persistence"
 domain: infotech
@@ -14,7 +14,7 @@ updated: "2026-09-01"
 ## Repair attended-login handoff
 
 ```task
-id: WARDEN-WP-0034-T01
+id: WARDEN-WP-0036-T01
 status: done
 priority: high
 ```
@@ -27,7 +27,7 @@ failure.
 ## Verify live contained operation
 
 ```task
-id: WARDEN-WP-0034-T02
+id: WARDEN-WP-0036-T02
 status: done
 priority: high
 ```