Close ADHOC-2026-08-11: hand warden-sign AppRole to WP-0027

T03 stays parked (neither apply nor withdraw). Neither un-park trigger has
fired, so the ad-hoc is finished and WP-0027 T02 owns the question.

workplans/WARDEN-WP-0027-credential-governance-lockdown.md

@@ -10,7 +10,7 @@ topic_slug: custodian
 planning_priority: medium
 planning_order: 27
 created: "2026-07-16"
-updated: "2026-07-17"
+updated: "2026-08-15"
 state_hub_workstream_id: "7d697c52-766a-4562-b2ad-a722880bcdcb"
 ---
 
@@ -113,9 +113,9 @@ founder OIDC act. Whether a second autonomous path should exist — and whether
 the AppRole or something this trust-root design supersedes — is a break-glass
 question, not a routing one. Resolve it here. Context and the counter-argument
 (AppRole is narrower in capability than placing the broker's issuer token on a remote
-host) are in `workplans/ADHOC-2026-08-11.md` T03; secrets-engine was told to stop
-holding apply readiness until this task or the ops-bridge cutover fires
-(msg `863c7b57`).
+host) are in `workplans/ADHOC-2026-08-11.md` T03 (ad-hoc **finished** 2026-08-15;
+question lives here now); secrets-engine was told to stop holding apply
+readiness until this task or the ops-bridge cutover fires (msg `863c7b57`).
 
 ## Task: Tamper-evident policy governance + reconcile
 
@@ -143,6 +143,7 @@ manifest, and an attended reconcile can restore it.
 - `.claude/rules/credential-routing.md` — ops-warden custodies no secret values
 - `railiance-platform` — OpenBao cluster, policy custody, credential broker
 - `wiki/AccessRouting.md` — issue vs route vs assist boundary
-- `workplans/ADHOC-2026-08-11.md` T03 — parked warden-sign AppRole; un-parks on this
-  workplan's break-glass task or the ops-bridge cert_command cutover
+- `workplans/ADHOC-2026-08-11.md` T03 — parked warden-sign AppRole (ad-hoc finished
+  2026-08-15); un-parks on this workplan's break-glass task or the ops-bridge
+  cert_command cutover
 - `secrets-engine` `SECRETS-WP-0004` — the parked AppRole apply/handoff