Close ADHOC-2026-08-11: hand warden-sign AppRole to WP-0027

T03 stays parked (neither apply nor withdraw). Neither un-park trigger has
fired, so the ad-hoc is finished and WP-0027 T02 owns the question.

wiki/playbooks/ops-bridge-tunnel-cert.md

@@ -71,9 +71,10 @@ Confirm exit 0 and cert line starts with `ssh-ed25519-cert-v01@openssh.com`.
 > tunnel host**, which is an open question, not an oversight: running the broker there
 > requires placing the railiance-platform checkout and its *issuer* token on that host.
 > A narrower alternative — a `warden-sign` AppRole scoped to `ssh/sign/{agt,adm,atm}-role`
-> — is validated but **parked** (`workplans/ADHOC-2026-08-11.md` T03, secrets-engine
+> — is validated but **parked** on `WARDEN-WP-0027` T02 (break-glass / trust-root;
-> `SECRETS-WP-0004`). **Resolve the token source before the live cutover**; do not
+> closed out of `workplans/ADHOC-2026-08-11.md` T03). secrets-engine
-> default to a long-lived exported token on the tunnel host.
+> `SECRETS-WP-0004` holds the dry-run only. **Resolve the token source before the
+> live cutover**; do not default to a long-lived exported token on the tunnel host.
 
 ---
 

workplans/ADHOC-2026-08-11.md

@@ -4,11 +4,11 @@ type: workplan
 title: "Ad Hoc Tasks — 2026-08-11"
 domain: infotech
 repo: ops-warden
-status: active
+status: finished
 owner: claude
 topic_slug: custodian
 created: "2026-08-11"
-updated: "2026-08-11"
+updated: "2026-08-15"
 state_hub_workstream_id: "c8c51e07-f42d-43b1-873f-fec6cda7ed25"
 ---
 
@@ -74,7 +74,7 @@ read. Inbox is now empty.
 
 ```task
 id: ADHOC-2026-08-11-T03
-status: wait
+status: done
 priority: medium
 state_hub_task_id: "b930df62-b8dd-45ae-b0a5-98298cdfa1b6"
 ```
@@ -124,5 +124,22 @@ No circular dependency exists today: OpenBao is a public endpoint
 
 Cheap to reverse: the secrets-engine dry-run plan is validated, re-runnable, and correct
 as drafted. The two operator gates (SECRETS-WP-0004 decision, mode-0600 lane bootstrap
-token) are deliberately *not* being satisfied while parked. Task stays `wait` until a
+token) are deliberately *not* being satisfied while parked.
-trigger fires.
+
+**Closed 2026-08-15.** Neither un-park trigger has fired:
+
+1. `WARDEN-WP-0027` is still `backlog`; T02 (graded lockdown / break-glass) stays
+   `cancel` with the workplan. The parked AppRole remains an input on that task.
+2. ops-bridge live cert_command cutover has not reached unattended signing on a
+   remote host. WP-0016 is finished as *pilot-ready and handed off*, not migrated.
+
+This ad-hoc's job was the operator question (withdraw vs keep). The 2026-08-11
+answer stands: **neither — park and hand off**. Applying or withdrawing the
+AppRole is out of scope here and would re-open the operator gates that were
+deliberately left unsatisfied. Long-term ownership is `WARDEN-WP-0027-T02`
+(and the ops-bridge cutover if that arrives first). secrets-engine already has
+the park instruction (msg `863c7b57`); no new apply/withdraw ask.
+
+- [x] Park decision recorded and communicated (2026-08-11)
+- [x] Ownership transferred to `WARDEN-WP-0027` T02; playbook pointer updated
+- [x] Ad-hoc closed so a `wait` item does not linger past the handoff

workplans/WARDEN-WP-0027-credential-governance-lockdown.md

@@ -10,7 +10,7 @@ topic_slug: custodian
 planning_priority: medium
 planning_order: 27
 created: "2026-07-16"
-updated: "2026-07-17"
+updated: "2026-08-15"
 state_hub_workstream_id: "7d697c52-766a-4562-b2ad-a722880bcdcb"
 ---
 
@@ -113,9 +113,9 @@ founder OIDC act. Whether a second autonomous path should exist — and whether
 the AppRole or something this trust-root design supersedes — is a break-glass
 question, not a routing one. Resolve it here. Context and the counter-argument
 (AppRole is narrower in capability than placing the broker's issuer token on a remote
-host) are in `workplans/ADHOC-2026-08-11.md` T03; secrets-engine was told to stop
+host) are in `workplans/ADHOC-2026-08-11.md` T03 (ad-hoc **finished** 2026-08-15;
-holding apply readiness until this task or the ops-bridge cutover fires
+question lives here now); secrets-engine was told to stop holding apply
-(msg `863c7b57`).
+readiness until this task or the ops-bridge cutover fires (msg `863c7b57`).
 
 ## Task: Tamper-evident policy governance + reconcile
 
@@ -143,6 +143,7 @@ manifest, and an attended reconcile can restore it.
 - `.claude/rules/credential-routing.md` — ops-warden custodies no secret values
 - `railiance-platform` — OpenBao cluster, policy custody, credential broker
 - `wiki/AccessRouting.md` — issue vs route vs assist boundary
-- `workplans/ADHOC-2026-08-11.md` T03 — parked warden-sign AppRole; un-parks on this
+- `workplans/ADHOC-2026-08-11.md` T03 — parked warden-sign AppRole (ad-hoc finished
-  workplan's break-glass task or the ops-bridge cert_command cutover
+  2026-08-15); un-parks on this workplan's break-glass task or the ops-bridge
+  cert_command cutover
 - `secrets-engine` `SECRETS-WP-0004` — the parked AppRole apply/handoff