Ship WARDEN-WP-0030: delegation register for every catalog lane

Every execution position is now explicit. Catalog entries carry
delegation.mode (permanent / native / interim) with intended owner and
blocker. warden route gaps lists the interim set. Promotion requires
the ownership question. Doctrine lives in AccessRouting.md; the
register was published to the named owner repos.

wiki/AccessRouting.md

@@ -76,6 +76,44 @@ boundary in `OperatorAccessAssist.md`.
 
 ---
 
+## Interim custodianship
+
+ops-warden **works with, and never replaces or duplicates**, the NetKingdom
+components that own identity, custody, authorization, and tenant/user lifecycle
+(`INTENT.md` §9). Covering a gap is legitimate. Silently becoming the owner of
+that gap is not.
+
+The only lane ops-warden executes with its own authority is **SSH issuance**
+(`ssh-cert-host-access`). Every other execution position — including every
+`warden access` proxy — is **interim by default**. A catalog entry without a
+`delegation:` block is treated as interim with an unknown owner: absence is a
+question, not a settlement.
+
+| `delegation.mode` | Meaning |
+| --- | --- |
+| `permanent` | ops-warden is the designed owner of this front door (SSH only, today) |
+| `native` | the intended owner already fronts it; ops-warden routes (and may keep a proxy as fallback) |
+| `interim` | ops-warden covers the gap until `intended_owner` ships the missing front door named in `blocked_on` |
+
+Delegation targets — the components that should own a front door once they have
+one:
+
+| Target | What they should front |
+| --- | --- |
+| **secrets-engine** | owner-native secret-exec (`secrets-engine exec --catalog <id>`) |
+| **tenant-engine** | tenant/client secret custody and tenant-lane front door |
+| **user-engine** | end-user / account-lifecycle secrets that belong with user identity |
+| **railiance-platform** | OpenBao cluster, credential broker, platform workload procedure |
+| **flex-auth** | authorization decisions (already native — ops-warden only points) |
+| **key-cape** | identity login and client-credential protocol (OIDC, `client_secret_basic`) |
+
+Query the register with `warden route gaps`. An interim lane is retired by
+setting `exec_owner` / `exec_command` (the WP-0019 pattern) and flipping
+`delegation.mode` to `native` once the owner's front door is proven. Do not
+delete a working proxy on the way.
+
+---
+
 ## Routing lookup CLI (`warden route`)
 
 Agents and operators query the pointer catalog directly instead of re-deriving
@@ -86,6 +124,7 @@ material.
 ```bash
 warden route list [--json] [--all] [--tag <keyword>]              # active-only unless --all
 warden route list --stale [--stale-days 90] [--all] [--json]    # past review cadence
+warden route gaps [--json] [--all]                              # interim register (owner + blocker)
 warden route show <id> [--json]                                 # owner + pointers; SSH adds steps
 warden route find "<free text need>" [--json] [--all]             # rank by keyword overlap
 ```
@@ -145,6 +184,7 @@ owner repo's shipped path.
 | **On canon change** | When net-kingdom security docs change, review affected `canon_ref` entries immediately |
 | **On owner ship** | When an owning repo merges a new OpenBao path or playbook, promote `draft` → `active` and bump `reviewed` |
 | **On agent confusion** | If `warden route find` misses a common query, add `need_keywords` or a playbook — do not restate owner procedure in the catalog |
+| **On interim review** | Run `warden route gaps` — re-check each `blocked_on` against the intended owner; flip to `native` when their front door exists |
 
 ### Stale check (operators and agents)
 
@@ -177,6 +217,7 @@ moved but anchors still resolve.
 
 - `CredentialRouting.md` — worker decision tree and routing table
 - `NetKingdomSecurityMap.md` — component literacy
-- `INTENT.md` — steward mission ("issue SSH, route the rest")
+- `INTENT.md` — steward mission ("issue SSH, route the rest"); §9 interim custodianship
+- `workplans/WARDEN-WP-0030-delegation-register.md` — delegation register
 - `workplans/WARDEN-WP-0010-access-routing-charter.md` — charter + no-double-source rule
 - `net-kingdom/docs/platform-identity-security-architecture.md` — platform canon