From cdb44a8f23abf5ddd7927272b851a4d01b94bfbb Mon Sep 17 00:00:00 2001
From: tegwick <bernd.worsch@gmail.com>
Date: Sat, 22 Aug 2026 22:38:00 +0200
Subject: [PATCH] docs: project WP0027 infra review contract

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a0290b-3241-74c3-b868-6049545af836
---
 ...T02-DRILL-20260822-01-railiance-infra.json | 67 +++++++++++++++++++
 ...-WP-0027-credential-governance-lockdown.md |  7 ++
 2 files changed, 74 insertions(+)
 create mode 100644 interfaces/reviews/WARDEN-WP-0027-T02-DRILL-20260822-01-railiance-infra.json

diff --git a/interfaces/reviews/WARDEN-WP-0027-T02-DRILL-20260822-01-railiance-infra.json b/interfaces/reviews/WARDEN-WP-0027-T02-DRILL-20260822-01-railiance-infra.json
new file mode 100644
index 0000000..1eb023d
--- /dev/null
+++ b/interfaces/reviews/WARDEN-WP-0027-T02-DRILL-20260822-01-railiance-infra.json
@@ -0,0 +1,67 @@
+{
+  "schema_version": "review-contract/v1",
+  "contract_key": "WARDEN-WP-0027-T02-DRILL-20260822-01-INFRA",
+  "subject": {
+    "kind": "task",
+    "id": "WARDEN-WP-0027-T02"
+  },
+  "scenario_id": "WARDEN-WP-0027-T02-DRILL-20260822-01",
+  "expires_at": "2026-08-23T20:00:00Z",
+  "authorizes_execution": false,
+  "evidence_boundary": "metadata_only",
+  "allowed_dispositions": [
+    "approve",
+    "request_changes"
+  ],
+  "artifacts": {
+    "docs/evidence/WARDEN-WP-0027-T02-drill-scenario-2026-08-22.md": {
+      "algorithm": "sha256",
+      "digest": "ffa69764ad391db633f57ac70444e5781eee698bf9e362dfef31614fa43152dc"
+    }
+  },
+  "owners": [
+    {
+      "id": "railiance-infra",
+      "artifact_ids": [
+        "docs/evidence/WARDEN-WP-0027-T02-drill-scenario-2026-08-22.md"
+      ],
+      "assertions": [
+        {
+          "id": "scenario-and-expiry-bound",
+          "statement": "This receipt applies only to scenario WARDEN-WP-0027-T02-DRILL-20260822-01 and expires at 2026-08-23T20:00:00Z."
+        },
+        {
+          "id": "provider-console-access-explicit",
+          "statement": "railiance-infra has independently verified provider-console access; it is not inferred from SSH, Warden, or cluster reachability."
+        },
+        {
+          "id": "distinct-abort-authority-accepted",
+          "statement": "railiance-infra accepts the distinct abort-authority role for this scenario and its bounded live window."
+        },
+        {
+          "id": "metadata-only-evidence",
+          "statement": "The receipt and its checks disclose no credential, token, recovery share, secret value, value-derived fingerprint, or provider-console detail."
+        },
+        {
+          "id": "execution-not-authorized",
+          "statement": "Approval is owner coordination evidence only and authorizes no console action, reboot, OpenBao seal or unseal, or other live execution."
+        }
+      ],
+      "check_ids": [
+        "scenario-artifact-sha256",
+        "provider-console-access-attestation",
+        "distinct-abort-role-attestation",
+        "metadata-only-boundary"
+      ]
+    }
+  ],
+  "gates": [
+    {
+      "id": "WARDEN-WP-0027-T02-DRILL-20260822-01-INFRA",
+      "policy": "all_required",
+      "owners": [
+        "railiance-infra"
+      ]
+    }
+  ]
+}
diff --git a/workplans/WARDEN-WP-0027-credential-governance-lockdown.md b/workplans/WARDEN-WP-0027-credential-governance-lockdown.md
index c9f5fce..785a954 100644
--- a/workplans/WARDEN-WP-0027-credential-governance-lockdown.md
+++ b/workplans/WARDEN-WP-0027-credential-governance-lockdown.md
@@ -170,6 +170,13 @@ and railiance-master is asked only for a metadata-only 2-of-3 availability
 attestation. All three owner receipts and a green fully parameterized preflight
 are required before the final operator question.
 
+The railiance-infra role is scoped by the authoritative review contract
+`WARDEN-WP-0027-T02-DRILL-20260822-01-INFRA` in
+`interfaces/reviews/WARDEN-WP-0027-T02-DRILL-20260822-01-railiance-infra.json`.
+It binds the exact scenario artifact and expiry, requires explicit independent
+provider-console and distinct-abort attestations, permits metadata-only evidence,
+and states `authorizes_execution: false`.
+
 ## Task: Tamper-evident policy governance + reconcile
 
 ```task