RPF-WP-0035-T14: flex-auth signer custody founder gate, runbook and review dispositions

- CCR-2026-0050: record secrets-engine-owner approval (two receipt conditions)
  and platform runbook review; link founder decision 18731e84.
- Attended creation runbook with preconditions, rollback and negatives.
- Warden routing receipt: openbao-platform-admin-login / oidc_login now selected.
- Native adapter: owner-review digest excludes expires_at so reviews can precede
  the 120 s window (close-down checklist row 27).
Nothing generated, written or applied.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 809600@bnt-lap001
Assistant-Session: 40ba228f-c8a0-4ec9-bb29-3129951afdc4

credential-change-requests/CCR-2026-0050-flex-auth-envelope-signing.yaml

@@ -5,7 +5,7 @@ request_type: workload-kv-read
 title: Retained flex-auth lifecycle PDP Ed25519 seed ESO read lane
 status: proposed
 created: '2026-10-16'
-updated: '2026-10-16'
+updated: '2026-10-21'
 requester:
   agent: railiance-platform
   reason: CUST-WP-0080 / RPF-WP-0035-T12 / FLEX-WP-0024-T06 source proposal. Exact
@@ -23,6 +23,12 @@ review:
   - reviewer: railiance-platform-owner (agent railiance-platform, codex)
     decision: approved
     comment: "INTENT Secure Custody/Stable Interfaces/Operable and Observable; RPF-WP-0035-T12. Approved Platform source/plan review only for frozen P4 manifest sha256:9eec861838a8e9138f2c821cff3014998fbe74bb01447642bf50d44e8b3b7cb3 and R2 manifest sha256:5be7a7f438624dcb35b7dbc96e7c9e5a8e2d5d1b1966cb4338aa5aecbe3a8b59; own bounded review artifact docs/evidence/2026-10-16-flex-auth-native-plan-review.json; sanitized supplement sha256:f02a9b595d9246a358d19b37bdad8fde158b7f0c9657a6ff088874732511a32c. Exact read policy/role/ESO proposal and one-use CAS0 writer stay separate. Identified manual Applications and recovery gates are mandatory. No founder decision, native execution, confirmed bindings or completed admission assent; current proposed status unchanged."
+  - reviewer: secrets-engine-owner (agent secrets-engine, hub message e73c9ffc-8a6d-4a17-9604-84324c678dc0)
+    decision: approved
+    comment: "2026-10-21, consumer side only. Consumer has no KV read role and receives no seed; public trust is admitted through a founder ssh-keygen -Y signed trust file (secrets-engine ebd8e49, docs/founder-admission.md, SECRETS-WP-0014-T04, decision e4eee965). Conditions: (1) the public receipt (kid, Ed25519 public key as 43-char unpadded base64url, evaluator/mode/policy_package/policy_version/policy_package_digest) is emitted by the attended writer at creation time or derived from its public output, never from a later read of the KV document; (2) the receipt carries the KV version and source/image provenance hashes. Not founder approval, native execution or a binding."
+  - reviewer: railiance-platform-owner (agent railiance-platform, claude)
+    decision: approved
+    comment: "2026-10-21 runbook review: docs/runbooks/flex-auth-envelope-signing-attended-creation.md prepared. Secrets condition 1 is met for kid/public key/fingerprint/kv_version/source/image hashes by deriving the consumer receipt from the writer receipt (no KV read); the evaluator/mode/policy_package/policy_version/policy_package_digest fields are not in the writer receipt and must come from Access's published pin. Review-scope digest no longer binds expires_at so owner reviews can precede the 120 s window. Pending: access-engine-owner (awaited), cluster-runtime-storage-owner (railiance-cluster, requested f8b4b229), founder. Nothing executed."
 target:
   domain: infotech
   tenant: platform
@@ -135,4 +141,6 @@ lifecycle:
     compromised seed; archive historical public keys for offline audit only.
 state_hub:
   workplan_id: RPF-WP-0035
-  task_id: RPF-WP-0035-T12
+  task_id: RPF-WP-0035-T14
+  decision_id: 18731e84-a6ab-4ac5-bf0e-7e7c3a9c4508
+  decision_api_url: http://127.0.0.1:8000/decisions/18731e84-a6ab-4ac5-bf0e-7e7c3a9c4508