RPF-WP-0035-T14: flex-auth signer custody founder gate, runbook and review dispositions

- CCR-2026-0050: record secrets-engine-owner approval (two receipt conditions)
  and platform runbook review; link founder decision 18731e84.
- Attended creation runbook with preconditions, rollback and negatives.
- Warden routing receipt: openbao-platform-admin-login / oidc_login now selected.
- Native adapter: owner-review digest excludes expires_at so reviews can precede
  the 120 s window (close-down checklist row 27).
Nothing generated, written or applied.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 809600@bnt-lap001
Assistant-Session: 40ba228f-c8a0-4ec9-bb29-3129951afdc4

scripts/flex_auth_signer_native.py

@@ -72,6 +72,14 @@ def parsed(raw):
     except Exception:raise Refused('invalid closed JSON input') from None
 
 
+def review_scope_digest(value):
+    """Owner reviews bind the exact action scope minus the reviews themselves and the
+    invocation-time expiry. The 5..120s expiry stays enforced separately; binding it
+    into the reviewed digest made five asynchronous reviews impossible to collect
+    inside the attended window (2026-10-21 build-mode fix, close-down checklist)."""
+    return digest(encoded({k:v for k,v in value.items() if k not in {'owner_reviews','expires_at'}}))
+
+
 def validate_admission(value):
     fields={'schema','action','operation_id','kid','expires_at','founder_entity_id','ccr_sha256','source_bundle','bindings',
             'producer_image','caller_binding','deployment_projection_sha256','authority','routing','owner_reviews',
@@ -93,7 +101,7 @@ def validate_admission(value):
             is_digest(review['approved_admission_sha256']) and type(review['approval_ref']) is str and
             0<len(review['approval_ref'])<=200,'exact external review required')
     # Dispositions bind a claim-free scope digest, avoiding self-referential JSON.
-    scope={k:v for k,v in value.items() if k!='owner_reviews'};scope_digest=digest(encoded(scope))
+    scope_digest=review_scope_digest(value)
     require(all(x['approved_admission_sha256']==scope_digest for x in reviews.values()),'owner review scope mismatch')
     require(type(value['source_bundle']) is dict and set(value['source_bundle'])==SOURCE_FILES and
             all(is_digest(x) for x in value['source_bundle'].values()),'exact execution source bundle required')