Add credential-change delegated applier flow

workplans/RAILIANCE-WP-0008-openbao-approved-automation-delegation.md

@@ -10,7 +10,7 @@ topic_slug: railiance
 planning_priority: high
 planning_order: 8
 created: "2026-06-28"
-updated: "2026-06-28"
+updated: "2026-06-30"
 depends_on_workplans:
   - RAIL-PL-WP-0002
   - RAILIANCE-WP-0005
@@ -114,7 +114,7 @@ and the local applier script.
 
 ```task
 id: RAILIANCE-WP-0008-T01
-status: todo
+status: done
 priority: high
 state_hub_task_id: "d19fdfc5-addb-4813-8086-3aca2e948cea"
 ```
@@ -129,11 +129,20 @@ Acceptance:
 - The proposal covers both workload KV read lanes and credential broker issuer
   policies.
 
+**2026-06-29:** Added `docs/openbao-approved-automation-delegation.md` and
+`openbao/policies/credential-change-prod-applier.hcl`. The document defines
+build/development, test/staging, and production boundaries, the allowed
+production metadata mutation surface, denied secret/admin paths, and required
+non-secret evidence. The production policy candidate allows only reviewed
+metadata writes for workload KV read policies, credential-broker issuer
+policies, approved auth-role prefixes, and self capability checks; it does not
+grant secret value reads or writes.
+
 ## T02 - Implement a CCR-aware applier dry-run
 
 ```task
 id: RAILIANCE-WP-0008-T02
-status: todo
+status: done
 priority: high
 state_hub_task_id: "2613f40d-fbd9-44f3-a864-85ec1d54e8f7"
 ```
@@ -149,11 +158,22 @@ Acceptance:
 - Dry-run refuses attempts to create `root`, `platform-admin`, wildcard, or
   unrelated policy names.
 
+**2026-06-29:** Added `scripts/credential-change.py applier-dry-run <CCR>` and
+Make target `credential-change-applier-dry-run`. The dry-run validates the CCR,
+requires approved/applied/verified/active status, requires confirmed auth
+bindings, verifies the OpenBao mount/path/policy/role stay inside the delegated
+metadata surface, compares the policy artifact to the generated CCR policy body,
+and renders only policy/auth-role mutations. It explicitly leaves secret value
+writes, secret reads, and front-door activation out of scope. Unit tests cover
+the active whynot-design CCR success path, unapproved CCR refusal, and rejection
+of `platform-admin`/out-of-scope mount and path attempts. `make
+credential-tests` passed with 28 tests.
+
 ## T03 - Add non-production applier role first
 
 ```task
 id: RAILIANCE-WP-0008-T03
-status: todo
+status: progress
 priority: medium
 state_hub_task_id: "ff927a19-50fb-4351-8db1-c60a0cce0995"
 ```
@@ -167,11 +187,32 @@ Acceptance:
 - Negative checks prove unrelated policy/auth/secret paths are denied.
 - Evidence is recorded without secret values.
 
+**2026-06-30:** Added the non-production metadata-only policy candidate
+`openbao/policies/credential-change-nonprod-applier.hcl` and documented that
+generated test-secret paths require separate CCR-backed approval. Live non-prod
+identity creation and positive/negative OpenBao evidence remain to close this
+task.
+
+**2026-06-30:** Added the guarded `applier-apply` execution path that reuses the
+CCR dry-run guardrails, requires exact `DELEGATED APPLY <CCR-ID>` confirmation,
+uses the local `bao` CLI with ambient delegated applier authority, writes only
+policy/auth-role metadata, and records non-secret `delegated_metadata_apply`
+evidence. Non-production task closure still needs a live build/test applier
+identity plus positive and negative capability evidence.
+
+**2026-06-30:** Added `scripts/openbao-apply-credential-change-appliers.py` and
+Make target `openbao-credential-change-appliers-dry-run` to install/dry-run the
+non-production applier policy plus bounded `auth/token/roles/credential-change-
+nonprod-applier` role. The token role allows only the matching applier policy,
+disallows `root` and `platform-admin`, disables the default policy, and does not
+issue tokens by itself. Live non-production apply and denial evidence remains
+the closeout gate.
+
 ## T04 - Add production metadata applier with human approval gate
 
 ```task
 id: RAILIANCE-WP-0008-T04
-status: todo
+status: progress
 priority: high
 state_hub_task_id: "414abd65-22d3-420f-994d-f7fdd1302db5"
 ```
@@ -185,6 +226,29 @@ Acceptance:
 - Unapproved CCRs fail closed.
 - Secret value provisioning is still not automated in production.
 
+**2026-06-30:** Strengthened the production gate by adding source-artifact
+checks to the CCR applier dry-run and documenting that unapproved CCRs fail
+closed before OpenBao mutation rendering. The production policy candidate exists
+and remains metadata-only; live delegated identity creation/application evidence
+still needs an operator-held OpenBao step.
+
+**2026-06-30:** Added `applier-apply` and Make targets
+`credential-change-applier-apply-plan` / `credential-change-applier-apply`. The
+command fails closed for unapproved CCRs, renders the dry-run payload before
+mutation, requires exact confirmation, does not accept tokens in argv, leaves
+secret values out of scope, and appends State Hub/file-backed non-secret apply
+evidence when requested. Production closure still requires live execution using
+the constrained applier identity rather than broad `platform-admin`.
+
+**2026-06-30:** Added `scripts/openbao-apply-credential-change-appliers.py` and
+Make targets `openbao-credential-change-appliers-dry-run` /
+`openbao-configure-credential-change-appliers` to configure the production
+`credential-change-prod-applier` policy and bounded token role. The role allows
+only `credential-change-prod-applier`, disallows `root` and `platform-admin`,
+uses service tokens, disables default policy attachment, and keeps token issuance
+outside the setup script. Production closure still needs a live run and
+capability evidence using this constrained identity.
+
 ## T05 - Close the whynot-design pilot
 
 ```task