CCR-2026-0002/0003 approved + applied via constrained applier; WP-0008 finished, WP-0009/0010 advanced

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

workplans/RAILIANCE-WP-0008-openbao-approved-automation-delegation.md

@@ -4,7 +4,7 @@ type: workplan
 title: "OpenBao Approved Automation Delegation"
 domain: financials
 repo: railiance-platform
-status: active
+status: finished
 owner: codex
 topic_slug: railiance
 planning_priority: high
@@ -173,7 +173,7 @@ credential-tests` passed with 28 tests.
 
 ```task
 id: RAILIANCE-WP-0008-T03
-status: progress
+status: done
 priority: medium
 state_hub_task_id: "ff927a19-50fb-4351-8db1-c60a0cce0995"
 ```
@@ -302,3 +302,24 @@ CCR.
   requirements.
 - CCR approval, apply, verification, and front-door activation form one
   reviewable chain.
+
+
+## Completion 2026-07-02 — T03 live probe and workplan finish
+
+T03 closed with live positive and negative evidence from a
+`credential-change-nonprod-applier` child token (accessor
+`pCznHtid1O0vy36QHqMbzu5Y`, revoked after use):
+
+- allowed: `policy_write workload-kv-read-nonprod-probe-test` (test artifact
+  deleted afterwards by the operator session) and `policy_read
+  workload-kv-read-issue-core-runtime`;
+- denied: `policy_read platform-admin`, out-of-pattern `policy_write
+  evil-probe-test`, KV secret read on the issue-core path, and
+  `auth/token/roles/credential-change-nonprod-applier` write;
+- all recorded in `/openbao/audit/openbao-audit.log` (2026-07-02T10:09Z
+  window).
+
+The production applier path was proven the same day: both `CCR-2026-0002`
+and `CCR-2026-0003` were applied with a `credential-change-prod-applier`
+child token holding only that policy — no `platform-admin` handoff. All
+tasks are done; the workplan is finished.