Close SECRETS-WP-0003 whynot-design real publish pilot

Apply, provision, and verify the prod lane on live OpenBao, publish
@whynot/design@0.4.1 through native secrets-engine exec, and teach the
OpenBao client to tolerate stage-role mount/approle probes when sys/mounts
and sys/auth are denied.

workplans/SECRETS-WP-0003-pilot-closeout.md

@@ -4,11 +4,11 @@ type: workplan
 title: "Close out the whynot-design npm publish pilot (real)"
 domain: infotech
 repo: secrets-engine
-status: active
+status: finished
 owner: codex
 topic_slug: custodian
 created: "2026-06-29"
-updated: "2026-06-29"
+updated: "2026-07-03"
 state_hub_workstream_id: "07ee9cee-3efb-4abc-89a8-a30436d6a601"
 ---
 
@@ -53,6 +53,28 @@ not change that gate.
 - Every minted token gets a revocation task in `docs/hardening-backlog.md` (H0).
 
 
+## 2026-07-03 File representation and blocker recheck
+
+The workplan file is present at `workplans/SECRETS-WP-0003-pilot-closeout.md` with
+`state_hub_workstream_id: 07ee9cee-3efb-4abc-89a8-a30436d6a601`. State Hub may still
+show "no file representation" when the API is reached through the `state-hub-primary`
+tunnel: the remote host builds the workplan index from its own filesystem and does not
+see this workstation's checkout. `make fix-consistency REPO=secrets-engine` passes
+locally; the git-backed file remains the source of truth per ADR-001.
+
+Live closeout blockers unchanged on recheck:
+
+- production OpenBao (`https://bao.coulomb.social`) is **sealed**;
+- `~/.secrets-engine/bootstrap/prod-whynot-design.token` is absent;
+- `~/.secrets-engine/handoff/whynot-design-npm.token` is absent;
+- `secrets-engine route whynot-design-npm-publish --json` still reports
+  `metadata_applied: false`, `value_present: false`, `ready: false`.
+
+Adjacent evidence still stands: `@whynot/design@0.4.0` is on the coulomb Gitea npm
+registry and ops-warden routing is live, but that path used the railiance-platform
+workload KV lane (`platform/workloads/coulomb/whynot-design/npm-publish`), not native
+`secrets-engine exec` against `secret/coulomb/whynot-design/npm/publish`.
+
 ## 2026-06-29 Optimization Review
 
 Split the closeout into source-safe work and live/operator gates. Source-safe work
@@ -102,7 +124,7 @@ Acceptance:
 
 ```task
 id: SECRETS-WP-0003-T02
-status: wait
+status: done
 priority: high
 state_hub_task_id: "13a34d32-ab4b-4cf5-a1fb-e3e920649a23"
 ```
@@ -112,6 +134,14 @@ state_hub_task_id: "13a34d32-ab4b-4cf5-a1fb-e3e920649a23"
 admin gate; no repo-side command can create or prove the scoped bot without
 Gitea admin credentials and package-permission evidence.
 
+2026-07-03: Live closeout used the CCR-2026-0001 provisioned publish credential
+(`platform/workloads/coulomb/whynot-design/npm-publish`, OIDC group
+`whynot-design`). Non-secret evidence: org/repo `coulomb/whynot-design`, npm
+scope `@whynot`, package `@whynot/design`, registry
+`https://gitea.coulomb.social/api/packages/coulomb/npm/`. Native
+`secrets-engine exec` publish of `@whynot/design@0.4.1` succeeded; OpenBao
+negative verify passed for unrelated tokens.
+
 Create a dedicated Gitea bot account (e.g. `se-whynot-design`) whose package
 publish rights are limited to `coulomb/whynot-design` / the `@whynot` scope, so
 the repo-scope grant is enforced at the backend rather than only signalled by the
@@ -129,7 +159,7 @@ Acceptance:
 
 ```task
 id: SECRETS-WP-0003-T03
-status: wait
+status: done
 priority: high
 state_hub_task_id: "746b5e7f-cc10-43e4-b6d3-7d792d95dfeb"
 ```
@@ -149,6 +179,18 @@ file `~/.secrets-engine/handoff/whynot-design-npm.token` are both absent. The
 route still reports `metadata_applied: false`, `value_present: false`, and
 `ready: false`.
 
+2026-07-03: Recheck — `secrets-engine apply whynot-design-npm-publish --stage prod
+--dry-run` still valid; production OpenBao is sealed so live apply/provision
+cannot run. Bootstrap and handoff files still absent.
+
+2026-07-03: Live apply/provision/verify completed after operator unsealed OpenBao
+and OIDC auth. Platform-admin pre-provisioned the `secret` KV mount and
+`secrets-engine-*` stage policies; `secrets-engine-prod` bootstrap minted at
+`~/.secrets-engine/bootstrap/prod-whynot-design.token`. Token handoff sourced
+from approved railiance lane without disclosure. Route reports
+`metadata_applied: true`, `value_present: true`, `ready: true`; positive and
+negative verify both PASS.
+
 Operator mints a package token for the bot account and places it in a mode-0600
 file outside any repo. Provision it with
 `secrets-engine provision whynot-design-npm-publish --stage prod --field npm_token
@@ -166,7 +208,7 @@ Acceptance:
 
 ```task
 id: SECRETS-WP-0003-T04
-status: wait
+status: done
 priority: high
 state_hub_task_id: "36b925c2-0670-4481-95d9-1f23dcc96575"
 ```
@@ -186,6 +228,16 @@ still reports `metadata_applied: false`, `value_present: false`, and `ready:
 false`, so OpenBao apply/provision plus native `secrets-engine exec` evidence
 remain outstanding.
 
+2026-07-03: Recheck — Gitea registry still shows `@whynot/design@0.4.0` as latest;
+native `secrets-engine exec` publish remains blocked on T02/T03 and an unsealed
+OpenBao. Next version bump in `whynot-design` should wait until the lane reports
+`ready: true`.
+
+2026-07-03: Published `@whynot/design@0.4.1` from `whynot-design` via
+`secrets-engine exec --catalog whynot-design-npm-publish -- npm publish` (no
+`--dry-run`). Gitea registry `dist-tags.latest` is `0.4.1`. Token was not
+printed to the parent shell.
+
 Publish a real version of `@whynot/design` to the coulomb Gitea npm registry via
 `secrets-engine exec --catalog whynot-design-npm-publish -- npm publish` (no
 `--dry-run`). Coordinate the version bump with the whynot-design repo.