Harden production authorization and service auth

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a0217e-8c4c-7383-be6b-f50a6e485306

docs/hardening-backlog.md

@@ -31,8 +31,11 @@ contents in this repo.
 
 ## H1 — Replace bootstrap token files with OIDC / service auth
 
-- Stand up an OpenBao auth method (OIDC or AppRole bound to a workload identity)
-  for each stage role.
+- Implemented consumer scaffold: exact KeyCape client-credentials exchange,
+  claim/lifetime preflight, strict client-secret file input, renewal boundary,
+  and no implicit fallback.
+- Remaining: railiance-platform stands up the exact-bound OpenBao JWT auth
+  mount/role and publishes its non-secret connection contract.
 - secrets-engine logs in via that method instead of reading a token file.
 - Remove `--bootstrap-token-file` from the steady-state path (keep only for true
   break-glass, heavily audited).
@@ -44,8 +47,11 @@ contents in this repo.
 
 ## H3 — Production dual-control
 
-- Require two-person approval (`approval.model: dual-control`) for prod value
-  provisioning before automating raw-value writes beyond the pilot.
+- Implemented consumer validator: exact action request, decision digest/binding,
+  validity, State Hub provenance, and caller-selected minimum distinct approval
+  count.
+- Remaining: State Hub stores/serves the durable object and production handlers
+  resolve it; all production live actions currently fail closed.
 
 ## H4 — Rotation & lifecycle states
 
@@ -59,7 +65,9 @@ contents in this repo.
 
 - Implemented: `secrets-engine audit <catalog-id>` summarizes allowlisted local
   action/result, decision, session-cleanup, and State Hub delivery evidence.
-- Remaining: durable/queued State Hub delivery and OpenBao audit request-id
+- Implemented: idempotency/source headers and edge-relay queued-receipt/outbox-id
+  visibility.
+- Remaining: operator replay verification and OpenBao audit request-id
   correlation.
 
 ## H6 — API service mode