Document scope alignment and warden-sign readiness

docs/ops-warden-routing-contract.md

@@ -1,10 +1,11 @@
 # ops-warden → secrets-engine Routing Contract
 
-ops-warden issues **SSH certificates only**. Every other credential need (API
-keys, provider tokens, DB passwords, npm publish tokens, and OpenBao API token
-lanes) routes to **secrets-engine**, which is OpenBao-backed. ops-warden must
-never request, hold, cache, or vend a raw secret value. A route result is a
-**pointer**, not a key.
+ops-warden issues **SSH certificates only**. Every other credential or scoped
+capability need (API keys, provider tokens, DB passwords, npm publish tokens,
+and OpenBao capability lanes) routes to **secrets-engine**. secrets-engine
+returns non-secret pointers and safe next commands while OpenBao remains the
+custody, policy, lease, and audit backend. ops-warden must never request, hold,
+cache, or vend a raw secret value. A route result is a **pointer**, not a key.
 
 ## What ops-warden calls
 
@@ -49,6 +50,9 @@ secrets-engine route <catalog-id> --json
 - **Actionable when not ready.** If a lane is unapproved, unapplied, or
   unprovisioned, `next_command` + `missing` tell the caller exactly what to do.
 - **Idempotent / read-only.** `route` performs no mutation.
+- **Custody stays in OpenBao.** secrets-engine orchestrates approved issuance,
+  delivery, handoff, verification, and revocation paths; it does not make
+  ops-warden a secret store or token broker.
 
 ## whynot-design retry flow
 

docs/warden-sign-auth-capability.md

@@ -16,6 +16,10 @@ only; the operator receives `role_id` and `secret_id` out-of-band.
 | SSH mount | `ssh` |
 | Policy | `warden-sign` |
 | AppRole | `warden-sign` |
+| OIDC auth mount | `netkingdom` |
+| OIDC role | `warden-sign` |
+| OIDC role path | `auth/netkingdom/role/warden-sign` |
+| OIDC bound group | `net-kingdom-admins` |
 | Token TTL | `15m` |
 | Secret ID TTL | `30m` |
 | Secret ID uses | `1` |
@@ -42,6 +46,60 @@ BAO_ADDR=https://bao.coulomb.social \
 The bootstrap token file must be mode `0600`, revocable, and tracked in
 [hardening-backlog.md](hardening-backlog.md) H0 until revoked and shredded.
 
+## OIDC operator login pointer
+
+For an attended human operator who has `bao` on the workstation, the intended
+narrow login is:
+
+```bash
+bao login -method=oidc -path=netkingdom role=warden-sign
+```
+
+That role lives at `auth/netkingdom/role/warden-sign`, is bound through the
+`groups` claim to `net-kingdom-admins`, and attaches only the `warden-sign`
+policy. It is not the `platform-admin` role and not the whynot-design KV-read
+role.
+
+If the role has not been applied yet, create/update it from an approved OpenBao
+operator context with this non-secret payload:
+
+```json
+{
+  "role_type": "oidc",
+  "allowed_redirect_uris": [
+    "https://bao.coulomb.social/ui/vault/auth/netkingdom/oidc/callback",
+    "http://localhost:8250/oidc/callback",
+    "http://127.0.0.1:8250/oidc/callback"
+  ],
+  "oidc_scopes": ["openid", "profile", "email", "groups"],
+  "user_claim": "sub",
+  "groups_claim": "groups",
+  "bound_claims": {
+    "groups": ["net-kingdom-admins"]
+  },
+  "policies": "warden-sign",
+  "ttl": "15m"
+}
+```
+
+Equivalent CLI path:
+
+```bash
+bao write auth/netkingdom/role/warden-sign @warden-sign-oidc-role.json
+```
+
+After login, verify the token shape without printing the token value:
+
+```bash
+bao token capabilities ssh/sign/agt-role
+bao token capabilities ssh/sign/adm-role
+bao token capabilities ssh/sign/atm-role
+bao token capabilities auth/token/create
+```
+
+The first three should include `update`; the last one should not grant token
+creation/admin capability.
+
 ## Handoff
 
 Mint a fresh single-use AppRole `secret_id` and write both handoff values to