Close warden-sign token lane

docs/hardening-backlog.md

@@ -14,13 +14,14 @@ Every minted bootstrap token has a revocation task. Track each here:
 | Token file | Stage | Minted | TTL | Revoked? |
 | --- | --- | --- | --- | --- |
 | `~/.secrets-engine/bootstrap/prod.token` | prod | (n/a — demo uses dev server) | 1h | n/a |
-| `~/.secrets-engine/bootstrap/prod-warden-sign.token` | prod | pending SECRETS-WP-0004 live apply | 1h | pending |
+| `~/.secrets-engine/bootstrap/prod-warden-sign.token` | prod | SECRETS-WP-0004 live lane applied via attended operator flow; file use not recorded in repo | 1h | cleanup/revocation evidence not recorded |
 | `~/.secrets-engine/bootstrap/prod-whynot-design.token` | prod | pending SECRETS-WP-0003 live apply/provision | 1h | pending |
 
 Revoke: `bao token revoke -accessor <accessor>` then `shred -u <file>`.
-For SECRETS-WP-0004, revoke the scoped `warden-sign` token/accessor after the
+For SECRETS-WP-0004, the scoped `warden-sign` token used for the 2026-06-29
-FLEX-WP-0007 T4 smoke or when its `15m` TTL expires, and remove the handoff
+smoke had a `15m` TTL; explicit accessor revocation and handoff-file cleanup are
-files under `~/.secrets-engine/handoff/`.
+operator-side hygiene if any material remains. Do not record accessors or file
+contents in this repo.
 
 ## H0a — Revoke pilot workload tokens
 

docs/warden-sign-auth-capability.md

@@ -198,3 +198,14 @@ BAO_ADDR=https://bao.coulomb.social \
   secrets-engine revoke warden-sign \
   --bootstrap-token-file ~/.secrets-engine/bootstrap/prod-warden-sign.token
 ```
+
+## Closeout status
+
+On 2026-06-29 ops-warden reported the joint production smoke as passed against
+the flex-auth runtime and production OpenBao. Non-secret evidence only:
+`warden sign agt-state-hub-bridge` returned policy decision
+`decision:032b096c433ad80c`, `--ttl 999` was denied with
+`ttl_out_of_bounds` before OpenBao signing, and the vault-backed allow path used
+the scoped `warden-sign` lane. `policy.enabled` remains off until the ecosystem
+moves from build-stage/pre-testing into the maturity posture where live
+enforcement is appropriate.

workplans/SECRETS-WP-0004-warden-sign-token-lane.md

@@ -4,11 +4,11 @@ type: workplan
 title: "Provision a scoped warden-sign token lane (ops-warden / FLEX-WP-0007 T4)"
 domain: infotech
 repo: secrets-engine
-status: active
+status: finished
 owner: codex
 topic_slug: custodian
 created: "2026-06-29"
-updated: "2026-06-29"
+updated: "2026-06-30"
 state_hub_workstream_id: "eb1bdff7-909c-4391-8b95-6baf1feb3a54"
 ---
 
@@ -23,7 +23,8 @@ narrow capability), not a KV value. Post the non-secret pointers to State Hub an
 hand the token/secret_id to the operator out-of-band.
 
 This unblocks FLEX-WP-0007 T4 (the joint OpenBao + policy-gate production smoke),
-after which `policy.enabled: true` can go live on CoulombCore.
+after which the verified gate can be banked until `policy.enabled: true`
+is appropriate for the ecosystem maturity stage.
 
 ## Context
 
@@ -113,7 +114,7 @@ Acceptance:
 
 ```task
 id: SECRETS-WP-0004-T03
-status: wait
+status: done
 priority: high
 state_hub_task_id: "4b414788-d670-496b-9c57-074464a012c4"
 ```
@@ -136,9 +137,18 @@ missing lane decision or the documented bootstrap handoff.
 2026-06-30: Approval mirror `.decisions/SECRETS-WP-0004.yaml` is now present
 and `secrets-engine route warden-sign --json` reports `decision_status:
 resolved` for canonical decision `4589dcb7-c0df-4073-9a0b-4f80a0fcdb93`.
-Readiness remains false because the OpenBao `warden-sign` policy/AppRole has
+Readiness remained false at that checkpoint because the OpenBao `warden-sign`
-not been applied (`metadata_applied: false`), and the documented lane bootstrap
+policy/AppRole had not yet been applied (`metadata_applied: false`), and the
-token file is still absent. Live apply and handoff were not executed.
+documented lane bootstrap token file was still absent. Live apply and handoff
+were not executed in that checkpoint.
+
+2026-06-30 closeout: ops-warden later reported that production OpenBao was
+unsealed, the secrets-engine `warden-sign` lane was applied, and a scoped
+AppRole token with `ssh/sign/agt-role` update capability was verified through
+the vault-backed smoke. No token value, role_id, secret_id, token accessor, or
+raw smoke log is recorded here. The documented bootstrap-token file path remains
+part of the hardening/audit backlog, but live lane metadata is no longer the
+blocker.
 
 Apply the policy + AppRole on `https://bao.coulomb.social` using a mode-0600
 bootstrap token stored outside any repo. Idempotent re-apply.
@@ -154,7 +164,7 @@ Acceptance:
 
 ```task
 id: SECRETS-WP-0004-T04
-status: wait
+status: done
 priority: high
 state_hub_task_id: "52b5cf88-029f-4f4b-8fe9-0a8dc30378b5"
 ```
@@ -186,6 +196,13 @@ so handoff is waiting on live OpenBao apply plus an attended, out-of-band
 bootstrap path. No `role_id`, `secret_id`, token value, token accessor, or
 smoke output was written to Git or State Hub.
 
+2026-06-30 closeout: the scoped warden-sign handoff path was exercised by the
+operator/ops-warden outside Git and State Hub. The only recorded evidence is the
+non-secret result: the vault-backed smoke used backend `vault` and policy
+decision `decision:032b096c433ad80c`. `policy.enabled` is intentionally left off
+until testing/production maturity; that is a separate operator posture decision,
+not an unfinished secrets-engine handoff.
+
 Define and execute the handoff: mint a fresh `secret_id`, deliver it (with the
 `role_id`) to the operator out-of-band; warden does `approle login` to obtain a
 `VAULT_TOKEN`. Post the non-secret pointers on the ops-warden thread (policy name,
@@ -202,14 +219,22 @@ Acceptance:
 
 ```task
 id: SECRETS-WP-0004-T05
-status: wait
+status: done
 priority: medium
 state_hub_task_id: "aa0f281e-976d-4fcd-b8a3-78582117f86f"
 ```
 
 2026-06-29: Offline tests pass (`59 passed, 2 skipped`) and route/dry-run CLI
 checks produce non-secret pointers. Joint production smoke and ops-warden signal
-remain waiting on live OpenBao apply, handoff, and operator-run smoke evidence.
+remained waiting on live OpenBao apply, handoff, and operator-run smoke evidence
+at that checkpoint.
+
+2026-06-30 closeout: ops-warden reported the joint smoke passed with non-secret
+evidence only: allow path `warden sign agt-state-hub-bridge` returned
+policy_decision_id `decision:032b096c433ad80c`, excessive TTL `--ttl 999` was
+rejected with `ttl_out_of_bounds` before OpenBao, and the vault-backed allow path
+used the scoped warden-sign lane. flex-auth closed `FLEX-WP-0007-T04` from this
+evidence, so secrets-engine can close the credential/capability lane too.
 
 Confirm the unblock end to end, then reply to ops-warden (msg 077ac90d) with the
 pointers and runbook alignment. The reply is the explicit "we will signal
@@ -231,3 +256,16 @@ Acceptance:
   external condition).
 - ops-warden has the non-secret pointers; no secret value crossed State Hub.
 - The bootstrap token and the minted credential have revocation tasks.
+
+
+## Closeout Evidence
+
+2026-06-30: SECRETS-WP-0004 is finished from the same non-secret smoke evidence
+used to close `FLEX-WP-0007-T04`:
+
+- `warden-sign` policy/AppRole lane applied in production OpenBao after operator unseal.
+- Scoped token capability verified for `ssh/sign/agt-role` update during the vault-backed smoke.
+- Allow smoke: `warden sign agt-state-hub-bridge` -> `decision:032b096c433ad80c`.
+- Deny smoke: `--ttl 999` -> `ttl_out_of_bounds` before OpenBao signing.
+- No raw token, AppRole `secret_id`, `role_id`, token accessor, or smoke log was written to Git, State Hub, prompts, chat, or normal logs.
+- `policy.enabled` remains off by build-stage maturity decision and can be flipped later by the ops-warden operator when testing/production posture requires live enforcement.