SCOPE: CUST-WP-0073 T02/T04 done; interactive agents isolated as custodian-agt

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

SCOPE.md

@@ -89,13 +89,21 @@ their own repositories and are referenced here only as integration pointers.
 
 - Status: active coordination and source tooling. `CUST-WP-0071` retains
   representative pilot acceptance, allocation review and weekly execution;
-  `CUST-WP-0073` retains actual interactive credential isolation and its
-  documentation; `CUST-WP-0079` retains schedule activation, policy publication,
+  `CUST-WP-0073` is blocked only on the founder-triggered rotation (T05);
+  `CUST-WP-0079` retains schedule activation, policy publication,
   fleet history acceptance and attended actions. Consult their task blocks for
   current gates. `CUST-WP-0076` and `CUST-WP-0080` are finished; later architecture
   and hardening work is tracked in `CUST-WP-0081` and `CUST-WP-0082`.
   Source preparation and owner integration can proceed independently of attended
   acceptance; a blocked acceptance gate does not imply absent implementation.
+- Interactive credential isolation (`CUST-WP-0073`; T02 and T04 done
+  2026-10-20). Codex, Claude Code and Grok Build run in the WSL2 distro
+  `custodian-agents` as `custodian-agt`. They hold only short-lived credentials
+  that the founder issues: a 24h ServiceAccount token
+  (`custodian-agents/custodian-agent`, curated read) and a 12h `agt-custodian`
+  SSH certificate (`permit-pty` only). Privileged actions go through
+  gated-executor on railiance01 under exact founder approval. Evidence is under
+  `docs/evidence/2026-10-20-*`.
 - Cross-domain work driven from here but owned elsewhere: forge closure
   (prj-forgejo-org-refactor `ORGREF-WP-0002`; decision record
   `decisions/forge-visibility-policy.md`) and the SecurityCaseType model
@@ -236,6 +244,13 @@ description: scripts/summarize_agent_supervision.py reports acceptance and verif
 keywords: [agents, supervision, evidence, approvals]
 ```
 
+```capability
+type: tool
+title: Attended agent credential issuance and denial verification
+description: docs/changes/CUST-WP-0073/workstation-agents-r4/issue-agent-credentials.sh lets the founder issue an interactive agent a 24h curated-read ServiceAccount token and a 12h permit-pty-only agt-custodian SSH certificate. docs/changes/CUST-WP-0073/credential-boundary-r1/verify_agent_denials.py probes Kubernetes denials from the agent's own account, retries errors and reports granted and undetermined results separately. Attended use only; grants no authority.
+keywords: [agents, credentials, isolation, rbac, ssh-certificate, verification]
+```
+
 These local discovery descriptions are not publication grants. The federated
 `registry/indexes/capabilities.yaml` deliberately exposes only generic runtime
 and repository classification tooling. Confidential canon, memory, operational