CUST-WP-0073: attended cutover steps 1-7 done; record evidence and remaining step 8/9

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/evidence/2026-10-20-railiance01-cutover-steps-2-4.md

@@ -29,3 +29,28 @@ no system:masters; **597/597 checks denied, granted [], undetermined []**. Recei
 `2026-10-20-custodian-agent-kube-denials-receipt.json`. A first run reported 500+ failures that were
 transient request errors through the tunnel (spot checks all answered "no"); the verifier now retries
 errors and reports `granted` separately from `undetermined`, so an error can never read as a pass or a grant.
+
+## Steps 1, 7 (SSH) and host-side proof
+
+- **flex-auth**: `warden sign agt-custodian` was first denied `unknown_actor_resource` (registry baked into
+  the image). access-engine FLEX-WP-0037 (`9132f9b`, `b429dcb`) added the actor; founder-approved
+  `helm upgrade flex-auth-ops-warden` → revision 3, image `sha256:f7c04991…`, 1/1 ready (rollback: revision 2).
+  After upgrade both an existing actor and agt-custodian pass the gate (stop at the Vault token stage).
+- **warden config**: `vault.addr` pointed at `https://bao.coulomb.social`, now an internal-only page (HTTP 404);
+  founder's `~/.config/warden/warden.yaml` switched to the bridge tunnel `http://127.0.0.1:18200` (backup kept).
+- **Stale warden install**: `uv tool install --force` had reused a cached wheel without WARDEN-WP-0045's
+  extension code, so the first certificate (founder-issued via `credential.py exec --grant ops-warden/warden-sign`,
+  valid 2026-10-20T23:16Z–2026-10-21T11:16Z, principal agt-custodian) carried **no extensions** — safe but no pty.
+  Reinstalled editable from the checkout; reissue pending.
+- **Host proof as custodian-agt** (from the custodian-agents distro, certificate login):
+  uid 1001 own group only; `sudo -n` → password required; `/etc/rancher/k3s/{k3s,registries,config}.yaml`
+  unreadable; `/home/tegwick` not searchable; containerd socket not writable; the agent certificate is
+  refused for `tegwick` (Permission denied (publickey)); local forward to 6443 → "administratively prohibited";
+  `ssh -A` gives no SSH_AUTH_SOCK; pty refused (no extension).
+- **Step 1 root cause**: `openbao-apply-ssh-engine.sh` never wrote roles (passed `bao` twice → exit 127,
+  "failed to write role adm-role"); fixed in railiance-platform `4b2b72a`. Founder read the live roles first:
+  adm/agt/atm matched the spec exactly except unset `allowed_extensions`; `default_extensions` empty on all.
+  Founder re-ran the apply; `agt-role` `allowed_extensions` = `permit-pty`.
+- **Reissued certificate** (founder, operator account, warden from checkout): valid 2026-10-20T23:24Z–
+  2026-10-21T11:25Z, principal `agt-custodian`, extensions `permit-pty` only. From the distro: pty session
+  as custodian-agt works; local forward still "administratively prohibited".