Close ops-warden policy gate deployment

docs/ops-warden-policy-gate-handoff.md

@@ -102,3 +102,13 @@ Production actor coverage now verifies agt-state-hub-bridge,
 agt-codex-interhub-bootstrap, adm-example, atm-backup-daily, ttl_out_of_bounds,
 unknown_actor_resource, and the iam:agt-state-hub-bridge subject path used by
 WARDEN_POLICY_SUBJECT.
+
+## FLEX-WP-0007 Closeout Update
+
+On 2026-06-29 ops-warden reported the production policy-gate smoke as passed
+against the deployed flex-auth runtime at `127.0.0.1:18090` from CoulombCore.
+Non-secret evidence: allow decision `decision:032b096c433ad80c` for
+`agt-state-hub-bridge`, deny reason `ttl_out_of_bounds` for an excessive TTL,
+and backend `vault` for the scoped OpenBao signing path. The operator is
+keeping `policy.enabled` off during build-stage/pre-testing; this is a maturity
+posture decision, not a missing flex-auth artifact.

docs/workplan-planning-map.md

@@ -1,6 +1,6 @@
 # Flex-Auth Workplan Planning Map
 
-Date: 2026-06-23
+Date: 2026-06-30
 
 ## Purpose
 
@@ -25,7 +25,7 @@ This document captures the current sequencing view for flex-auth workplans.
 | `FLEX-WP-0003` | complete | completed | `FLEX-WP-0002` | Markitect consumer integration and first CARING benchmark are complete: resource namespace, manifest import, action vocabulary, descriptor fixtures, decision fixtures, integration docs. |
 | `FLEX-WP-0004` | complete | completed | `FLEX-WP-0002`, `FLEX-WP-0005` | Delegated PDP and directory adapter boundary work is complete: Topaz adapter shape, OpenFGA/SpiceDB, OPA/Cedar, Keycloak Authorization Services, Entra/Graph/SCIM, CARING envelope preservation. |
 | `FLEX-WP-0006` | complete | finished | `FLEX-WP-0002`, `FLEX-WP-0005` | Ops-warden unblocker is complete: flex-auth publishes `ssh-certificate` / `sign` policies, fixtures, and `/v1/check` smoke evidence for the opt-in pre-sign gate shipped in ops-warden `WARDEN-WP-0007` and tracked for production in `WARDEN-WP-0009`. |
-| `FLEX-WP-0007` | `P0` | blocked | `FLEX-WP-0006` | Repo-side production registry fixture, sync contract, runtime command, healthz coverage, and real actor/IAM tests are implemented. Operator deployment and OpenBao smoke remain blocked on reachable runtime selection and scoped VAULT_TOKEN refresh. |
+| `FLEX-WP-0007` | complete | finished | `FLEX-WP-0006` | Production registry fixture, sync contract, runtime command, healthz coverage, real actor/IAM tests, operator tunnel reachability, and vault-backed joint smoke are complete. `policy.enabled` remains off by maturity decision until testing/production posture calls for live enforcement. |
 
 ## Dependency Notes
 
@@ -80,6 +80,7 @@ Native State Hub dependency edges:
 - `FLEX-WP-0004 -> FLEX-WP-0005` (Topaz adapter consumes the spike)
 - `FLEX-WP-0006 -> FLEX-WP-0002`
 - `FLEX-WP-0006 -> FLEX-WP-0005`
-- ops-warden: `WARDEN-WP-0009` finished (caller + registry smoke). Production
+- ops-warden: `WARDEN-WP-0009` finished (caller + registry smoke). FLEX-WP-0007
-  `policy.enabled: true` waits for `FLEX-WP-0007` (reachable flex-auth runtime).
+  is also finished; production `policy.enabled: true` waits for a later
+  maturity/posture decision, not for repo-side flex-auth artifacts.
 - `FLEX-WP-0007 -> FLEX-WP-0006`

workplans/FLEX-WP-0007-ops-warden-policy-gate-production-deployment.md

@@ -4,7 +4,7 @@ type: workplan
 title: "Ops-Warden Policy Gate Production Deployment"
 domain: infotech
 repo: flex-auth
-status: blocked
+status: finished
 owner: codex
 topic_slug: flex-auth
 planning_priority: P0
@@ -14,7 +14,7 @@ depends_on_workplans:
 related_workplans:
   - WARDEN-WP-0009
 created: "2026-06-23"
-updated: "2026-06-23"
+updated: "2026-06-30"
 state_hub_workstream_id: "358ce697-2611-4fe9-89ab-63e86ceb00fa"
 ---
 
@@ -25,21 +25,22 @@ state_hub_workstream_id: "358ce697-2611-4fe9-89ab-63e86ceb00fa"
 Deploy flex-auth as a reachable production runtime for ops-warden's opt-in SSH
 signing policy gate, load a production registry aligned with real inventory
 actors, and complete joint smoke evidence so operators can set policy.enabled:
-true in warden.yaml.
+true in warden.yaml when the ecosystem maturity stage calls for live enforcement.
 
 Review update: repo-side production readiness is now separated from
 operator-only work. flex-auth can publish the production fixture, tests,
 runtime command, and sync contract in this repo. The actual stable URL
-deployment and OpenBao smoke remain blocked because they need NetKingdom
+deployment and OpenBao smoke were completed through the operator tunnel and a
-reachability and a refreshed scoped VAULT_TOKEN.
+scoped warden-sign OpenBao lane. The final `policy.enabled` production flip is
+explicitly deferred until the ecosystem reaches testing/production maturity.
 
 ## Background
 
 ops-warden finished WARDEN-WP-0009 on the caller side: local and
 production-registry smoke passed, and the production registry generator exists.
 The remaining risk is operational, not policy shape: warden workstations need a
-reachable flex-auth URL, and the vault-backed joint smoke needs a valid scoped
+reachable flex-auth URL and a vault-backed joint smoke before the gate can be
-VAULT_TOKEN.
+banked for later enforcement.
 
 Production registry artifacts:
 
@@ -130,7 +131,7 @@ repos.
 
 ```task
 id: FLEX-WP-0007-T04
-status: wait
+status: done
 priority: medium
 state_hub_task_id: "32a96f1c-e0e8-4e27-baa6-7b8c445cf7a1"
 ```
@@ -139,14 +140,16 @@ Coordinate with ops-warden for vault-backed signing through the deployed
 flex-auth runtime.
 
 - [x] flex-auth deployed with production registry via operator tunnel, completing T1
-- [ ] ops-warden policy.enabled: true and policy.flex_auth_url points to deployed URL http://127.0.0.1:18090 on CoulombCore
+- [x] policy.flex_auth_url validated against deployed URL http://127.0.0.1:18090 on CoulombCore; `policy.enabled` intentionally remains off until testing/production maturity
-- [ ] Valid scoped VAULT_TOKEN with warden-sign policy, operator-provided
+- [x] Scoped warden-sign OpenBao lane available for the smoke; no token value recorded here
-- [ ] Allow smoke: warden sign agt-state-hub-bridge records backend vault and policy_decision_id
+- [x] Allow smoke: `warden sign agt-state-hub-bridge` recorded backend `vault` and policy_decision_id `decision:032b096c433ad80c`
-- [ ] Deny smoke: TTL above registry max is denied by flex-auth before OpenBao
+- [x] Deny smoke: TTL above registry max was denied by flex-auth before OpenBao with reason `ttl_out_of_bounds`
-- [ ] Record non-secret evidence: decision ids, reasons, actor names only
+- [x] Record non-secret evidence: decision ids, reasons, actor names only
 
-Blocked on: scoped VAULT_TOKEN refresh. Previous ops-warden session returned
+Closed on 2026-06-30 from ops-warden non-secret smoke evidence received
-HTTP 403 on 2026-06-23; no VAULT_TOKEN is present in this session.
+2026-06-29. The operator deliberately keeps `policy.enabled` off for now because
+the ecosystem is still build-stage/pre-testing; the gate is verified and banked
+for later live enforcement rather than forced into premature production rigor.
 
 Smoke runner when token is valid:
 
@@ -176,8 +179,8 @@ required beyond existing policy behavior.
 - flex-auth production runtime reachable from CoulombCore warden path: done via flex-auth-coulombcore operator tunnel
 - Production registry loaded and real inventory actors covered locally: done
 - Registry sync contract published and cross-linked: done
-- Joint vault-backed smoke evidence recorded, or T4 explicitly waits on token: T4 waits on scoped VAULT_TOKEN
+- Joint vault-backed smoke evidence recorded: done, decision:032b096c433ad80c
-- ops-warden operator has the repo-side artifacts needed to set policy.enabled: true after the stable URL and token are ready
+- ops-warden operator has the repo-side artifacts needed to set policy.enabled: true later, when maturity posture calls for live enforcement
 
 ## Implementation Notes
 
@@ -187,9 +190,10 @@ required beyond existing policy behavior.
 - Added Go coverage for production actor allows, IAM subject allow, ttl_out_of_bounds, unknown_actor_resource, production registry counts, and /healthz.
 - Published docs/ops-warden-registry-sync.md and cross-linked it from the handoff and examples docs.
 
-Remaining blocked work:
+Closeout note:
 
-- Operator refreshes scoped VAULT_TOKEN and reruns the OpenBao-backed smoke.
+- The OpenBao-backed smoke passed through ops-warden with the scoped warden-sign lane.
+- The `policy.enabled` flip is intentionally deferred by operator/maturity decision, not treated as an open repo-side blocker.
 - After workplan file changes, run make fix-consistency REPO=flex-auth from ~/state-hub to mirror these statuses into State Hub.
 
 ## See Also
@@ -209,3 +213,11 @@ Remaining blocked work:
 - Verified remote health from CoulombCore: GET /healthz returned HTTP 200.
 - Verified remote POST /v1/check from CoulombCore allowed agt-state-hub-bridge with decision:873c6c682a52bebc.
 - VAULT_TOKEN is absent, so OpenBao-backed smoke remains blocked on operator credential refresh.
+
+2026-06-30 closeout from ops-warden smoke handoff:
+
+- Mode: `FLEX_AUTH_EXTERNAL` against deployed runtime `127.0.0.1:18090` via the CoulombCore operator path.
+- Allow: `warden sign agt-state-hub-bridge` returned policy_decision_id `decision:032b096c433ad80c`.
+- Deny: `--ttl 999` was rejected with `ttl_out_of_bounds` before OpenBao signing.
+- Vault-backed allow: backend `vault` produced the same policy_decision_id through the scoped warden-sign OpenBao lane.
+- Operator decision: keep `policy.enabled` off during build-stage/pre-testing and flip it later when the ecosystem reaches the appropriate maturity posture.