NET-WP-0020-T02: SOPS-held OpenBao init/unseal automation helper

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

workplans/NET-WP-0020-openbao-unseal-custody-and-ssh-automation.md

@@ -8,7 +8,7 @@ status: active
 owner: codex
 topic_slug: net-kingdom
 created: "2026-06-17"
-updated: "2026-06-18"
+updated: "2026-07-02"
 state_hub_workstream_id: "d6338ac9-797d-4009-8203-4b8dd39010af"
 ---
 
@@ -44,14 +44,33 @@ state_hub_task_id: "7040f347-d54a-42ba-a14f-5b0a7e691786"
 
 ```task
 id: NET-WP-0020-T02
-status: todo
+status: progress
 priority: high
 state_hub_task_id: "65407eb1-9d89-4158-aed5-4987badd83fc"
 ```
 
-- [ ] Extend `creds-bootstrap-agent.sh` for OpenBao init/unseal when sealed
-- [ ] Non-secret evidence flags: `openbao_initialized`, `openbao_post_unseal_verified`
-- [ ] Integrate with `make openbao-configure-initial` post-unseal
+- [x] SOPS-held init/unseal automation: `sso-mfa/bootstrap/openbao-init-unseal.sh`
+  (`make openbao-init-unseal` / `openbao-init-unseal-dry-run`)
+- [x] Non-secret evidence flags: `openbao_initialized`, `openbao_post_unseal_verified`
+  (emitted on the script's `EVIDENCE` JSON line)
+- [x] Integrate with `make openbao-configure-initial` post-unseal
+  (`OPENBAO_RUN_CONFIGURE_INITIAL=1` chains it; default prints the handoff hint)
+- [ ] Wire the helper as an optional phase inside `creds-bootstrap-agent.sh`
+  (agent-policy blocked automated edits to the credential bootstrap script on
+  2026-07-02 — operator should add a phase that calls the helper, sets the two
+  state flags in `creds-state.yaml`, and re-runs `encrypt-secrets.sh` + commit
+  when `secrets/openbao/` was created)
+- [ ] Greenfield live proof: run against a sealed/uninitialized OpenBao on a
+  rebuild slate (current cluster is already initialized+unsealed, so only the
+  status/verify path was live-smoked on 2026-07-02; custody-gate refusal was
+  proven for `unselected` and `attended-ceremony`)
+
+**2026-07-02:** Helper implemented and smoke-tested: dry-run against the live
+cluster passed the custody gate (`sops-held-automation` selected) and read
+`initialized=true sealed=false`; negative tests proved refusal for unselected
+and attended-ceremony models. Init material is written only into
+`secrets/openbao/` for age custody; unseal shares travel stdin-to-stdin and
+never appear in argv or logs.
 
 ### T3 — Attended ceremony automation profile