NET-WP-0020 finished: attended-ceremony + auto-unseal-transit profiles, greenfield init/unseal proof

T2: greenfield live proof against a fresh uninitialized OpenBao 2.5.5 —
caught and fixed 'bao operator unseal -' not reading stdin (now
'bao write sys/unseal key=-'); init and reseal-replay paths proven.
T3: attended-ceremony selectable — runbook, non-secret ceremony-record
template + validator, and a lab/production deployment profile that blocks
sops-held-automation in console selection, gates, and the init script.
T4: console gate + evidence flags for auto-unseal-transit (Helm seal stanza
prepared in railiance-platform).
Also: SCOPE.md refreshed to current repo state; adhoc fix for the broken
check-secrets Make target (unescaped $).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

workplans/ADHOC-2026-07-02.md

@@ -33,3 +33,18 @@ recipient and a clear notice instead of dying; live runs without a key still
 fail hard. Verified: full `--dry-run` now traverses Phase 0 through Phase 10
 including the new Phase 7b OpenBao hook (NET-WP-0020-T02) on a machine with
 no age key.
+
+## Fix broken check-secrets Make target (unescaped `$`)
+
+```task
+id: ADHOC-2026-07-02-T02
+status: done
+priority: medium
+```
+
+`make check-secrets` failed with a bash parse error ("unexpected EOF while
+looking for matching `'`"): the trailing `grep -v '/$'` used a single `$`,
+which make expanded before bash saw it. Escaped to `$$`. Verified:
+`make check-secrets` passes again ("All secrets/ files appear SOPS-encrypted").
+Pre-existing bug, unrelated to NET-WP-0020; found while running the final
+checks for that workplan.

workplans/NET-WP-0020-openbao-unseal-custody-and-ssh-automation.md

@@ -4,7 +4,7 @@ type: workplan
 title: "OpenBao Unseal Custody Models and SSH Automation Path"
 domain: infotech
 repo: net-kingdom
-status: active
+status: finished
 owner: codex
 topic_slug: net-kingdom
 created: "2026-06-17"
@@ -44,7 +44,7 @@ state_hub_task_id: "7040f347-d54a-42ba-a14f-5b0a7e691786"
 
 ```task
 id: NET-WP-0020-T02
-status: progress
+status: done
 priority: high
 state_hub_task_id: "65407eb1-9d89-4158-aed5-4987badd83fc"
 ```
@@ -61,10 +61,14 @@ state_hub_task_id: "65407eb1-9d89-4158-aed5-4987badd83fc"
   `creds-state.yaml` flags, encrypts + commits new init material, and a
   custody-gate refusal warns without aborting the SSO/MFA bootstrap —
   dry-run/skip/refusal paths harness-tested)
-- [ ] Greenfield live proof: run against a sealed/uninitialized OpenBao on a
-  rebuild slate (current cluster is already initialized+unsealed, so only the
-  status/verify path was live-smoked on 2026-07-02; custody-gate refusal was
-  proven for `unselected` and `attended-ceremony`)
+- [x] Greenfield live proof: full init→unseal→verify path proven 2026-07-02
+  against a genuinely uninitialized local OpenBao 2.5.5 (kubectl-exec shim,
+  script logic unmodified) — see
+  `history/2026-07-02-openbao-greenfield-init-unseal-proof.md`. The proof
+  caught and fixed a real bug: `bao operator unseal -` does not read stdin;
+  now `bao write sys/unseal key=-` (shares still never in argv/logs). Restart/
+  reseal replay path proven too. The first 3-node rebuild slate re-runs the
+  same script via Phase 7b.
 
 **2026-07-02 (later):** Bernd reviewed the helper design (five safety
 properties incl. the root-token-in-bundle caveat of the sops-held model) and
@@ -84,27 +88,42 @@ never appear in argv or logs.
 
 ```task
 id: NET-WP-0020-T03
-status: wait
+status: done
 priority: medium
 state_hub_task_id: "34f3d979-a040-49ca-bfcb-35cf17473a06"
 ```
 
-- [ ] Implement `attended-ceremony` selection path (runbooks + evidence validators)
-- [ ] Production profile blocks `sops-held-automation` default
+- [x] Implement `attended-ceremony` selection path (runbooks + evidence validators)
+- [x] Production profile blocks `sops-held-automation` default
 
-**Blocked until:** T2 automation path proven on greenfield rebuild.
+**2026-07-02:** Model selectable in the console; runbook at
+`docs/openbao-attended-ceremony-runbook.md`; non-secret ceremony record
+template + `validate-openbao-ceremony-record` validator (refuses secret
+markers/placeholders). New `deployment_profile` metadata (`lab`/`production`,
+`select-deployment-profile`): production blocks `sops-held-automation` in
+selection, status gates, and `openbao-init-unseal.sh`. Console refuse-live-init
+boundary unchanged. Covered by console test suite (14 passing) + CLI smoke.
 
 ### T4 — Auto-unseal transit profile
 
 ```task
 id: NET-WP-0020-T04
-status: wait
+status: done
 priority: medium
 state_hub_task_id: "54ab6505-c13b-4f63-8c94-07dd202de90a"
 ```
 
-- [ ] `railiance-platform` Helm seal stanza for transit/KMS
-- [ ] Console gate + evidence for `auto-unseal-transit`
+- [x] `railiance-platform` Helm seal stanza for transit/KMS
+- [x] Console gate + evidence for `auto-unseal-transit`
+
+**2026-07-02:** Commented-out `seal "transit"` stanza (disabled by default;
+token via `extraSecretEnvironmentVars`, never Git) in
+`railiance-platform/helm/openbao-values.yaml` plus an "Auto-Unseal via Transit
+Seal" section in `railiance-platform/docs/openbao.md` (enable → `-migrate` →
+pod-restart proof). Console: model selectable; init gate stays blocked until
+`openbao_transit_seal_configured` and `openbao_auto_unseal_verified` are set.
+Live transit/KMS provisioning is future ops work on the HA rebuild, gated by
+that evidence.
 
 ### T5 — SSH engine + host CA automation (cross-repo)