Implement WP-0022 audit trail and WP-0023 INTENT–SCOPE closeout

Add unified metadata-only audit.jsonl with secret-material guard, instrument
sign/access/worker paths, and expose warden activity CLI. Surface broker hint
when VAULT_TOKEN is unset, refresh INTENT/SCOPE docs, and add production
integration checklists plus catalog lane promotion playbook.

wiki/playbooks/catalog-lane-promotion.md

@@ -0,0 +1,59 @@
+# Catalog Lane Promotion — draft → active
+
+Date: 2026-07-01  
+Workplan: WARDEN-WP-0023 T05
+
+`registry/routing/catalog.yaml` entries start as **`draft`** until an owner-confirmed
+concrete path exists. Draft lanes are hidden from default `warden route find` unless
+`--all` is passed.
+
+---
+
+## Promotion checklist
+
+Before changing `status: draft` → `status: active`:
+
+| # | Criterion | Evidence |
+| --- | --- | --- |
+| 1 | **Owner confirmed** | Owner repo workplan or State Hub note naming the lane ready |
+| 2 | **Concrete path** | Real OpenBao path, grant id, or exec command — no unresolved `<placeholders>` in the primary handoff |
+| 3 | **Playbook** | `wiki/playbooks/<id>.md` with `#worker-checklist` section |
+| 4 | **Exec routing** | `exec_owner` + native command **or** `exec_capable: true` with tested `warden access` proxy |
+| 5 | **Resolvable** | `warden route show <id> --json` shows `resolvable: true` when placeholders are documented |
+| 6 | **Tests** | Routing test or smoke proving lookup + handoff shape (no secret values in fixtures) |
+| 7 | **Review date** | Update `reviewed:` in catalog entry |
+
+Promotion PR touches: `registry/routing/catalog.yaml`, playbook, optional
+`tests/test_routing.py`, and a one-line note in `wiki/CredentialRouting.md` draft table.
+
+---
+
+## Worked example (already active)
+
+**`ops-warden-warden-sign-token`** — promoted 2026-07-01 after RAILIANCE-WP-0005:
+
+- Owner: `railiance-platform` credential broker
+- Concrete grant: `ops-warden/warden-sign`
+- Playbook: `wiki/playbooks/ops-warden-warden-sign-token.md`
+- Smoke: `make credential-exec-ops-warden-smoke`
+
+---
+
+## Draft lanes — none ready yet (2026-07-01)
+
+| Catalog `id` | Blocker |
+| --- | --- |
+| `issue-core-ingestion-api-key` | OpenBao KV path + ESO wiring not owner-signed off |
+| `openrouter-llm-connect` | activity-core secret mount path still placeholder |
+| `object-storage-sts` | NK-WP-0007 vending path not production-exercised |
+| `database-dynamic-credentials` | OpenBao database engine role paths TBD per workload |
+
+Re-run promotion when the owning repo closes the blocker; do not promote on
+playbook prose alone.
+
+---
+
+## See also
+
+- `wiki/CredentialRouting.md` — draft table index
+- `wiki/playbooks/ops-warden-warden-sign-token.md` — promotion reference

wiki/playbooks/ops-bridge-tunnel-cert.md

@@ -135,9 +135,35 @@ pilot. Migrate per-tunnel when ops-bridge owner prioritizes them.
 
 ---
 
+## Live cutover evidence template
+
+When ops-bridge completes the pilot cutover, record **non-secret** evidence only.
+Post a State Hub progress note or save under `history/` with these fields:
+
+| Field | Example / instruction |
+| --- | --- |
+| Tunnel id | `state-hub-coulombcore` |
+| Actor | `agt-state-hub-bridge` |
+| Readiness gate | `check_tunnel_cert_readiness.py` exit code + date |
+| First `bridge up` success | ISO timestamp (tunnel established) |
+| First warden-signed connection | ISO timestamp from `signatures.log` or `warden activity --kind sign` |
+| `cert_command` in use | yes / no |
+| Rollback tested | yes / no — static-key path still available until verified |
+| Operator | human handle or agent id |
+| Cross-links | ops-bridge session notes, this playbook |
+
+**Do not** include `VAULT_TOKEN`, private keys, cert bodies, or host passwords in
+evidence. Use `warden activity --days 1 --kind sign --json` for sign metadata.
+
+Coordination: message `ops-bridge` on State Hub with pointer to this template when
+starting cutover (WARDEN-WP-0023).
+
+---
+
 ## See also
 
 - `wiki/CertCommandInterface.md`
 - `wiki/OpsWardenConfig.md` — cert_command example
 - `wiki/playbooks/operator-openbao-token-hygiene.md`
+- `wiki/AuditTrail.md` — query recent signs via `warden activity`
 - `warden route show ops-bridge-tunnel --json`