Implement WP-0022 audit trail and WP-0023 INTENT–SCOPE closeout

Add unified metadata-only audit.jsonl with secret-material guard, instrument
sign/access/worker paths, and expose warden activity CLI. Surface broker hint
when VAULT_TOKEN is unset, refresh INTENT/SCOPE docs, and add production
integration checklists plus catalog lane promotion playbook.

workplans/WARDEN-WP-0023-intent-scope-alignment-closeout.md

@@ -4,7 +4,7 @@ type: workplan
 title: "INTENT–SCOPE Alignment Closeout"
 domain: infotech
 repo: ops-warden
-status: ready
+status: finished
 owner: codex
 topic_slug: custodian
 planning_priority: high
@@ -64,7 +64,7 @@ Acceptance:
 
 ```task
 id: WARDEN-WP-0023-T02
-status: todo
+status: done
 priority: high
 state_hub_task_id: "9a9b3631-8948-45af-ace1-c19ee74ace4d"
 ```
@@ -85,11 +85,13 @@ Acceptance:
 - INTENT still describes direction, not implementation inventory.
 - No contradiction with SCOPE 2026-07-01 boundary (ops-warden does not mint tokens).
 
+**2026-07-01:** INTENT.md updated.
+
 ### T03 — Production integration coordination pack
 
 ```task
 id: WARDEN-WP-0023-T03
-status: todo
+status: done
 priority: high
 state_hub_task_id: "26f23798-494b-45fc-baa8-af27bdffa038"
 ```
@@ -111,11 +113,14 @@ Acceptance:
 - A human operator can run the flip/cutover checklists without re-deriving steps.
 - Evidence fields are defined; completion is recorded via State Hub progress when done.
 
+**2026-07-01:** Rollback section added to `wiki/PolicyGatedSigning.md`; live cutover
+evidence template added to `wiki/playbooks/ops-bridge-tunnel-cert.md`.
+
 ### T04 — `warden sign` broker hint when `VAULT_TOKEN` unset
 
 ```task
 id: WARDEN-WP-0023-T04
-status: todo
+status: done
 priority: medium
 state_hub_task_id: "85e324f9-273d-4740-a202-9c4e8fb122ae"
 ```
@@ -129,11 +134,13 @@ Acceptance:
 - Unit test covers the hint text (catalog id + exec shape, no secret placeholders).
 - Manual `export VAULT_TOKEN` remains documented as fallback in playbooks.
 
+**2026-07-01:** `src/warden/vault_hints.py` + `tests/test_vault.py`.
+
 ### T05 — Catalog draft-lane promotion checklist
 
 ```task
 id: WARDEN-WP-0023-T05
-status: todo
+status: done
 priority: medium
 state_hub_task_id: "82608692-2845-41e1-a498-90ed53780748"
 ```
@@ -151,11 +158,14 @@ Acceptance:
 - Checklist is reviewable by humans and agents.
 - At least one promotion example or explicit “none ready yet” note in the workplan.
 
+**2026-07-01:** `wiki/playbooks/catalog-lane-promotion.md` — worked example
+`ops-warden-warden-sign-token`; four draft lanes explicitly not ready.
+
 ### T06 — SCOPE and workplan consistency
 
 ```task
 id: WARDEN-WP-0023-T06
-status: todo
+status: done
 priority: medium
 state_hub_task_id: "79ca7b9a-554e-4952-9393-a29b100f6190"
 ```
@@ -171,11 +181,13 @@ Acceptance:
 - SCOPE and gap analysis cross-link correctly.
 - Uncommitted SCOPE edits from 2026-07-01 broker routing are committed with this WP.
 
+**2026-07-01:** SCOPE.md updated.
+
 ### T07 — Sequence WP-0022 audit implementation
 
 ```task
 id: WARDEN-WP-0023-T07
-status: todo
+status: done
 priority: high
 state_hub_task_id: "1f3b3b33-974e-49bf-be4a-9d50b702c2a4"
 ```
@@ -190,6 +202,8 @@ Acceptance:
 - WP-0023 `depends_on_workplans` includes WP-0022.
 - Hub consistency run syncs both workplans.
 
+**2026-07-01:** WP-0022 implemented and both workplans marked `finished`.
+
 ---
 
 ## Exit criteria