Confirm whynot credential binding

workplans/RAILIANCE-WP-0007-credential-change-approval-workflow.md

@@ -203,7 +203,8 @@ Acceptance:
 
 **2026-06-27:** Added file-backed `approve`, `deny`, and `needs-changes`
 commands that require reviewer and comment text and append non-secret review
-comments to the CCR. Added `status` plus Make targets
+comments to the CCR. Added `confirm-binding` for explicit non-secret auth
+binding confirmation. Added `status` plus Make targets
 `credential-change-status` and `credential-change-status-json` so ops-warden can
 consume `readiness`/`resolvable` without scraping prose. Remaining T05 work is
 State Hub decision-event emission and tighter chat integration.
@@ -249,8 +250,9 @@ Acceptance:
 - ops-warden activates its catalog entry only after CCR verification.
 
 **2026-06-27:** The whynot-design lane is represented as `CCR-2026-0001` and
-can be rendered for review. It remains proposed/unapproved with unconfirmed
-bound claims, so live apply and ops-warden activation are correctly blocked.
+can be rendered for review. The whynot-design bound claim was confirmed from
+operator chat context and recorded in the CCR, but it remains proposed/unapproved,
+so live apply and ops-warden activation are correctly blocked.
 
 **2026-06-27:** Converted the ops-warden batch follow-up
 `fe5b1696-8956-4bd5-9d6f-dbde1901a076` into three proposed CCRs: