feat: add credential broker token helper

workplans/RAILIANCE-WP-0005-credential-request-and-lease-broker.md

@@ -10,7 +10,7 @@ topic_slug: railiance
 planning_priority: high
 planning_order: 5
 created: "2026-06-24"
-updated: "2026-06-25"
+updated: "2026-06-26"
 depends_on_workplans:
   - RAIL-PL-WP-0002
 state_hub_workstream_id: "2731fece-6c49-45b8-ab8a-4ea6c04ac603"
@@ -152,7 +152,7 @@ Acceptance:
 
 ```task
 id: RAILIANCE-WP-0005-T03
-status: todo
+status: progress
 priority: high
 state_hub_task_id: "d8498e3b-b2fb-47b7-ab88-cd6592c1807e"
 ```
@@ -167,11 +167,20 @@ Acceptance:
 - The resulting token cannot administer OpenBao and can only call the SSH sign paths allowed by openbao/policies/warden-sign.hcl.
 - Verification proves the token can run ops-warden vault signing and cannot list unrelated secrets.
 
+**2026-06-26:** Added the source-side OpenBao token-grant implementation for
+the `ops-warden/warden-sign` pilot: issuer policy
+`openbao/policies/credential-broker-warden-sign-issuer.hcl`, idempotent apply
+and verify scripts, Make targets for dry-run/live apply/live verification, and
+catalog validation for `openbao.issuer_policy`. Dry-run validation is expected
+to work offline. Live closure still requires an approved OpenBao operator token
+path and successful runs of `make openbao-configure-token-grants` and
+`make openbao-verify-token-grants-smoke`, so T03 remains `progress`.
+
 ## T04 - Build credential helper MVP
 
 ```task
 id: RAILIANCE-WP-0005-T04
-status: todo
+status: progress
 priority: high
 state_hub_task_id: "0c543cb3-36cb-4b25-9a58-de8efc1216c9"
 ```
@@ -186,6 +195,16 @@ Acceptance:
 - status and revoke work by non-secret lease handle/accessor.
 - The helper redacts token-looking values from logs and refuses to run in verbose modes that would print secrets.
 
+**2026-06-26:** Added `scripts/credential.py` as the source helper MVP with
+`request`, `exec`, `status`, and `revoke` subcommands. The helper validates the
+grant catalog, enforces purpose and TTL bounds, defaults `request` to a local
+mode-0600 token file plus non-secret accessor metadata, supports response-wrap
+handoff, injects `VAULT_TOKEN` only into the child process for `exec`, redacts
+token-looking child output, rejects caller-supplied token env assignments, and
+revokes exec tokens by accessor in a `finally` block. Added Make dry-run and
+ops-warden smoke targets. T04 remains `progress` until a live OpenBao issuer
+token is available to prove `credential-exec-ops-warden-smoke` end to end.
+
 ## T05 - Implement secure delivery modes
 
 ```task