Record completed approval transport repair preparation

Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a126e1-76f8-7643-8cf3-e93336539ade

workplans/ADHOC-2026-10-11.md

@@ -9,6 +9,7 @@ owner: codex
 created: "2026-10-11"
 updated: "2026-10-11"
 flavor: implementation
+state_hub_workstream_id: "77fca3cc-64dc-5c31-915e-999dde18eee5"
 ---
 
 # Strict execution consume-confirmation client source preparation
@@ -25,6 +26,7 @@ not promote or implement APPROVAL-WP-0002's residual adoption obligations.
 id: APPROVAL-WP-ADHOC-2026-10-11-T01
 status: done
 priority: medium
+state_hub_task_id: "57b7db4f-87d5-503d-974a-af21c05cde21"
 ```
 
 Completed source preparation: approval_engine/execution_confirmation.py adds
@@ -82,3 +84,52 @@ transport admission. Fresh claim/PDP validation, returned original consumption
 correspondence and a separate one-shot journal remain caller obligations.
 No grant, native acceptance, deployment, human approval, residual promotion or
 full-adoption closure was recorded.
+
+
+## Repair fixed-origin confirmation transport after synthetic credential redirect
+
+```task
+id: APPROVAL-WP-ADHOC-2026-10-11-T02
+status: done
+priority: high
+```
+
+New bounded source demand, distinct from completed T01: the Custodian synthetic
+two-origin counterexample proved the inherited ApprovalHTTPClient default could
+follow cross-origin redirects, forward Authorization and accept redirected JSON.
+Original T01 source review and its outcome are preserved; they did not prove this
+transport boundary. The failure receipt is the-custodian/docs/evidence/
+2026-10-10-security-consolidation/approval-confirmation-transport-counterexample.json.
+
+Completed staged source preparation adds fixed-provider isolated default HTTP
+transport with no environment proxies or redirects, exact 200/JSON/content/body
+limits, duplicate/nonfinite JSON refusal, closed errors and bounded whole-network
+request deadline including exceptional close. Process isolation retains threaded
+SDK support without signals or multiprocessing main-guard requirements. Protected
+local credential reads refuse symlink components, hardlinks, public/group-writable
+files, unknown owners, special files and excessive/invalid contents; token
+rotation through reread remains supported. Explicit test-opener injection is
+retained as an owner-controlled seam, not an admitted production transport.
+
+INTENT basis: deterministic authentic approval facts, exact binding and fail-closed
+consumption evidence in Purpose, Claim Shape and Consumption Ordering. This
+source repair does not add a policy decision, grant, caller attestation, execution
+journal or privileged replay service.
+
+Validation: 270 staged full tests passed, with the existing JWT test-key warning;
+51 new transport cases include cross-origin GET/POST redirects (zero second-origin
+requests/headers), ignored environment proxies, status/content/size/JSON/error
+refusals, total deadline under slow headers/dribbled body/error body from a worker
+thread, safe exceptional close and credential-file guards. Existing PEP and exact
+consumption tests remain covered after their synthetic token fixture modes become
+explicitly private. Native credentials, custody, OpenBao or production APIs were
+not accessed. Immutable staged hashes are in normalized-source-manifest.json
+and SHA256SUMS; source patch checks against the current owner checkout.
+
+This completed task records local source preparation only. Formal updated owner
+review must follow persistence of T02 in the actual owner checkout. No formal
+updated review is written at this preparation stage. Actual mediator read/consume
+identity, credential custody, transport/server identity and ingress admission are
+unproved. Fresh claim/PDP validation, returned original consumption tuple and a
+separate live one-shot execution journal remain mandatory. Existing adoption/
+native obligations retain their owners/statuses; no residual is promoted.