approval-engine/workplans/APPROVAL-WP-0004-exact-consume-source-provenance.md

id	type	title	domain	repo	status	flavor	owner	topic_slug	created	updated	depends_on	state_hub_workstream_id
APPROVAL-WP-0004	workplan	Retain exact authenticated consume source provenance	infotech	approval-engine	finished	implementation	codex	netkingdom	2026-10-16	2026-10-16		688edc60-a179-5618-90f1-468aadc2af58

Explicit NetKingdom target demand under CUST-WP-0080 selects the source evidence subset of APPROVAL-WP-0002-T01/T04/T05. INTENT basis: authenticated consumable object, exact binding and atomic local evidence. Existing authoritative CAS, confirmation transport and audit adapter are reused. No second approval/PDP service, portable signer, foreign owner review or live action is added.

Preserve verified consumer and approved operation in the use source row

id: APPROVAL-WP-0004-T01
status: done
priority: high
state_hub_task_id: "b0b0a5a9-f7e7-508b-96d0-4b02457b16fc"

Source implementation supplies the HTTP-verified Identity to consume and writes its bounded metadata plus native act/PDP bindings into the existing atomic use outbox. Body-provided provenance is ignored, internal calls retain null, original idempotent evidence is immutable, and historical rows remain untouched. No DB schema change, response/claim widening or identity scope change is needed. Seven new source tests cover signature-verified HTTP consumption, restart, adapter preservation, spoofed fields, denied identities, retry immutability and rollback. Source checks do not establish native acceptance.

Integrate independently reviewed source and synchronize work records

id: APPROVAL-WP-0004-T02
status: done
priority: high
state_hub_task_id: "2b932ef8-e143-5bb7-856e-4cba4fb22c09"

The Custodian coordinator reviewed and integrated the exact source patch a6bf77fa8b6916f423db7832f475e38747b828dd632a88f9631131e28e3230ee as commit 477c683991fda3c01e2af98a18f5a8719ee9dbc9. Canonical source hashes and integration are recorded in the-custodian's docs/changes/netkingdom-target-2026-10-16/approval-reference/canonical-integration.json. Normal State Hub sync/publication is recorded in the same change directory's sync-session-61857.json: bindings synchronized 5/5, source commit pushed, zero failures, zero automation errors and nine warnings. The generated-only writeback commit refusal remains recorded in that receipt; generated identifiers are retained. Published origin HEAD was independently read back as the exact commit above on 2026-10-16. This completes scoped source integration/publication, not formal delegated-owner assent or native acceptance. The closure-file update itself still follows the coordinator's normal review and synchronization.

Existing native delivery obligations remain live under APPROVAL-WP-0002: T01 exact issuer/profile and release/migration, T04 admitted lifecycle source delivery/reconciliation, T05 named served PEP consumption before protected effect. Platform owns mediator transport/identity/custody, the one-shot journal and native effect; Secrets owns implementation of the strict handoff and task-scoped backend. The strict task handoff is not implemented at Secrets canonical c80a944105a00220cd3c1a007709e72d830dd08d and remains its next implementation work. Access owns the signed decision and exact request/action/representation binding. No claim that an isolated source test closes any of these gates is made.

No scoped source work remains in APPROVAL-WP-0004. The native obligations above were live in APPROVAL-WP-0002 before this work and remain there under their existing identifiers and wait statuses; no new residual record is needed and no residual implementation is promoted by this closure. Further implementation of a necessary WP0002 residual must be explicitly selected under the continuing CUST-WP-0080 target demand and recorded with its precise owner/action scope; credential, rollout and native effect steps retain their separate authority gates.