DEC-2026-002 resolved: agent-harness (single shared runtime)

- DecisionQueue: moved to resolved log with rescoped outcome (three-layer
  model; binky-control = tenant #1); hub decision resolved
- Secret lanes doc: identifiers renamed executor-worker → agent-harness
  before any provisioning happens
- Cutover runbook + WP-0004-T06: gate 1 done; deployment gate now points
  at HARNESS-WP-0001-T06/T07 in the agent-harness repo

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

integrations/executor-worker-secrets.md

@@ -1,10 +1,10 @@
-# Executor Worker — OpenBao Secret Lanes (BINKY-WP-0004-T03)
+# Agent Harness — OpenBao Secret Lanes (BINKY-WP-0004-T03)
 
 > Status: prepared 2026-07-17. Catalog metadata and provisioning steps only —
 > **no secret values appear here or anywhere in git/hub/chat**. All new
 > provisioning is founder Red lane per AutonomyPolicy.md.
 
-The executor worker (DEC-2026-002: new small repo, deployed on Railiance)
+The agent harness (DEC-2026-002 resolved: single shared runtime repo `agent-harness`, deployed on Railiance)
 needs three credential lanes. One exists and is reusable; two need
 provisioning.
 
@@ -19,7 +19,7 @@ Warden catalog `openrouter-llm-connect` (active, resolvable, reviewed
 - Policy gate: `flex-auth check secret.read:llm-connect` (advisory today)
 
 **Verdict: reuse.** The key is scoped to "llm-connect in activity-core"; the
-executor worker is the consumer that scoping anticipated (it executes tasks
+agent harness is the consumer that scoping anticipated (it executes tasks
 activity-core emits, via llm-connect adapters). No new secret needed. If the
 worker later gets its own workload identity, bind that identity to the same
 policy — same secret, separate auth principal — rather than duplicating the
@@ -36,14 +36,14 @@ Proposed provisioning (founder Red lane, ~10 min):
 
 1. Generate an ed25519 keypair on Railiance (worker host), private key never
    leaves the host; store a copy under OpenBao
-   `platform/workloads/executor-worker/forgejo-deploy-key`
+   `platform/workloads/agent-harness/forgejo-deploy-key`
    (fields: `SSH_PRIVATE_KEY`, `SSH_PUBLIC_KEY`).
 2. In forgejo, add the public key as a **per-repo deploy key with write
    access** — sandbox repo only at first; add binky-control at T06 cutover.
    Per-repo deploy keys beat a machine-user account here: blast radius is
    exactly the repo list.
-3. New OpenBao policy `workload-kv-read-executor-worker-forgejo` scoped to
-   that path; warden catalog entry `executor-worker-forgejo-deploy` (owner:
+3. New OpenBao policy `workload-kv-read-agent-harness-forgejo` scoped to
+   that path; warden catalog entry `agent-harness-forgejo-deploy` (owner:
    railiance-platform, risk: high).
 
 ## Lane 3 — Non-interactive AppRole for company-email scan: NEW (Red lane)
@@ -57,7 +57,7 @@ Proposed provisioning (founder Red lane, ~10 min):
 
 1. Enable/confirm AppRole auth on the OpenBao instance (`bao auth list`;
    enable at path `approle` if absent).
-2. Create role `executor-worker-binky-mail` bound to the **existing** policy
+2. Create role `agent-harness-binky-mail` bound to the **existing** policy
    `workload-kv-read-binky-company-email-imap` (no policy change needed):
    `token_ttl=15m`, `token_max_ttl=30m`, `secret_id_ttl=0` (or rotate
    quarterly), `token_num_uses` bounded.
@@ -66,7 +66,7 @@ Proposed provisioning (founder Red lane, ~10 min):
    repo). The worker logs in per run:
    `bao write auth/approle/login role_id=… secret_id=…` → short-lived token
    → `bao kv get -field=IMAP_USERNAME|IMAP_PASSWORD tenants/binky/company-email/imap`.
-4. Warden catalog entry `executor-worker-binky-mail-approle` (owner:
+4. Warden catalog entry `agent-harness-binky-mail-approle` (owner:
    railiance-platform, risk: high) so the lane is discoverable and audited.
 
 Scan invocation stays exactly the manual pattern (read-only email-connect,
@@ -78,7 +78,7 @@ config `integrations/mailbox-binky-company.yml`, reports to
 
 - [ ] Lane 2: forgejo deploy key (generate, register on sandbox repo, store
       in OpenBao, catalog entry)
-- [ ] Lane 3: AppRole `executor-worker-binky-mail` (create role, deliver
+- [ ] Lane 3: AppRole `agent-harness-binky-mail` (create role, deliver
       role_id/secret_id to Railiance, catalog entry)
 - [x] Lane 1: nothing to do — reuse confirmed