Record authenticated caller in the decision envelope.

FLEX-WP-0023-T04: provenance.caller is additive (mode required;
principal/audience/not_after when a token was reviewed). TokenReview
keeps the JWT exp. request_digest is unchanged because the caller is
not binding material.

Assistant: grok
Assistant-Session: 01a09dc1-b21e-77e1-919e-fcad2f82b267

workplans/FLEX-WP-0023-operator-caller-access-path.md

@@ -4,7 +4,7 @@ type: workplan
 title: "Operator caller access path and caller identity in the decision record"
 domain: infotech
 repo: flex-auth
-status: active
+status: finished
 owner: claude
 topic_slug: netkingdom
 planning_priority: P1
@@ -15,7 +15,7 @@ related_workplans:
   - FLEX-WP-0016
   - SECRETS-WP-0009
 created: "2026-09-06"
-updated: "2026-09-06"
+updated: "2026-09-14"
 state_hub_workstream_id: "ad011f92-786c-51ad-b3f6-c06ad77e7af7"
 ---
 
@@ -134,7 +134,7 @@ caller adoption is proved — is satisfied by `T02`, not bypassed by this task.
 
 ```task
 id: FLEX-WP-0023-T04
-status: todo
+status: done
 priority: high
 state_hub_task_id: "c0e4f31a-cc42-5bd2-b938-d140ecd52e1a"
 ```
@@ -165,6 +165,16 @@ authenticated.
 Gate: a decision obtained under `enforce` names its caller and lifetime; the
 same request's `request_digest` is byte-identical to the pre-change value.
 
+**Done 2026-09-14.** `provenance.caller` is additive on `flex-auth.decision-record.v1`
+(`mode` required; `principal`/`audience`/`not_after` when a token was reviewed).
+`internal/callerauth.Identity` now keeps the reviewed JWT `exp`. HTTP `/v1/check`
+and `/v1/batch_check` stamp the record through request context so the decision
+log matches the response. Disabled evaluation emits `{"mode":"disabled"}`.
+`request_digest` is unchanged: the caller is not in `binding`. Tests:
+`TestCallerProvenanceDoesNotChangeRequestDigest`,
+`TestKubernetesTokenReviewerCapturesTokenExpiry`,
+`TestServeCallerAuthenticationBindsSystemToPrincipal`.
+
 ## 5. Report the gap to gate-house as a v0.8 finding
 
 ```task