repo.work.create_intake GH-IN-0002

correlation_id: d2369d5a-ffae-4dc5-9f6a-ee4011d50b4c
reason: rmgr CLI
source: repo-manager

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 425128@bnt-lap001
Assistant-Session: f5944d8b-dac4-4e1a-87eb-8b3d8f314a63

intakes/intakes.md

@@ -124,3 +124,41 @@ closed_at: '2026-08-29T00:55:21.377495Z'
 outcome: promoted
 state_hub_intake_id: "01a04b04-dd82-73a4-a8bf-9aeba5ef575f"
 ```
+
+## GH-IN-0002 — Claim envelope on the PEP consumption path — which artifact is step 1 of GH-DEC-2026-003
+
+```yaml
+id: GH-IN-0002
+kind: intake
+title: Claim envelope on the PEP consumption path — which artifact is step 1 of GH-DEC-2026-003
+status: open
+origin: cross-repo
+origin_ref: approval-engine APPROVAL-IN-0002 (decision request)
+priority: high
+owner: gate-house
+requested_by: approval-engine
+lane: red
+description: 'approval-engine asks gate-house to confirm which artifact satisfies
+  step 1 of the GH-DEC-2026-003 consumption sequence. secrets-engine''s PEP validator
+  (validate_action_authorization) expects a flex-auth ActionAuthorization envelope
+  but fetches GET /v1/approvals/{id}/claim, which serves approval-engine''s approval-claim.
+  Two different objects on one path.
+
+
+  GH-DEC-2026-003 already names step 1 by endpoint and by field — ''GET /v1/approvals/{id}/claim
+  -> valid_now (a fact, not permission)''. valid_now is an approval-claim field; ActionAuthorization
+  has no such field and appears nowhere in gate-house doctrine. It originates in flex-auth
+  docs/action-bound-authorization-contract.md as a proposed shape for durable approval
+  storage that the same document assigns to approval-engine; it was never ratified.
+
+
+  Secondary finding: the secrets-engine validator hard-requires provenance.authority
+  == ''state-hub'' (AUTHORITY constant, src/secrets_engine/authorization.py), while
+  flex-auth''s own contract holds that State Hub decision records are not the runtime
+  approval authority.
+
+
+  Requested disposition is a confirmation, not a redesign. Resolved as GH-DEC-2026-005.'
+created: '2026-09-05T23:28:11.977565Z'
+updated: '2026-09-05T23:28:11.977565Z'
+```