From be18542cc6fed10e4d297cb8ba66baa2e004e23b Mon Sep 17 00:00:00 2001
From: repo-manager <repo-manager@local>
Date: Sun, 6 Sep 2026 01:28:12 +0200
Subject: [PATCH] repo.work.create_intake GH-IN-0002

correlation_id: d2369d5a-ffae-4dc5-9f6a-ee4011d50b4c
reason: rmgr CLI
source: repo-manager

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 425128@bnt-lap001
Assistant-Session: f5944d8b-dac4-4e1a-87eb-8b3d8f314a63
---
 intakes/intakes.md | 38 ++++++++++++++++++++++++++++++++++++++
 1 file changed, 38 insertions(+)

diff --git a/intakes/intakes.md b/intakes/intakes.md
index 591039d..428e8ad 100644
--- a/intakes/intakes.md
+++ b/intakes/intakes.md
@@ -124,3 +124,41 @@ closed_at: '2026-08-29T00:55:21.377495Z'
 outcome: promoted
 state_hub_intake_id: "01a04b04-dd82-73a4-a8bf-9aeba5ef575f"
 ```
+
+## GH-IN-0002 — Claim envelope on the PEP consumption path — which artifact is step 1 of GH-DEC-2026-003
+
+```yaml
+id: GH-IN-0002
+kind: intake
+title: Claim envelope on the PEP consumption path — which artifact is step 1 of GH-DEC-2026-003
+status: open
+origin: cross-repo
+origin_ref: approval-engine APPROVAL-IN-0002 (decision request)
+priority: high
+owner: gate-house
+requested_by: approval-engine
+lane: red
+description: 'approval-engine asks gate-house to confirm which artifact satisfies
+  step 1 of the GH-DEC-2026-003 consumption sequence. secrets-engine''s PEP validator
+  (validate_action_authorization) expects a flex-auth ActionAuthorization envelope
+  but fetches GET /v1/approvals/{id}/claim, which serves approval-engine''s approval-claim.
+  Two different objects on one path.
+
+
+  GH-DEC-2026-003 already names step 1 by endpoint and by field — ''GET /v1/approvals/{id}/claim
+  -> valid_now (a fact, not permission)''. valid_now is an approval-claim field; ActionAuthorization
+  has no such field and appears nowhere in gate-house doctrine. It originates in flex-auth
+  docs/action-bound-authorization-contract.md as a proposed shape for durable approval
+  storage that the same document assigns to approval-engine; it was never ratified.
+
+
+  Secondary finding: the secrets-engine validator hard-requires provenance.authority
+  == ''state-hub'' (AUTHORITY constant, src/secrets_engine/authorization.py), while
+  flex-auth''s own contract holds that State Hub decision records are not the runtime
+  approval authority.
+
+
+  Requested disposition is a confirmation, not a redesign. Resolved as GH-DEC-2026-005.'
+created: '2026-09-05T23:28:11.977565Z'
+updated: '2026-09-05T23:28:11.977565Z'
+```