Record owner replies and verified policy v2 rollout

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a0726e-5232-73f2-aaca-2c05ceb62efb

docs/evidence/GLAS-WP-0015-policy-v2-2026-09-06.json

@@ -0,0 +1,44 @@
+[
+  {
+    "fixture": "check_request_allow_destroy_dual_control.json",
+    "decision_id": "decision:4e327202e2aee41c",
+    "effect": "allow",
+    "reason": "catalog_lane_policy_matched",
+    "version": "v2"
+  },
+  {
+    "fixture": "check_request_deny_unknown_subject.json",
+    "decision_id": "decision:6ddc0e0d9764c2bb",
+    "effect": "deny",
+    "reason": "unknown_subject",
+    "version": "v2"
+  },
+  {
+    "fixture": "check_request_deny_wrong_tenant.json",
+    "decision_id": "decision:7d56b7fc274ddfd6",
+    "effect": "deny",
+    "reason": "wrong_tenant",
+    "version": "v2"
+  },
+  {
+    "fixture": "check_request_deny_destroy_without_claim.json",
+    "decision_id": "decision:9840abdeba8ad507",
+    "effect": "deny",
+    "reason": "dual_control_required",
+    "version": "v2"
+  },
+  {
+    "fixture": "check_request_deny_revoke_not_an_action.json",
+    "decision_id": "decision:b2a548b858bfd9a3",
+    "effect": "deny",
+    "reason": "unknown_action",
+    "version": "v2"
+  },
+  {
+    "fixture": "check_request_allow_rotate.json",
+    "decision_id": "decision:414734bb30381ff7",
+    "effect": "allow",
+    "reason": "catalog_lane_policy_matched",
+    "version": "v2"
+  }
+]

docs/production-dependency-handoffs.md

@@ -9,11 +9,12 @@ No credential values belong in responses.
 
 ## Ready infrastructure
 
-FLEX-WP-0021-T04 deployed flex-auth-secrets-engine revision 1, available 1/1,
-with five policy fixtures and positive/negative network probes passing.
+FLEX-WP-0021-T04 deployment now serves flex-auth-secrets-engine revision 2, available 1/1,
+with six live policy fixtures passing. Positive/negative network probes passed
+at revision 1; revision 2 retains the same ingress policy.
 Endpoint: http://flex-auth-secrets-engine.flex-auth.svc.cluster.local:8080.
-Package: secrets-engine.catalog-lane.lifecycle v1.
-Image: sha256:89086c02c74a931068423e70937d03df7850fa0db9c63e70be56b3558f1756af.
+Package: secrets-engine.catalog-lane.lifecycle v2.
+Image: sha256:db1c4f7e621c7ea119489a321d7db0e05da09afc17be5f69d873b2b3c7f60cfc.
 Caller-auth is warn. Direct cluster ingress requires namespace secrets-engine
 and pod label app.kubernetes.io/name=secrets-engine. A workstation process needs
 an explicitly supported owner access path; Service DNS is not workstation
@@ -133,3 +134,19 @@ read access to glas-harness for this packet and the acceptance contract.
 Sand-boxer also needs rein-aharness as a sibling for runtime packaging/startup.
 KeyCape/custody/audit preparation and approval-image/runtime preparation can
 proceed in parallel; final native activation follows the verified prerequisites.
+
+## Owner returns reviewed — 2026-09-06
+
+Six acknowledgements received: key-cape, audit-core, approval-engine,
+secrets-engine, flex-auth and sand-boxer. railiance-platform has not returned
+a reply in this review. See GLAS-WP-0015 for the receipt summary.
+
+- v1 lacked tenant enforcement; v2 is now live with wrong_tenant denial.
+- Tenant values remain incompatible, with no authorized mapping. Operator
+  choice requested before changing registration/store semantics.
+- Workstation caller access remains open even though FLEX-WP-0021-T05 was
+  marked done; service coordinates are insufficient for the actual consumer.
+- AUDIT-WP-0009-T03 must precede T09 so load-bearing evidence is represented.
+- sand-boxer 23d0c2b resolves the exact project as glas-local-proof; its
+  profile.claude-agent-dev-proof v1.1.0 is a source candidate, not a deployed
+  combined runtime. Claude executable pin/startup remains outstanding.

docs/production-handoff-followups-2026-09-06.json

@@ -0,0 +1,26 @@
+[
+  {
+    "id": "7382a735-66e4-452c-9335-b7613dda188d",
+    "to_agent": "flex-auth",
+    "thread_id": "16172bc0-2935-40fe-8b5b-847132ecb689",
+    "created_at": "2026-09-06T19:30:13.702873Z"
+  },
+  {
+    "id": "d4ab2e21-b31b-441b-9be4-af6ae0a4a770",
+    "to_agent": "secrets-engine",
+    "thread_id": "7ab6d325-11a2-4f94-9736-b17335054e3c",
+    "created_at": "2026-09-06T19:30:17.157780Z"
+  },
+  {
+    "id": "972d5460-4bc8-4d97-8d2d-8737ea709aa5",
+    "to_agent": "sand-boxer",
+    "thread_id": "481b18b6-54ae-44bc-bb31-ffd130d6d8ad",
+    "created_at": "2026-09-06T19:30:21.193436Z"
+  },
+  {
+    "id": "0da5875f-672a-42a2-b246-b11972f95c66",
+    "to_agent": "audit-core",
+    "thread_id": "85c68e66-46e3-4d30-a72f-4e104e2bbe5c",
+    "created_at": "2026-09-06T19:30:24.635897Z"
+  }
+]