Record enforced caller proof and published approval release

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a0726e-5232-73f2-aaca-2c05ceb62efb

docs/production-dependency-handoffs.md

@@ -9,16 +9,22 @@ No credential values belong in responses.
 
 ## Ready infrastructure
 
-FLEX-WP-0021-T04 deployment now serves flex-auth-secrets-engine revision 2, available 1/1,
-with six live policy fixtures passing. Positive/negative network probes passed
-at revision 1; revision 2 retains the same ingress policy.
-Endpoint: http://flex-auth-secrets-engine.flex-auth.svc.cluster.local:8080.
+FLEX-WP-0021-T04 deployment now serves flex-auth-secrets-engine revision 3, available 1/1,
+with authenticated caller enforcement. Six live policy fixtures passed at
+revision 2. Positive/negative network probes passed at revision 1; revision 3
+retains the same policy image and ingress policy.
+In-cluster endpoint only: http://flex-auth-secrets-engine.flex-auth.svc.cluster.local.:8080.
 Package: secrets-engine.catalog-lane.lifecycle v2.
 Image: sha256:db1c4f7e621c7ea119489a321d7db0e05da09afc17be5f69d873b2b3c7f60cfc.
-Caller-auth is warn. Direct cluster ingress requires namespace secrets-engine
-and pod label app.kubernetes.io/name=secrets-engine. A workstation process needs
-an explicitly supported owner access path; Service DNS is not workstation
-connectivity. Do not turn warn into enforce before caller adoption is proved.
+Caller-auth is enforce after successful short-lived caller adoption. Direct
+cluster ingress requires namespace secrets-engine and pod label
+app.kubernetes.io/name=secrets-engine. Workstation access uses a loopback-only
+kubectl port-forward through authenticated Kubernetes API TLS and a ten-minute
+TokenRequest token for system:serviceaccount:secrets-engine:secrets-engine,
+audience flex-auth. Bare Service DNS must not be used from the workstation.
+See flex-auth/docs/operator-caller-access-path.md and FLEX-WP-0023. Caller
+provenance in the envelope (T04) remains open; response signatures are separate
+FLEX-WP-0024 work. The forwarding session is temporary, not a deployed tunnel.
 
 ## 1. Tenant alignment — key-cape, approval-engine, secrets-engine, flex-auth
 
@@ -149,3 +155,23 @@ a reply in this review. See GLAS-WP-0015 for the receipt summary.
 - sand-boxer 23d0c2b resolves the exact project as glas-local-proof; its
   profile.claude-agent-dev-proof v1.1.0 is a source candidate, not a deployed
   combined runtime. Claude executable pin/startup remains outstanding.
+
+
+## Verified owner returns and deployment progress — 2026-09-06, later review
+
+- KeyCape 7a6666d and approval-engine 6d18f62 implement the exact approved
+  tenant in source; live registration/custody remains open.
+- secrets-engine 80eafaf/b9058c9 includes the formerly absent lifecycle request
+  tenant and accepts policy v2 only. Its OpenBao login client retains the
+  separate tenant:coulomb identity; the approved decision does not change it.
+- Audit-core 15e5436 completes evidence-kind T03 and prepares T09. Exact
+  tenant:platform scope and redact policy confirmation requested from the
+  approval owner; wildcard is not assumed. Freshness T02 and suppression
+  detection T04/T06 bound evidence claims rather than blocking admission.
+- Approval-engine d7a9fe5's scanned Alpine candidate was published as 0.1.0.
+  Remote registry index digest
+  sha256:73333f5ceb55e48192e3095cb2e2a741cdc6ff0be2f18128301072b4a6b6eb9d
+  now pins both manifest image references. No service rollout before identity
+  and audit prerequisites.
+- Five follow-ups delivered in production-owner-review-followups-2026-09-06.json.
+  Platform custody acknowledgement and the Claude executable pin remain open.