Record enforced caller proof and published approval release

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a0726e-5232-73f2-aaca-2c05ceb62efb

docs/evidence/GLAS-WP-0015-caller-auth-2026-09-06.json

@@ -0,0 +1,96 @@
+[
+  {
+    "test": "issuance",
+    "principal": "system:serviceaccount:secrets-engine:secrets-engine",
+    "audience": [
+      "flex-auth"
+    ],
+    "issued_at": 1788729746,
+    "not_after": 1788730346
+  },
+  {
+    "test": "positive-adoption",
+    "mode": "warn",
+    "http_status": 200,
+    "expected_status": 200,
+    "checked_at": 1788729745,
+    "effect": "allow",
+    "policy_version": "v2"
+  },
+  {
+    "test": "adoption-warning-check",
+    "warnings": 0
+  },
+  {
+    "test": "positive-enforced",
+    "mode": "enforce",
+    "http_status": 200,
+    "expected_status": 200,
+    "checked_at": 1788729813,
+    "effect": "allow",
+    "policy_version": "v2"
+  },
+  {
+    "test": "issuance",
+    "principal": "system:serviceaccount:secrets-engine:secrets-engine",
+    "audience": [
+      "flex-auth"
+    ],
+    "issued_at": 1788729831,
+    "not_after": 1788730431
+  },
+  {
+    "test": "positive-enforced",
+    "mode": "enforce",
+    "http_status": 200,
+    "expected_status": 200,
+    "checked_at": 1788729831,
+    "effect": "allow",
+    "policy_version": "v2"
+  },
+  {
+    "test": "N1-missing-token",
+    "mode": "enforce",
+    "http_status": 401,
+    "expected_status": 401,
+    "checked_at": 1788729832,
+    "effect": null,
+    "policy_version": null
+  },
+  {
+    "test": "N2-wrong-principal",
+    "mode": "enforce",
+    "http_status": 403,
+    "expected_status": 403,
+    "checked_at": 1788729832,
+    "effect": null,
+    "policy_version": null
+  },
+  {
+    "test": "N3-wrong-audience",
+    "mode": "enforce",
+    "http_status": 401,
+    "expected_status": 401,
+    "checked_at": 1788729832,
+    "effect": null,
+    "policy_version": null
+  },
+  {
+    "test": "N4-expired-token",
+    "mode": "enforce",
+    "http_status": 401,
+    "expected_status": 401,
+    "checked_at": 1788730498,
+    "effect": null,
+    "policy_version": null
+  },
+  {
+    "test": "positive-fresh-after-expiry",
+    "mode": "enforce",
+    "http_status": 200,
+    "expected_status": 200,
+    "checked_at": 1788730499,
+    "effect": "allow",
+    "policy_version": "v2"
+  }
+]

docs/production-caller-access-receipts-2026-09-06.json

@@ -0,0 +1,14 @@
+[
+  {
+    "id": "8a6de2f4-5c4b-4eae-8149-febc5c954db1",
+    "to_agent": "secrets-engine",
+    "thread_id": "7ab6d325-11a2-4f94-9736-b17335054e3c",
+    "created_at": "2026-09-06T21:36:20.908762Z"
+  },
+  {
+    "id": "09190f45-6b3e-41c1-9baa-cda6567a59f4",
+    "to_agent": "flex-auth",
+    "thread_id": "16172bc0-2935-40fe-8b5b-847132ecb689",
+    "created_at": "2026-09-06T21:36:26.587706Z"
+  }
+]

docs/production-dependency-handoffs.md

@@ -9,16 +9,22 @@ No credential values belong in responses.
 
 ## Ready infrastructure
 
-FLEX-WP-0021-T04 deployment now serves flex-auth-secrets-engine revision 2, available 1/1,
+FLEX-WP-0021-T04 deployment now serves flex-auth-secrets-engine revision 3, available 1/1,
-with six live policy fixtures passing. Positive/negative network probes passed
+with authenticated caller enforcement. Six live policy fixtures passed at
-at revision 1; revision 2 retains the same ingress policy.
+revision 2. Positive/negative network probes passed at revision 1; revision 3
-Endpoint: http://flex-auth-secrets-engine.flex-auth.svc.cluster.local:8080.
+retains the same policy image and ingress policy.
+In-cluster endpoint only: http://flex-auth-secrets-engine.flex-auth.svc.cluster.local.:8080.
 Package: secrets-engine.catalog-lane.lifecycle v2.
 Image: sha256:db1c4f7e621c7ea119489a321d7db0e05da09afc17be5f69d873b2b3c7f60cfc.
-Caller-auth is warn. Direct cluster ingress requires namespace secrets-engine
+Caller-auth is enforce after successful short-lived caller adoption. Direct
-and pod label app.kubernetes.io/name=secrets-engine. A workstation process needs
+cluster ingress requires namespace secrets-engine and pod label
-an explicitly supported owner access path; Service DNS is not workstation
+app.kubernetes.io/name=secrets-engine. Workstation access uses a loopback-only
-connectivity. Do not turn warn into enforce before caller adoption is proved.
+kubectl port-forward through authenticated Kubernetes API TLS and a ten-minute
+TokenRequest token for system:serviceaccount:secrets-engine:secrets-engine,
+audience flex-auth. Bare Service DNS must not be used from the workstation.
+See flex-auth/docs/operator-caller-access-path.md and FLEX-WP-0023. Caller
+provenance in the envelope (T04) remains open; response signatures are separate
+FLEX-WP-0024 work. The forwarding session is temporary, not a deployed tunnel.
 
 ## 1. Tenant alignment — key-cape, approval-engine, secrets-engine, flex-auth
 
@@ -149,3 +155,23 @@ a reply in this review. See GLAS-WP-0015 for the receipt summary.
 - sand-boxer 23d0c2b resolves the exact project as glas-local-proof; its
   profile.claude-agent-dev-proof v1.1.0 is a source candidate, not a deployed
   combined runtime. Claude executable pin/startup remains outstanding.
+
+
+## Verified owner returns and deployment progress — 2026-09-06, later review
+
+- KeyCape 7a6666d and approval-engine 6d18f62 implement the exact approved
+  tenant in source; live registration/custody remains open.
+- secrets-engine 80eafaf/b9058c9 includes the formerly absent lifecycle request
+  tenant and accepts policy v2 only. Its OpenBao login client retains the
+  separate tenant:coulomb identity; the approved decision does not change it.
+- Audit-core 15e5436 completes evidence-kind T03 and prepares T09. Exact
+  tenant:platform scope and redact policy confirmation requested from the
+  approval owner; wildcard is not assumed. Freshness T02 and suppression
+  detection T04/T06 bound evidence claims rather than blocking admission.
+- Approval-engine d7a9fe5's scanned Alpine candidate was published as 0.1.0.
+  Remote registry index digest
+  sha256:73333f5ceb55e48192e3095cb2e2a741cdc6ff0be2f18128301072b4a6b6eb9d
+  now pins both manifest image references. No service rollout before identity
+  and audit prerequisites.
+- Five follow-ups delivered in production-owner-review-followups-2026-09-06.json.
+  Platform custody acknowledgement and the Claude executable pin remain open.

docs/production-owner-review-followups-2026-09-06.json

@@ -0,0 +1,32 @@
+[
+  {
+    "id": "d5c3f981-51f2-4c30-a609-f7d325b2b82d",
+    "to_agent": "key-cape",
+    "thread_id": "356f6977-d361-4e3b-83ab-b2c7f4759286",
+    "created_at": "2026-09-06T21:28:18.339973Z"
+  },
+  {
+    "id": "691f25a3-d5c9-41a7-a6b2-987111fe2bda",
+    "to_agent": "railiance-platform",
+    "thread_id": "1b88b600-7b5d-4e3f-9999-8b8fec54b1ef",
+    "created_at": "2026-09-06T21:28:22.132226Z"
+  },
+  {
+    "id": "3f1e7d2c-d69c-4d66-9711-63eab6254daf",
+    "to_agent": "audit-core",
+    "thread_id": "85c68e66-46e3-4d30-a72f-4e104e2bbe5c",
+    "created_at": "2026-09-06T21:28:23.912633Z"
+  },
+  {
+    "id": "e53321db-09c2-4775-863b-a52970a7bbb4",
+    "to_agent": "approval-engine",
+    "thread_id": "1e45cc7f-f1f5-40a8-b3f9-f1f8d78ece5c",
+    "created_at": "2026-09-06T21:28:27.661572Z"
+  },
+  {
+    "id": "1af22d2a-ee55-4790-a49f-52702fc37455",
+    "to_agent": "secrets-engine",
+    "thread_id": "7ab6d325-11a2-4f94-9736-b17335054e3c",
+    "created_at": "2026-09-06T21:28:30.996101Z"
+  }
+]

workplans/GLAS-WP-0012-first-local-profile-production-proof.md

@@ -319,3 +319,10 @@ Tenant decision update (2026-09-06): operator approved `tenant:platform` for the
 approval dependency chain as the platform management/services tenant. See
 `docs/platform-tenant-decision.md`. The choice blocker is resolved; exact owner
 configuration alignment and verification remain part of T02 before readiness.
+
+
+Later deployment progress (2026-09-06): KeyCape/approval source tenant alignment
+verified, approval release published and pinned, audit T03 complete, dedicated
+PDP revision 3 enforces adopted short-lived caller identity. See GLAS-WP-0015
+and its evidence receipts. T02 remains wait until remaining owner admission and
+runtime gates are verified; no real model run or readiness promotion.

workplans/GLAS-WP-0015-production-dependency-coordination.md

@@ -112,3 +112,50 @@ administration and services tenant (landlord zone). Recorded in
 approval store and lifecycle request must agree exactly. No alias or implicit
 cross-tenant authorization. Existing owner threads receive the approved change;
 T03 remains progress pending implementation evidence and other dependencies.
+
+
+## Later owner review and production progress — 2026-09-06
+
+Reviewed and marked read the five replies below; cross-checked the owner source
+revisions. Tenant source alignment accepted at KeyCape 7a6666d and approval
+6d18f62; no live tenant-registration claim. Audit evidence-kind prerequisite
+complete at 15e5436; exact sender scope/redaction confirmation requested.
+
+- approval-engine: `cfff917f-d6e1-4f5e-a396-e0e43ebb97e6`
+- secrets-engine: `b9c4641b-3227-47a2-84de-a696a219fd8e`
+- flex-auth: `e272f234-7ba2-458b-a6df-9c2664e4ad76`
+- audit-core: `4ae48d3d-a6fd-4f26-aaa7-c5f55a93ab75`
+- key-cape: `893e17a1-ac96-465c-ad22-af88204275cd`
+
+Published approval-engine d7a9fe5 candidate 0.1.0 and verified the registry
+index digest 73333f5ceb55e48192e3095cb2e2a741cdc6ff0be2f18128301072b4a6b6eb9d.
+Both owner deployment image references pinned; client dry-run passes. Production
+service remains undeployed until KeyCape and audit credential admission.
+
+FLEX-WP-0023 now owns the workstation path. Created the exact bound caller SA
+without role bindings and with automount disabled. Ten-minute audience-scoped
+TokenRequest identity passed warn adoption with zero warnings. Helm revision 3
+now enforces caller authentication; positive request passes, missing token and
+wrong audience return 401, wrong principal returns 403. Real expiry proof passed (expired 401, then fresh 200); see docs/evidence/GLAS-WP-0015-caller-auth-2026-09-06.json for outcomes.
+Other three consumer Deployment specs unchanged. Caller provenance/signatures
+remain live owner work (FLEX-WP-0023-T04 / FLEX-WP-0024).
+
+Five follow-ups delivered, receipts in
+`docs/production-owner-review-followups-2026-09-06.json`. GLAS-WP-0012 remains
+blocked on credential custody/adoption, approval deployment and Claude runtime
+pin/startup. No Anthropic key read or real model run. Profiles remain two blocked
+and one unverified; no readiness promotion.
+
+
+Also reviewed and marked read approval scan follow-up
+`89e21fcb-fbf8-43c0-9138-5da7f4dc0d67`; its publication blocker was resolved in
+this session. The published pin is committed in approval-engine `b51d174`.
+Independently ran approval-engine tests/test_auth.py: 23 passed. Glas fetched
+origin with no ahead/behind drift before edits; the readiness catalog validated.
+
+
+Final caller proof completed: FLEX-WP-0023-T01/T02/T03 done, including actual
+issued-token expiry and fresh-token recovery. Temporary forward removed and
+proof process exited. Final owner receipt deliveries recorded in
+`docs/production-caller-access-receipts-2026-09-06.json`. This establishes the
+operator path; consumer adoption and native action authorization remain open.