docs: record delivered production dependency handoffs

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a0726e-5232-73f2-aaca-2c05ceb62efb

docs/production-dependency-handoffs.md

@@ -1,7 +1,9 @@
 # Production dependency handoffs
 
 Prepared 2026-09-06 from GLAS-WP-0012 and the deployed policy-service evidence.
-These are reviewable owner requests, not delivered messages or authority grants.
+Sent to the seven owners on 2026-09-06 after explicit user authorization.
+Receipt IDs are in [production-handoff-receipts.json](production-handoff-receipts.json).
+Delivery does not establish owner acceptance or an authority grant.
 Glas coordinates acceptance; each owner retains implementation and authorization.
 No credential values belong in responses.
 
@@ -122,3 +124,12 @@ consumer tuple, declared egress and denial/cleanup evidence. GLAS-WP-0012 then
 reviews version 1.1.0, executes its real artifact proof and promotes only the
 proven candidate. Provider workspace scope and spend limit remain operator
 inputs; model budget_tokens does not establish a provider spend limit.
+
+## Repository access for owner sessions
+
+Primary owner workspaces: key-cape, railiance-platform, audit-core,
+approval-engine, secrets-engine, flex-auth and sand-boxer. Give each owner
+read access to glas-harness for this packet and the acceptance contract.
+Sand-boxer also needs rein-aharness as a sibling for runtime packaging/startup.
+KeyCape/custody/audit preparation and approval-image/runtime preparation can
+proceed in parallel; final native activation follows the verified prerequisites.

docs/production-handoff-receipts.json

@@ -0,0 +1,58 @@
+[
+  {
+    "id": "356f6977-d361-4e3b-83ab-b2c7f4759286",
+    "to_agent": "key-cape",
+    "subject": "GLAS-WP-0015 production dependency handoff: key-cape",
+    "thread_id": null,
+    "created_at": "2026-09-06T18:22:01.797689Z",
+    "reply_thread_id": "356f6977-d361-4e3b-83ab-b2c7f4759286"
+  },
+  {
+    "id": "1b88b600-7b5d-4e3f-9999-8b8fec54b1ef",
+    "to_agent": "railiance-platform",
+    "subject": "GLAS-WP-0015 production dependency handoff: railiance-platform",
+    "thread_id": null,
+    "created_at": "2026-09-06T18:22:06.074863Z",
+    "reply_thread_id": "1b88b600-7b5d-4e3f-9999-8b8fec54b1ef"
+  },
+  {
+    "id": "85c68e66-46e3-4d30-a72f-4e104e2bbe5c",
+    "to_agent": "audit-core",
+    "subject": "GLAS-WP-0015 production dependency handoff: audit-core",
+    "thread_id": null,
+    "created_at": "2026-09-06T18:22:10.048994Z",
+    "reply_thread_id": "85c68e66-46e3-4d30-a72f-4e104e2bbe5c"
+  },
+  {
+    "id": "1e45cc7f-f1f5-40a8-b3f9-f1f8d78ece5c",
+    "to_agent": "approval-engine",
+    "subject": "GLAS-WP-0015 production dependency handoff: approval-engine",
+    "thread_id": null,
+    "created_at": "2026-09-06T18:22:16.057537Z",
+    "reply_thread_id": "1e45cc7f-f1f5-40a8-b3f9-f1f8d78ece5c"
+  },
+  {
+    "id": "7ab6d325-11a2-4f94-9736-b17335054e3c",
+    "to_agent": "secrets-engine",
+    "subject": "GLAS-WP-0015 production dependency handoff: secrets-engine",
+    "thread_id": null,
+    "created_at": "2026-09-06T18:22:22.076640Z",
+    "reply_thread_id": "7ab6d325-11a2-4f94-9736-b17335054e3c"
+  },
+  {
+    "id": "16172bc0-2935-40fe-8b5b-847132ecb689",
+    "to_agent": "flex-auth",
+    "subject": "GLAS-WP-0015 production dependency handoff: flex-auth",
+    "thread_id": null,
+    "created_at": "2026-09-06T18:22:27.550323Z",
+    "reply_thread_id": "16172bc0-2935-40fe-8b5b-847132ecb689"
+  },
+  {
+    "id": "481b18b6-54ae-44bc-bb31-ffd130d6d8ad",
+    "to_agent": "sand-boxer",
+    "subject": "GLAS-WP-0015 production dependency handoff: sand-boxer",
+    "thread_id": null,
+    "created_at": "2026-09-06T18:22:33.550976Z",
+    "reply_thread_id": "481b18b6-54ae-44bc-bb31-ffd130d6d8ad"
+  }
+]

workplans/GLAS-WP-0012-first-local-profile-production-proof.md

@@ -300,5 +300,6 @@ work: tenant agreement and client custody, KeyCape rollout, audit source
 onboarding, approval release, native lane activation and pinned combined
 runtime. Image/runtime preparation can proceed in parallel. The runner's
 project glas-local-proof must be reconciled with the owner route example's
-project glas-harness before the exact delivery binding is selected. No owner
+project glas-harness before the exact delivery binding is selected. Owner
-messages have been sent by this coordination work yet. T02 remains wait.
+handoffs were sent after explicit authorization; GLAS-WP-0015 records all seven
+receipt IDs and tracks replies. This plan's T02 remains wait.

workplans/GLAS-WP-0015-production-dependency-coordination.md

@@ -38,15 +38,17 @@ path, independent image/runtime preparation, and proof project binding mismatch.
 
 ```task
 id: GLAS-WP-0015-T02
-status: wait
+status: done
 priority: high
 state_hub_task_id: "8903d552-4039-5b80-b589-3743f7751e5f"
 ```
 
-Requests are prepared but not sent. Obtain explicit authorization to send
+Completed 2026-09-06 after explicit user authorization. Sent one deduplicated
-State Hub coordination messages, then send deduplicated threaded handoffs to
+root message to each of the seven owners; State Hub returned 201 and actual
-named owners and record actual receipt ids. Never mark delivery from file
+message IDs, recorded in docs/production-handoff-receipts.json. Replies must
-creation alone. A sent message is not accepted work or implementation evidence.
+use the root message ID as thread_id. The first attempt with a newly invented
+thread UUID was rejected before delivery; it was corrected, not counted as sent.
+A delivered message is not owner acceptance or implementation evidence.
 
 ## Review owner returns against the acceptance gates
 
@@ -62,3 +64,15 @@ release, native activation and runtime binding against the linked owner tasks.
 Check revisions and positive/negative evidence; feed verified returns into
 GLAS-WP-0012-T02. Keep unfulfilled owner work live, and do not close this plan
 while actionable requests lack an owning record or acknowledged disposition.
+
+## Delivery receipts
+
+| Owner | Root message / reply thread |
+|---|---|
+| key-cape | `356f6977-d361-4e3b-83ab-b2c7f4759286` |
+| railiance-platform | `1b88b600-7b5d-4e3f-9999-8b8fec54b1ef` |
+| audit-core | `85c68e66-46e3-4d30-a72f-4e104e2bbe5c` |
+| approval-engine | `1e45cc7f-f1f5-40a8-b3f9-f1f8d78ece5c` |
+| secrets-engine | `7ab6d325-11a2-4f94-9736-b17335054e3c` |
+| flex-auth | `16172bc0-2935-40fe-8b5b-847132ecb689` |
+| sand-boxer | `481b18b6-54ae-44bc-bb31-ffd130d6d8ad` |