Record accepted platform tenant and notify dependency owners

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a0726e-5232-73f2-aaca-2c05ceb62efb

docs/platform-tenant-decision-receipts.json

@@ -0,0 +1,35 @@
+{
+  "decision_id": "5ed3fb35-eca9-413a-82b9-95171ba85bf6",
+  "messages": [
+    {
+      "id": "f487c63a-dd7e-4ad8-9188-eec9fbea59c6",
+      "to_agent": "key-cape",
+      "thread_id": "356f6977-d361-4e3b-83ab-b2c7f4759286",
+      "created_at": "2026-09-06T19:47:20.986481Z"
+    },
+    {
+      "id": "feff15be-c916-411a-818e-ab7bf06507ab",
+      "to_agent": "railiance-platform",
+      "thread_id": "1b88b600-7b5d-4e3f-9999-8b8fec54b1ef",
+      "created_at": "2026-09-06T19:47:24.861958Z"
+    },
+    {
+      "id": "aaa897fa-1ab3-4abc-9a18-4f0c6a121e25",
+      "to_agent": "approval-engine",
+      "thread_id": "1e45cc7f-f1f5-40a8-b3f9-f1f8d78ece5c",
+      "created_at": "2026-09-06T19:47:27.319877Z"
+    },
+    {
+      "id": "9009e150-15f3-4d40-93af-2c8624566507",
+      "to_agent": "secrets-engine",
+      "thread_id": "7ab6d325-11a2-4f94-9736-b17335054e3c",
+      "created_at": "2026-09-06T19:47:34.413613Z"
+    },
+    {
+      "id": "a24be254-e94e-4db6-93f4-20e232175f71",
+      "to_agent": "flex-auth",
+      "thread_id": "16172bc0-2935-40fe-8b5b-847132ecb689",
+      "created_at": "2026-09-06T19:47:40.852327Z"
+    }
+  ]
+}

docs/platform-tenant-decision.md

@@ -0,0 +1,26 @@
+# Platform management tenant decision
+
+Date: 2026-09-06
+Status: accepted by Bernd Worsch
+Tracking: GLAS-WP-0015-T03
+
+`tenant:platform` identifies the platform management, administration and services
+tenant: the landlord zone supporting the other tenants. This describes its
+operational role; access across tenant boundaries requires explicit policy grants.
+
+For the first Glas production dependency chain, use the exact string
+`tenant:platform` in the approval store configuration, the JWT tenant claims for
+`secrets-engine-approval` and `approval-engine-operator`, and the secrets-engine
+lifecycle CheckRequest tenant. Retain exact tenant comparison and v2 wrong-tenant
+denial. Neither bare `platform` nor `tenant:coulomb` is an alias.
+
+This decision authorizes alignment of those two proposed service registrations
+and the undeployed approval service. It does not change unrelated clients, human
+directory defaults, scopes or other tenant policies. Custody, runtime admission
+and actual end-to-end verification remain separate outstanding gates.
+
+Owner implementation and evidence are requested on the existing KeyCape,
+approval-engine, secrets-engine, flex-auth and railiance-platform handoff threads.
+See platform-tenant-decision-receipts.json for the State Hub decision and delivery
+receipts. The accepted choice resolves the decision blocker; implementation is
+not yet verified.

docs/production-dependency-handoffs.md

@@ -22,15 +22,14 @@ connectivity. Do not turn warn into enforce before caller adoption is proved.
 
 ## 1. Tenant alignment — key-cape, approval-engine, secrets-engine, flex-auth
 
-Before materializing credentials, reconcile three existing values:
-approval store `platform`, proposed client JWT `tenant:coulomb`, policy tenant
-`tenant:platform`. JWT/store comparison is exact. These may identify distinct
-layers, but an explicit owner-reviewed mapping is required; spelling similarity
-is not a valid mapping.
+Operator decision accepted 2026-09-06: use exact `tenant:platform` for the
+approval store, both proposed approval-client JWT tenant claims, and lifecycle
+CheckRequest tenant. This is the platform management and services tenant.
+See [accepted decision](platform-tenant-decision.md). No alias or implicit
+cross-tenant privilege follows from the landlord role.
 
-Return: the exact store tenant, JWT tenant, CheckRequest tenant and any permitted
-mapping, with a decision/contract reference and wrong-tenant denial evidence.
-No unilateral change to live clients or policy subjects is requested.
+Return: aligned source/deployment coordinates and wrong-tenant denial evidence.
+The decision is resolved; owner implementation and verification remain open.
 Related: KEY-WP-0013-T02, APPROVAL-WP-0002-T01, SECRETS-WP-0009-T03.
 
 ## 2. Admit service-client custody — railiance-platform with key-cape
@@ -142,8 +141,8 @@ secrets-engine, flex-auth and sand-boxer. railiance-platform has not returned
 a reply in this review. See GLAS-WP-0015 for the receipt summary.
 
 - v1 lacked tenant enforcement; v2 is now live with wrong_tenant denial.
-- Tenant values remain incompatible, with no authorized mapping. Operator
-  choice requested before changing registration/store semantics.
+- Tenant choice is now accepted as exact tenant:platform; owner alignment
+  and verification remain outstanding (see platform-tenant-decision.md).
 - Workstation caller access remains open even though FLEX-WP-0021-T05 was
   marked done; service coordinates are insufficient for the actual consumer.
 - AUDIT-WP-0009-T03 must precede T09 so load-bearing evidence is represented.

workplans/GLAS-WP-0012-first-local-profile-production-proof.md

@@ -313,3 +313,9 @@ to lack tenant denial at v1; the owner correction v2 is now deployed at Helm
 revision 2 and six live Check fixtures pass, including wrong_tenant denial.
 Tenant choice, workstation caller access, audit load-bearing schema/admission,
 identity/custody and native activation remain gates. T02 remains wait.
+
+
+Tenant decision update (2026-09-06): operator approved `tenant:platform` for the
+approval dependency chain as the platform management/services tenant. See
+`docs/platform-tenant-decision.md`. The choice blocker is resolved; exact owner
+configuration alignment and verification remain part of T02 before readiness.

workplans/GLAS-WP-0015-production-dependency-coordination.md

@@ -98,7 +98,17 @@ consumer Deployment specs unchanged. Receipt file:
 docs/evidence/GLAS-WP-0015-policy-v2-2026-09-06.json. Do not roll back to the
 known over-permissive v1; if v2 cannot operate, stop this consumer release.
 
-Operator tenant choice is pending. Follow-ups request live tracking of the
+Operator tenant choice was pending at rollout and is resolved below. Follow-ups request live tracking of the
 workstation caller path, independent Claude packaging, audit T03 then T09,
 and correct v2 adoption. T03 remains progress until owner prerequisites are
 verified; no real credential or model run has occurred.
+
+## Accepted tenant choice — 2026-09-06
+
+Operator approved exact `tenant:platform`, the platform management,
+administration and services tenant (landlord zone). Recorded in
+`docs/platform-tenant-decision.md` and State Hub; delivery receipts in
+`docs/platform-tenant-decision-receipts.json`. The two proposed service clients,
+approval store and lifecycle request must agree exactly. No alias or implicit
+cross-tenant authorization. Existing owner threads receive the approved change;
+T03 remains progress pending implementation evidence and other dependencies.