Apply GH-DEC-2026-013 and GH-DEC-2026-014; close INFD-IN-0002

Two rulings landed and both corrected something.

GH-DEC-2026-013 accepted our binding-versus-awareness argument, wrote it into
the record as its §6, and did not change the outcome — it sharpened the defect.
Two different facts share one field named tenant: the act-scope, a property of
the act that our binding slice commits, and the principal's membership, a
property of the person that approval-engine exact-matches. Gate House's
correction stands: a binding slice that must commit the scope being entered
should commit that scope, not borrow a membership claim to stand in for it. Our
schema already does — binding.target IS the act-scope and is inside view_hash —
so no field was added, only a statement (PR-08) and a provenance record (PR-09),
since key-cape emits tenant as a bare string.

key-cape had already implemented registration-bound tenancy on 2026-09-09,
correct under both candidate rulings, so the fail-closed-at-first-use risk that
made us withhold the client strings was already retired. IN-0002 closed. The one
remaining input to T07 is the deployed origin.

GH-DEC-2026-014 granted commitment-only evidence and bounded it. It satisfies
non-alteration and NOT reconstructability, and must not be described otherwise
anywhere. It also corrected our wording of the gap: we wrote that it leaves us
able to erase the content, which understates it. Commitment-only moves integrity
out of our control and leaves availability entirely inside it — the party that
can withhold the content is the party the evidence is about. Limit 3's condition
reduced, not removed.

The grant carries a condition we did not propose and would not have thought of:
the path must assert that committed content exists and where custody sits, so
non-production is a finding attributable to the custodian rather than an
unremarkable blank. A commitment with no assertion that something is being
committed to is indistinguishable from a commitment to nothing. Booked as PR-53,
and marked not-a-reversal-candidate.

Recorded the meta-rule Gate House named, now in its third setting here: unknown
versus absent in the stance map, directory-asserted versus registration-supplied
in the tenant claim, erased versus never held in the evidence path. Wherever a
system reaches one appearance by two routes, the record must say which route.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01V3W1dQG7GFFM9d94jFx7iR

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 1565372@bnt-lap001
Assistant-Session: 16bb2f25-b34c-49ef-8e94-5fec3567a568

workplans/INFD-WP-0001-founding-specs-and-approver-ui-ownership.md

@@ -352,7 +352,21 @@ registration is accepted by `approval-engine`'s verifier; `KEY-WP-0013-T02` is
 unblocked. **This is the task that discharges the gap that created this
 repository.**
 
-2026-09-09: blocked on `INFD-IN-0002`. `key-cape` found that a human access
+2026-09-10 — **unblocked.** `INFD-IN-0002` closed: `key-cape` had already
+implemented registration-bound tenancy (`329e48f`) correct under both candidate
+rulings, and `GH-DEC-2026-013` granted the shape as a declared bounded gap. Two
+obligations land here and are booked as PR-08/PR-09: never use the token's
+`tenant` claim as the act-scope (`binding.target` is, and already was), and
+record the claim's provenance, since `key-cape` emits it as a bare string and a
+consumer cannot otherwise tell a directory-asserted tenant from a
+registration-supplied one. Build to the registration-bound shape knowing it is
+transitional.
+
+The one remaining input is the **deployed origin**. Redirects match exactly, so
+`client_id` and the callback URI must name a real origin — the reason not to
+publish is now solely that, and no longer the tenant.
+
+Superseded context: 2026-09-09: blocked on `INFD-IN-0002`. `key-cape` found that a human access
 token cannot carry `tenant:platform` today — the tenant claim resolves from a
 directory record no adapter populates, so every human token falls back to
 `tenant:coulomb`, which `approval-engine` refuses by exact match. Registering