Align approval registrations to the tenant:platform decision

Operator decision 5ed3fb35-eca9-413a-82b9-95171ba85bf6 accepts tenant:platform
as the platform management tenant for the Glas approval chain, requiring exact
spelling across the approval store, the service-client JWT claim and the
lifecycle CheckRequest.

Changes the tenant field on secrets-engine-approval and approval-engine-operator
only, in the registration fixture and the provisioning packet. Unrelated clients
and the human directory default keep tenant:coulomb, and no audience, scope,
subject, role, lifetime or MFA grant changes.

Adds issuance evidence that the approval shape emits tenant:platform exactly and
never an alias the caller requests, that the OpenBao client gains no
cross-tenant reach, and a fixture guard pinning every reviewed client's tenant.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01NV9oijZukGyGbRQGGKnK4P

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 713576@bnt-lap001
Assistant-Session: 384c511d-9bce-4cb8-a676-2aef6c0c8df6

workplans/KEY-WP-0013-approval-engine-resource-audience.md

@@ -63,6 +63,7 @@ No secrets were read or production resources changed.
 id: KEY-WP-0013-T03
 status: done
 priority: high
+state_hub_task_id: "e98da2eb-1f05-5c7f-bc84-711fa38b8c4a"
 ```
 
 Source: glas-harness inbox message 356f6977-d361-4e3b-83ab-b2c7f4759286
@@ -81,3 +82,32 @@ Added `src/internal/server/oidc/tenant_test.go`: request-supplied `tenant` and
 `tenant_hint` cannot alter the claim; two registrations never carry each other's
 tenant (the wrong-tenant denial basis); human tokens default to `tenant:coulomb`
 rather than an empty claim. Local issuance proof only, not live-rollout evidence.
+
+## Align approval registrations to tenant:platform
+
+```task
+id: KEY-WP-0013-T04
+status: done
+priority: high
+```
+
+Source: glas-harness inbox message f487c63a-dd7e-4ad8-9188-eec9fbea59c6,
+operator decision 5ed3fb35-eca9-413a-82b9-95171ba85bf6 ("Use tenant:platform for
+the Glas approval dependency chain", verified resolved in the hub). This closed
+resolution 2 of the two options recorded in KEY-WP-0013-T03.
+
+Changed the `tenant` field on exactly `secrets-engine-approval` and
+`approval-engine-operator` in `config/service-clients.example.yaml` and the two
+matching entries in `docs/approval-engine-provisioning-request.yaml` to
+`tenant:platform`, each annotated with the decision id. `codex-railiance-platform`,
+`secrets-engine-openbao` and the human directory default keep `tenant:coulomb`.
+No audience, scope, subject, role, lifetime or MFA change; no cross-tenant grant.
+
+Evidence: `TestApprovalClientIssuesExactPlatformTenantAndRejectsAliases` (exact
+`tenant:platform` with `aud=approval-engine` even when the caller requests
+`platform`, `tenant:coulomb` or `TENANT:PLATFORM`),
+`TestUnrelatedServiceClientKeepsCoulombTenant`, and
+`TestServiceRegistrationTenantsAreExactPerDecision`, which pins every reviewed
+client's tenant against the real fixture so a reintroduced alias fails the build.
+Full `go test ./...` and `go vet ./...` pass. Choice only — live provisioning and
+the other admission gates remain with KEY-WP-0013-T02.

workplans/KEY-WP-0015-scope-intent-assessment.md

@@ -9,6 +9,7 @@ owner: codex
 topic_slug: scope-intent-assessment
 created: "2026-09-05"
 updated: "2026-09-05"
+state_hub_workstream_id: "14a7312b-ec92-5640-8b26-cbaa4753c18e"
 ---
 
 ## Inventory implementation and document scope gaps
@@ -17,6 +18,7 @@ updated: "2026-09-05"
 id: KEY-WP-0015-T01
 status: done
 priority: medium
+state_hub_task_id: "99be1489-d9e5-53b1-9c82-75dc961131f7"
 ```
 
 Reviewed source revision b989de4, INTENT, SCOPE, runtime composition, authentication