Bound JWT private input and gate native effects on public health

Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a126e1-76f8-7643-8cf3-e93336539ade

workplans/ADHOC-2026-10-11.md

@@ -233,3 +233,60 @@ unknown outcomes and prior deadline/delete/recovery guards pass. Forty-six
 supplied lifecycle tests, seventeen unchanged-runner tests and twenty-one
 independent checks pass. NetKingdom exact source agreement only; same trial,
 no new task, native authority, credential access, runtime acceptance or closure.
+
+T07 same-trial node-route source followthrough: prepared exact successor
+manifest 23a972abc5175e121e594726d2b7f7a28c62109253f58f12623eaf2e5564a035 from unchanged published/frozen v5. Source inspection
+confirms the named OpenBao bridge binds workstation loopback, not node loopback;
+node Pod DNS/reachability is unobserved. Proposed founder-held bounded node-local
+port-forward of existing openbao/openbao-ui-gateway includes targeted teardown.
+A public-only route diagnostic and strict health identity digest now gate execute
+before protected/native reads and again before temporary mutation; recovery
+checks first as well. Forty-six retained lifecycle, eight new route, twenty-one
+retained independent and seventeen unchanged-runner tests pass offline.
+No tunnel, native health probe, credential/Secret read or mutation ran. Current
+source agreement is only NetKingdom's; fresh independent Platform/KeyCape
+acknowledgments and exact founder route/native authority remain prerequisites.
+Same completed T07, all previous source/review bytes intact, no new workplan.
+
+T07 same-trial v7 private-input sequencing correction: exact successor
+manifest 90aabec336008d7d51e37c04b5ff96ba8ed6630821cca1a4c333d803367247f7 retains immutable v6 source and NetKingdom/Platform
+reviews. V6 health gated native access but main read stdin first; its broader
+pre-private-input description was incorrect. V7 main now validates the exact
+source/approval, starts the bounded window and checks pinned public health before
+reading stdin. Execute revalidates source/expiry and preserves that original
+monotonic budget, while retaining health before native access and first mutation.
+Actual main tests prove failed/missing-pin health never consumes stdin; recovery
+remains stdin-free. Forty-six lifecycle, twelve route/main and twenty-one retained
+independent checks pass; unchanged runner remains pinned and previously verified.
+Pre-freeze local refactor/test failures were corrected and retained in validation
+evidence. Source preparation only; no owner checkout changes, native operation,
+credentials, tunnel, health observation or new workplan. Fresh exact independent
+KeyCape/Platform reviews and founder native authority remain required.
+
+T07 same-trial private-producer consumer source review: exact KeyCape proposal
+manifest 239aaac8541ba05e8bba5f9ecdc8b555a02fd9d0ad1762fdfc4d4bae7e4ef463
+reviewed as NetKingdom consumer only. Eighteen supplied and five independent
+synthetic checks pass, including actual partial-write timeout/unknown outcome.
+Changes requested: no child-ready preflight acknowledgement before private pipe
+write, writable stdout-pipe aliases pass FD>=3 guard, and final stat/unlink is
+non-atomic despite precise-inspected-inode removal wording. Exclusive caller
+custody is an assumption, not an authenticated peer or JWT signature proof.
+No KeyCape owner role, existing-client reuse, coding-agent custody admission,
+launcher/transport grant or native readiness is inferred. No private credentials,
+native operation or owner checkout writes occurred; staged v6/v7 remain history.
+
+T07 same-trial v8 bounded private receive correction: exact frozen successor
+manifest 316fd6005cc4cb7fe14ea69a5fd408aed13e6122afef60afd13d97952b27cf4a retains v7 agreement and the subsequent KeyCape
+unbounded-input finding as same-trial history. Complete private JSON receive is
+now binary/chunk/65536-byte/15-second capped, clipped to the original remaining
+action window; requires actual EOF, exact two-token object and per-token byte
+limits, checks expiry again before decoding/execute and emits no private errors.
+Actual main real stalled pipe and complete JSON without EOF time out; oversized,
+incomplete and late input refuse before execution. Forty-six lifecycle, twelve
+route/main, seven new receive and twenty-one retained independent checks pass.
+Producer-side exact-child ready acknowledgment still does not exist; child read
+bounds do not authorize early exporter write. Earlier producer changes-requested
+review remains live source feedback. Fresh exact independent KeyCape/Platform
+reviews, producer/launcher handoff and founder native authority remain required.
+No original source/stage/review changed, no owner checkout writes or native/
+credential/Secret/tunnel operation; same completed T07, no duplicate workplan.