Keep original case provenance while revalidating a fresh caller session

Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a14bfc-9643-7872-aa12-98326dcf25e7

workplans/WARDEN-WP-0044-security-case-follow-through.md

@@ -151,6 +151,22 @@ state_hub_task_id: "bcbf6c91-2c04-5c16-ae8c-5d6c06fd6b89"
 
 ### T03 — Run and verify a case
 
+2026-10-18 current-session continuation: the new optional
+`Executor.admit(original_session_reference=...)` separates immutable original
+run-sheet provenance from fresh independently verified current session evidence.
+It requires the exact existing journal and original running intent under the
+normal lock, refuses missing/orphan/changed context and retains all original
+pins. Current authority is rechecked before every subsequent write/callback;
+neither the original reference nor a fresh login can replay a completed effect
+or clear uncertainty. No descriptor/Invocation/receipt schema or default
+admission behavior changes. Source integration uses the actual KeyCape CLI over
+HTTPS, a fresh Python owner process and actual Warden SQLite, with synthetic
+case/catalog/owner/effect attestations only. Exact source/proof is retained by
+CUST-WP-0080 under `keycape-current-client-r1`. Native owner mappings, current
+operation/effect authority, credential custody, case/type/descriptor refreeze,
+Forgejo inverse semantics and first native acceptance remain open; no lane,
+adapter, runtime or caller scope is activated by this source change.
+
 `warden case run <case.yaml>` executes the plan. Owner entry points run through
 the existing proxy as the caller; steps that need an attended login use the
 existing contained login envelope (silent command, session revoked afterwards),