# T03 requester session

CCR-2026-0025 admits only the new requester path. The contained Warden login
uses `secrets-engine-requester-workload-kv-read`. Its owner command checks exact
reader policies and denial of the existing consumer path, obtains one in-memory
create-only token and submits only the three frozen T03 records. It cannot bind
or consume an approval and never reads the KeyCape verifier Secret.

Use the current source catalog explicitly while the installed bundle is older:
`WARDEN_ROUTING_CATALOG=/home/worsch/ops-warden/registry/routing/catalog.yaml`.

The reviewed child is
`/home/worsch/informed-decision/.venv/bin/python -B /home/worsch/railiance-platform/scripts/create-t03-approval-requests.py`.
It requires the owner-bound Approval Engine tunnel at 127.0.0.1:18281 and frozen
native evaluator receipts. Its output is metadata-only persisted by the owner;
Warden self-revokes and removes the reader helper after the child exits.