- WP-0039-T03: receipts against flex-auth-ops-warden-fetch with ops-warden's
own caller token. Positive forgejo-admin-api-token allow; negatives for
unknown need, wrong owner (403), wrong tenant and anonymous caller (401).
Policy decisions only, no credential read. WP-0039 finished.
- audit-core-senders: active as a pointer on ops-mason's custody check
(message 5a516911). Custody text corrected to OpenBao KV v2 read via ESO;
delegation verified source-read.
- WP-0044: oidc-browser-relying-party 1.1 is plannable; the case-ref is taken
at run time because it covers the case status.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 427672@bnt-lap001
Assistant-Session: a0a2367e-4697-440c-a4e5-9713c009f6d8
tegwick
b76ee0edae