From 08c1f036f2750097750f435efd76e8f6ee6df393 Mon Sep 17 00:00:00 2001
From: codex <codex@local>
Date: Fri, 16 Oct 2026 21:14:48 +0200
Subject: [PATCH] Review exact native signer custody and manual Argo plan

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a140c4-354a-7823-8f0d-8f717397f786
---
 ...-2026-0050-flex-auth-envelope-signing.yaml |   5 +-
 ...ex-auth-native-plan-public-supplement.json | 328 ++++++++++++++++++
 ...26-10-16-flex-auth-native-plan-review.json | 302 ++++++++++++++++
 ...-WP-0035-credential-lane-implementation.md |  10 +
 4 files changed, 644 insertions(+), 1 deletion(-)
 create mode 100644 docs/evidence/2026-10-16-flex-auth-native-plan-public-supplement.json
 create mode 100644 docs/evidence/2026-10-16-flex-auth-native-plan-review.json

diff --git a/credential-change-requests/CCR-2026-0050-flex-auth-envelope-signing.yaml b/credential-change-requests/CCR-2026-0050-flex-auth-envelope-signing.yaml
index 6e8b621..dc9dc2c 100644
--- a/credential-change-requests/CCR-2026-0050-flex-auth-envelope-signing.yaml
+++ b/credential-change-requests/CCR-2026-0050-flex-auth-envelope-signing.yaml
@@ -19,7 +19,10 @@ review:
   - access-engine-owner
   - secrets-engine-owner
   - cluster-runtime-storage-owner
-  comments: []
+  comments:
+  - reviewer: railiance-platform-owner (agent railiance-platform, codex)
+    decision: approved
+    comment: "INTENT Secure Custody/Stable Interfaces/Operable and Observable; RPF-WP-0035-T12. Approved Platform source/plan review only for frozen P4 manifest sha256:9eec861838a8e9138f2c821cff3014998fbe74bb01447642bf50d44e8b3b7cb3 and R2 manifest sha256:5be7a7f438624dcb35b7dbc96e7c9e5a8e2d5d1b1966cb4338aa5aecbe3a8b59; own bounded review artifact docs/evidence/2026-10-16-flex-auth-native-plan-review.json; sanitized supplement sha256:f02a9b595d9246a358d19b37bdad8fde158b7f0c9657a6ff088874732511a32c. Exact read policy/role/ESO proposal and one-use CAS0 writer stay separate. Identified manual Applications and recovery gates are mandatory. No founder decision, native execution, confirmed bindings or completed admission assent; current proposed status unchanged."
 target:
   domain: infotech
   tenant: platform
diff --git a/docs/evidence/2026-10-16-flex-auth-native-plan-public-supplement.json b/docs/evidence/2026-10-16-flex-auth-native-plan-public-supplement.json
new file mode 100644
index 0000000..4bc8e09
--- /dev/null
+++ b/docs/evidence/2026-10-16-flex-auth-native-plan-public-supplement.json
@@ -0,0 +1,328 @@
+{
+  "applications": {
+    "eso-token-renewer": {
+      "exists": true,
+      "ok": true,
+      "selected": {
+        "automated_present": false,
+        "metadata": {
+          "name": "eso-token-renewer",
+          "namespace": "argocd",
+          "owners": [],
+          "resource_version": "76246569",
+          "uid": "b10d1e31-08da-4364-b537-4e166eeeb25e"
+        },
+        "operation_phase": "Succeeded",
+        "operation_present": false,
+        "resources": [
+          {
+            "kind": "ConfigMap",
+            "name": "eso-token-renewer-worker-5c86dt7fm7",
+            "namespace": "external-secrets"
+          },
+          {
+            "kind": "ServiceAccount",
+            "name": "eso-token-renewer",
+            "namespace": "external-secrets"
+          },
+          {
+            "kind": "CronJob",
+            "name": "eso-token-renewer",
+            "namespace": "external-secrets"
+          }
+        ],
+        "source": {
+          "chart": null,
+          "path": "argocd/platform-addons/eso-token-renewer",
+          "repoURL": "https://forgejo.coulomb.social/coulomb/railiance-platform.git",
+          "targetRevision": "b2ebe108495c4d06ebb6ca33893ea4a2a23c9725"
+        },
+        "sources": []
+      },
+      "stderr_present": false
+    },
+    "informed-decision": {
+      "exists": true,
+      "ok": true,
+      "selected": {
+        "automated_present": false,
+        "metadata": {
+          "name": "informed-decision",
+          "namespace": "argocd",
+          "owners": [],
+          "resource_version": "76247431",
+          "uid": "499868f2-eabc-4df4-ae31-b89ce58d750d"
+        },
+        "operation_phase": "Succeeded",
+        "operation_present": false,
+        "resources": [
+          {
+            "kind": "ConfigMap",
+            "name": "informed-decision-runtime-6c221878d051",
+            "namespace": "informed-decision"
+          },
+          {
+            "kind": "ConfigMap",
+            "name": "informed-decision-runtime-c81577741a09",
+            "namespace": "informed-decision"
+          },
+          {
+            "kind": "ConfigMap",
+            "name": "informed-decision-workload-registry",
+            "namespace": "informed-decision"
+          },
+          {
+            "kind": "PersistentVolumeClaim",
+            "name": "informed-decision-data",
+            "namespace": "informed-decision"
+          },
+          {
+            "kind": "Service",
+            "name": "informed-decision",
+            "namespace": "informed-decision"
+          },
+          {
+            "kind": "Service",
+            "name": "informed-decision-workload",
+            "namespace": "informed-decision"
+          },
+          {
+            "kind": "ServiceAccount",
+            "name": "review",
+            "namespace": "informed-decision"
+          },
+          {
+            "kind": "Deployment",
+            "name": "informed-decision",
+            "namespace": "informed-decision"
+          },
+          {
+            "kind": "NetworkPolicy",
+            "name": "informed-decision-review-ingress",
+            "namespace": "approval-engine"
+          },
+          {
+            "kind": "NetworkPolicy",
+            "name": "informed-decision-lifecycle-ingress",
+            "namespace": "flex-auth"
+          },
+          {
+            "kind": "NetworkPolicy",
+            "name": "informed-decision-review-ingress",
+            "namespace": "flex-auth"
+          },
+          {
+            "kind": "NetworkPolicy",
+            "name": "informed-decision-review",
+            "namespace": "informed-decision"
+          },
+          {
+            "kind": "ClusterRole",
+            "name": "informed-decision-tokenreview",
+            "namespace": null
+          },
+          {
+            "kind": "ClusterRoleBinding",
+            "name": "informed-decision-tokenreview",
+            "namespace": null
+          }
+        ],
+        "source": {
+          "chart": null,
+          "path": "deploy/lifecycle",
+          "repoURL": "https://forgejo.coulomb.social/coulomb/informed-decision.git",
+          "targetRevision": "312ab97e876e17341bf16f9e95397e14c2ac2720"
+        },
+        "sources": []
+      },
+      "stderr_present": false
+    },
+    "openbao-secretstore": {
+      "exists": true,
+      "ok": true,
+      "selected": {
+        "automated_present": false,
+        "metadata": {
+          "name": "openbao-secretstore",
+          "namespace": "argocd",
+          "owners": [],
+          "resource_version": "76247497",
+          "uid": "f2932505-e649-4b99-b505-4789ed21301f"
+        },
+        "operation_phase": "Succeeded",
+        "operation_present": false,
+        "resources": [
+          {
+            "kind": "ClusterSecretStore",
+            "name": "openbao",
+            "namespace": null
+          }
+        ],
+        "source": {
+          "chart": null,
+          "path": "argocd/platform-addons/openbao-secretstore",
+          "repoURL": "https://forgejo.coulomb.social/coulomb/railiance-platform.git",
+          "targetRevision": "d2dbc19c254247652c49fda8721c80d53bca206a"
+        },
+        "sources": []
+      },
+      "stderr_present": false
+    },
+    "railiance-apps-root": {
+      "exists": true,
+      "ok": true,
+      "selected": {
+        "automated_present": false,
+        "metadata": {
+          "name": "railiance-apps-root",
+          "namespace": "argocd",
+          "owners": [],
+          "resource_version": "76247264",
+          "uid": "3078d1f5-07c2-44cc-bff7-c2ee2a2c9e7c"
+        },
+        "operation_phase": "Succeeded",
+        "operation_present": false,
+        "resources": [
+          {
+            "kind": "Application",
+            "name": "activity-core",
+            "namespace": "argocd"
+          },
+          {
+            "kind": "Application",
+            "name": "bao-notice",
+            "namespace": "argocd"
+          },
+          {
+            "kind": "Application",
+            "name": "eso-token-renewer",
+            "namespace": "argocd"
+          },
+          {
+            "kind": "Application",
+            "name": "informed-decision",
+            "namespace": "argocd"
+          },
+          {
+            "kind": "Application",
+            "name": "informed-decision-requester",
+            "namespace": "argocd"
+          },
+          {
+            "kind": "Application",
+            "name": "openbao-secretstore",
+            "namespace": "argocd"
+          },
+          {
+            "kind": "Application",
+            "name": "secret-annotation-guard",
+            "namespace": "argocd"
+          },
+          {
+            "kind": "Application",
+            "name": "state-hub-memo-dispatch",
+            "namespace": "argocd"
+          },
+          {
+            "kind": "Application",
+            "name": "target-revenue",
+            "namespace": "argocd"
+          }
+        ],
+        "source": {
+          "chart": null,
+          "path": "argocd/railiance01/applications",
+          "repoURL": "https://forgejo.coulomb.social/coulomb/railiance-platform.git",
+          "targetRevision": "main"
+        },
+        "sources": []
+      },
+      "stderr_present": false
+    }
+  },
+  "held_fence": false,
+  "objects": {
+    "deployment/flex-auth-secrets-engine": {
+      "exists": true,
+      "ok": true,
+      "selected": {
+        "conditions": [
+          {
+            "reason": "NewReplicaSetAvailable",
+            "status": "True",
+            "type": "Progressing"
+          },
+          {
+            "reason": "MinimumReplicasAvailable",
+            "status": "True",
+            "type": "Available"
+          }
+        ],
+        "field_managers": [
+          {
+            "manager": "helm",
+            "operation": "Update"
+          },
+          {
+            "manager": "k3s",
+            "operation": "Update"
+          }
+        ],
+        "metadata": {
+          "name": "flex-auth-secrets-engine",
+          "namespace": "flex-auth",
+          "owners": [],
+          "resource_version": "75291996",
+          "uid": "f83a5f5c-7dd7-4aac-bc02-d447e423e6ae"
+        }
+      },
+      "stderr_present": false
+    },
+    "externalsecret.external-secrets.io/flex-auth-secrets-engine-envelope-signing": {
+      "exists": false,
+      "ok": true
+    },
+    "persistentvolumeclaim/flex-auth-secrets-engine-outbox": {
+      "exists": false,
+      "ok": true
+    },
+    "secretstore.external-secrets.io/openbao-flex-auth-envelope-signing": {
+      "exists": false,
+      "ok": true
+    },
+    "serviceaccount/flex-auth-envelope-signing-eso": {
+      "exists": false,
+      "ok": true
+    },
+    "serviceaccount/flex-auth-secrets-engine": {
+      "exists": true,
+      "ok": true,
+      "selected": {
+        "conditions": [],
+        "field_managers": [
+          {
+            "manager": "helm",
+            "operation": "Update"
+          }
+        ],
+        "metadata": {
+          "name": "flex-auth-secrets-engine",
+          "namespace": "flex-auth",
+          "owners": [],
+          "resource_version": "57721771",
+          "uid": "4fd62828-c7b6-47ce-ac44-11b9fab851c4"
+        }
+      },
+      "stderr_present": false
+    }
+  },
+  "observed_at": "2026-10-16T19:12:36.858755+00:00",
+  "persistent_mutations": false,
+  "schema": "platform-native-plan-public-supplement.v1",
+  "transport": {
+    "exit_code": 0,
+    "stderr_present": false
+  },
+  "collector_sha256": "sha256:151f54e7815d97f0e28437f8db17f20c1eb436dce56ec332d36b88e0abfbc91d",
+  "coordinator_completed_at": "2026-10-16T19:12:36.585389+00:00"
+}
diff --git a/docs/evidence/2026-10-16-flex-auth-native-plan-review.json b/docs/evidence/2026-10-16-flex-auth-native-plan-review.json
new file mode 100644
index 0000000..efd3b43
--- /dev/null
+++ b/docs/evidence/2026-10-16-flex-auth-native-plan-review.json
@@ -0,0 +1,302 @@
+{
+  "schema": "railiance-platform.bounded-native-plan-review.v1",
+  "reviewer": "railiance-platform-owner (agent railiance-platform, codex)",
+  "work_item": "RPF-WP-0035-T12",
+  "decision": "approved",
+  "scope": "Exact P4/R2 Platform custody/read-lane and existing Argo Application manual-sync/freeze execution proposal, contingent on mandatory observed execution gates. Owner plan review only; not founder approval, native execution, CCR approval recording or completed native-admission disposition.",
+  "intent_basis": "INTENT Secure Custody, Stable Interfaces and Operable and Observable; Staff PEP-shaped attended founder-gated effects. SCOPE retains OpenBao custody/policy/delivery acceptance, not workload/Helm, cluster runtime/storage, identity or authorization ownership.",
+  "exact_revisions": {
+    "platform_revision": "84c529f239c81e6d3ca337015700b03e3a862f53",
+    "packet_p4_manifest_sha256": "9eec861838a8e9138f2c821cff3014998fbe74bb01447642bf50d44e8b3b7cb3",
+    "rollout_r2_manifest_sha256": "5be7a7f438624dcb35b7dbc96e7c9e5a8e2d5d1b1966cb4338aa5aecbe3a8b59",
+    "chart_revision": "dc042022f7c30671cf0a7605cf43ef6d96d04242",
+    "image_revision": "84c78e072c8f3daf2bc3b90f8efc8fbeb16c3cf0",
+    "image_digest": "sha256:09a83b273740133518cc7e7915fb211381e06545d347d2dd1974042525ac981f",
+    "deployment_projection_sha256": "8ce375f065552c551538f3acc7300c427407057eeff1d0b43755bfdf8a46169c",
+    "ccr_proposed_sha256": "44bbbf4aff84c3b085afdb14708106fd9a12ac03a0c47774913931a87fb94ada"
+  },
+  "evidence": {
+    "live_preflight_sha256": "7a45f821e57b6ea9a4603db52a603ab230016da2d4145d1b772baa7f4a11840b",
+    "observed_at": "2026-10-16T18:53:06.325922+00:00",
+    "all_seven_server_dry_runs_accepted": true,
+    "projection_source_matches_server_admitted_stopped_render": true,
+    "held_fence": false,
+    "actual_signer_stopped": false,
+    "application_supplement_sha256": "f02a9b595d9246a358d19b37bdad8fde158b7f0c9657a6ff088874732511a32c",
+    "application_supplement_observed_at": "2026-10-16T19:12:36.858755+00:00",
+    "application_collector_sha256": "sha256:151f54e7815d97f0e28437f8db17f20c1eb436dce56ec332d36b88e0abfbc91d"
+  },
+  "platform_read_lane": {
+    "ccr": "CCR-2026-0050",
+    "policy": "workload-kv-read-flex-auth-envelope-signing",
+    "role": "external-secrets-flex-auth-envelope-signing",
+    "sa": "flex-auth/flex-auth-envelope-signing-eso",
+    "audience": "openbao",
+    "ttl_seconds": 900,
+    "max_ttl_seconds": 900,
+    "explicit_max_ttl_seconds": 900,
+    "no_default_policy": true,
+    "permissions": "Exact platform/data/workloads/flex-auth/envelope-signing read plus lookup-self read/revoke-self update; no metadata/list/sibling/write/delete grant. KV document has all three fields; ESO projects only ED25519_PRIVATE_KEY to seed. No field-level authorization claim.",
+    "delivery": "Namespaced SecretStore flex-auth/openbao-flex-auth-envelope-signing and ExternalSecret flex-auth/flex-auth-secrets-engine-envelope-signing; Owner target creation, Retain deletion, 5m refresh; dedicated SA automount false. This proposed namespaced lane does not mutate existing ClusterSecretStore/openbao or legacy ESO token renewer."
+  },
+  "observed_application_scope": [
+    {
+      "name": "railiance-apps-root",
+      "uid": "3078d1f5-07c2-44cc-bff7-c2ee2a2c9e7c",
+      "automated": false,
+      "last_phase": "Succeeded",
+      "relevance": "Parent of existing nine Applications; hold manual sync during ceremony to prevent child source/policy changes.",
+      "source": {
+        "chart": null,
+        "path": "argocd/railiance01/applications",
+        "repoURL": "https://forgejo.coulomb.social/coulomb/railiance-platform.git",
+        "targetRevision": "main"
+      },
+      "queued_operation_present": false,
+      "resource_tuples": [
+        {
+          "kind": "Application",
+          "name": "activity-core",
+          "namespace": "argocd"
+        },
+        {
+          "kind": "Application",
+          "name": "bao-notice",
+          "namespace": "argocd"
+        },
+        {
+          "kind": "Application",
+          "name": "eso-token-renewer",
+          "namespace": "argocd"
+        },
+        {
+          "kind": "Application",
+          "name": "informed-decision",
+          "namespace": "argocd"
+        },
+        {
+          "kind": "Application",
+          "name": "informed-decision-requester",
+          "namespace": "argocd"
+        },
+        {
+          "kind": "Application",
+          "name": "openbao-secretstore",
+          "namespace": "argocd"
+        },
+        {
+          "kind": "Application",
+          "name": "secret-annotation-guard",
+          "namespace": "argocd"
+        },
+        {
+          "kind": "Application",
+          "name": "state-hub-memo-dispatch",
+          "namespace": "argocd"
+        },
+        {
+          "kind": "Application",
+          "name": "target-revenue",
+          "namespace": "argocd"
+        }
+      ],
+      "resource_version": "76247264"
+    },
+    {
+      "name": "informed-decision",
+      "uid": "499868f2-eabc-4df4-ae31-b89ce58d750d",
+      "automated": false,
+      "last_phase": "Succeeded",
+      "relevance": "Resource inventory includes NetworkPolicies informed-decision-lifecycle-ingress and informed-decision-review-ingress in flex-auth. Hold manual sync affecting those policies; no signer Deployment/ESO resource ownership observed.",
+      "source": {
+        "chart": null,
+        "path": "deploy/lifecycle",
+        "repoURL": "https://forgejo.coulomb.social/coulomb/informed-decision.git",
+        "targetRevision": "312ab97e876e17341bf16f9e95397e14c2ac2720"
+      },
+      "queued_operation_present": false,
+      "resource_tuples": [
+        {
+          "kind": "ConfigMap",
+          "name": "informed-decision-runtime-6c221878d051",
+          "namespace": "informed-decision"
+        },
+        {
+          "kind": "ConfigMap",
+          "name": "informed-decision-runtime-c81577741a09",
+          "namespace": "informed-decision"
+        },
+        {
+          "kind": "ConfigMap",
+          "name": "informed-decision-workload-registry",
+          "namespace": "informed-decision"
+        },
+        {
+          "kind": "PersistentVolumeClaim",
+          "name": "informed-decision-data",
+          "namespace": "informed-decision"
+        },
+        {
+          "kind": "Service",
+          "name": "informed-decision",
+          "namespace": "informed-decision"
+        },
+        {
+          "kind": "Service",
+          "name": "informed-decision-workload",
+          "namespace": "informed-decision"
+        },
+        {
+          "kind": "ServiceAccount",
+          "name": "review",
+          "namespace": "informed-decision"
+        },
+        {
+          "kind": "Deployment",
+          "name": "informed-decision",
+          "namespace": "informed-decision"
+        },
+        {
+          "kind": "NetworkPolicy",
+          "name": "informed-decision-review-ingress",
+          "namespace": "approval-engine"
+        },
+        {
+          "kind": "NetworkPolicy",
+          "name": "informed-decision-lifecycle-ingress",
+          "namespace": "flex-auth"
+        },
+        {
+          "kind": "NetworkPolicy",
+          "name": "informed-decision-review-ingress",
+          "namespace": "flex-auth"
+        },
+        {
+          "kind": "NetworkPolicy",
+          "name": "informed-decision-review",
+          "namespace": "informed-decision"
+        },
+        {
+          "kind": "ClusterRole",
+          "name": "informed-decision-tokenreview",
+          "namespace": null
+        },
+        {
+          "kind": "ClusterRoleBinding",
+          "name": "informed-decision-tokenreview",
+          "namespace": null
+        }
+      ],
+      "resource_version": "76247431"
+    },
+    {
+      "name": "openbao-secretstore",
+      "uid": "f2932505-e649-4b99-b505-4789ed21301f",
+      "automated": false,
+      "last_phase": "Succeeded",
+      "relevance": "Owns ClusterSecretStore/openbao only; existing shared delivery controller-adjacent app. No proposed signer namespaced lane ownership observed; preserve existing state and no related manual sync during ceremony.",
+      "source": {
+        "chart": null,
+        "path": "argocd/platform-addons/openbao-secretstore",
+        "repoURL": "https://forgejo.coulomb.social/coulomb/railiance-platform.git",
+        "targetRevision": "d2dbc19c254247652c49fda8721c80d53bca206a"
+      },
+      "queued_operation_present": false,
+      "resource_tuples": [
+        {
+          "kind": "ClusterSecretStore",
+          "name": "openbao",
+          "namespace": null
+        }
+      ],
+      "resource_version": "76247497"
+    },
+    {
+      "name": "eso-token-renewer",
+      "uid": "b10d1e31-08da-4364-b537-4e166eeeb25e",
+      "automated": false,
+      "last_phase": "Succeeded",
+      "relevance": "Owns legacy renewer ConfigMap/SA/CronJob in external-secrets, not new dedicated Kubernetes-auth role. Preserve unchanged; no stop/disable of unrelated shared renewer proposed.",
+      "source": {
+        "chart": null,
+        "path": "argocd/platform-addons/eso-token-renewer",
+        "repoURL": "https://forgejo.coulomb.social/coulomb/railiance-platform.git",
+        "targetRevision": "b2ebe108495c4d06ebb6ca33893ea4a2a23c9725"
+      },
+      "queued_operation_present": false,
+      "resource_tuples": [
+        {
+          "kind": "ConfigMap",
+          "name": "eso-token-renewer-worker-5c86dt7fm7",
+          "namespace": "external-secrets"
+        },
+        {
+          "kind": "ServiceAccount",
+          "name": "eso-token-renewer",
+          "namespace": "external-secrets"
+        },
+        {
+          "kind": "CronJob",
+          "name": "eso-token-renewer",
+          "namespace": "external-secrets"
+        }
+      ],
+      "resource_version": "76246569"
+    }
+  ],
+  "observed_signer_controller": "No Application in the current complete inventory owns flex-auth-secrets-engine Deployment, signer SecretStore/ExternalSecret or outbox PVC. Helm release revision4 and native Deployment/ReplicaSet controller are actual signer write path; Access owns exact manual/CI/Helm writer freeze. No new signer Argo adoption or controller configuration change is proposed.",
+  "mandatory_execution_gates": [
+    "Initial founder rollout/CCR decision may authorize only its explicitly enumerated read-lane apply and Access stopped-candidate preparation effects under reviewed owner scopes; it does not require those effects to exist before authorization. After that authorization and execution, assemble separately reviewed final one-use custody scope from approved CCR bytes/confirmed native bindings, authenticated founder entity, future absolute UTC expiry, held exclusive-window receipt, stopped native projection/fence and independent consumer baseline. All five dispositions bind this exact completed scope before custody. Actual founder/expiry/CCR/window remain null in frozen P4 preparation; this review fills none.",
+    "Before window refresh exact Application UID/source revision/resource tuples/current operation and manual sync settings for the identified apps and root. Freeze explicit manual sync/CI/Helm actors by founder executor/abort-owner agreement; require no pending/running Argo operation affecting relevant resources. Last Succeeded alone is not proof of no newly queued operation. Preserve before-state metadata; no speculative absence-of-all-possible-writers requirement. The19:12:36 supplement establishes all four selected Applications manual/no queued operation at that time, not a reserved future window.",
+    "Platform approves only source read-lane policy/role/delivery design here. Separate founder CCR decision and reviewed role/policy apply/readback are required; verify exact SA namespace/audience, native policy and all 900s/max/no-default attributes. Native positive/negative ESO login/path tests and safely reduced Ready/SecretSynced/version correspondence are separate evidence; no raw Secret/JWT outputs.",
+    "Access installs exact stopped candidate through reviewed Helm path and authenticates competing workload writers; actual observedGeneration, Deployment/owned ReplicaSets0, no owned/terminating/signer-SA/seed-mount pods and no HPA must hold. Exact native projection must equal8ce375f, independently of successful server dry-run. Secrets owns stopped/failclosed consumer; cluster owns refreshed headroom/storage/PV retention.",
+    "Founder runs only exact approved silent child/source/admission-file hash through attended Warden OIDC. Use private0700 receipt/admission custody,0600 files, trusted dependencies/runtime and explicit same-UID containment assessment. 5<remaining<=120 seconds at child start with fixed2s I/O caps; expired/early/changed scope refuses; no TTL widening/post-login refresh.",
+    "One fixed CAS0 plus metadata setup/readback is distinct from CCR read grant. Fresh exact cluster/backend/entity/source/reader-policy and actual fence checks precede private effects; only durable authenticated public receipt may cross to Secrets. No private seed/credential output, external seed import, standing writer role or agent session.",
+    "Keep signer and consumer fenced after CAS until independent Secrets public key/kid/fingerprint/trust admission, exact ESO/readback and Access mounted-runtime proofs. 120s ready abort and600s founder recovery hold apply to proposed rollout; no success inferred from source/public preparation.",
+    "On any unknown custody/write/readback/fsync, hold fence and original unknown receipt; only independently reviewed R2 read-only recovery binds immutable original receipt and current/original source lineages. No CAS retry/remint, automatic cleanup, private seed restoration or retrospective success.",
+    "Platform restores only captured safe manual Application/sync state under reviewed recovery disposition; never sync root merely to clear OutOfSync or enable automated/prune/selfheal. Access owns workload rollback and outbox preservation; unsigned05a remains failclosed for strict signed consumer. Secrets owns trust withdrawal/restoration; cluster owns PVC/PV retention. Compromise uses separately approved forward-only successor, never old-seed restoration."
+  ],
+  "owner_roles": [
+    "access-engine-owner: workload/Helm",
+    "railiance-platform-owner: custody/read-lane/existing Applications",
+    "cluster-runtime-storage-owner: runtime/storage",
+    "secrets-engine-owner: consumer/trust",
+    "founder: exact decision/executor/abort authority"
+  ],
+  "cost_and_risk": "Platform preparation/new infrastructure EUR0. No monetary loss/risk ceiling granted. Seed compromise permits lifecycle forgery; controlled outage and node-local evidence loss need explicit founder disposition. Shared ESO/Argo controllers remain installed unchanged; Enablement review only if actual installation/controller configuration delta is later proposed.",
+  "not_authorized": [
+    "live Kubernetes/OpenBao/Argo mutation",
+    "credential or Secret reads/TokenRequest",
+    "native custody/trust/caller admission",
+    "founder decision or completed native scope assent",
+    "other-owner review"
+  ],
+  "open_metadata_detail": "Requested sanitized supplement successfully observed all four exact Application sources/revisions/resource tuples and no queued operation; proposed delivery objects/PVC absent. Refresh at authorized ceremony; no broader writer inventory demanded.",
+  "workplan_status": "RPF-WP-0035-T12 remains progress; all native custody/acceptance gates remain open.",
+  "observed_delivery_state": {
+    "proposed_eso_sa_store_external_secret_and_pvc_absent": true,
+    "deployment_field_managers": [
+      "helm",
+      "k3s"
+    ],
+    "signer_sa_field_managers": [
+      "helm"
+    ],
+    "observations_grant_no_execution": true
+  },
+  "approval_stages": {
+    "initial_rollout_ccr_decision": "Explicit founder scope for read role/policy/delivery apply and stopped Helm/PVC preparation only; source plan owner reviews support this proposal. No custody/public-trust/caller grant inferred.",
+    "later_one_use_custody_assent": "Five exact dispositions bind completed approved CCR/native binding receipt, founder identity, absolute expiry, held window, actual fence/projection, source/image/baseline. Changed expiry changes scope.",
+    "execution_produced_facts_not_initial_human_choices": [
+      "actual stopped Helm revision",
+      "PVC UID/PV UID and Retain readback after WFFC binding",
+      "actual stopped fence/projection receipt",
+      "held-window observation"
+    ],
+    "unresolved_human_choices": [
+      "authenticated public founder OpenBao entity UUID (not inferred from hub-writer identity)",
+      "concrete ceremony absolute UTC expiry/window for final exact scope",
+      "accept or constrain proposed high seed-forgery/outage/local-evidence-loss scope; no monetary loss ceiling is established"
+    ]
+  }
+}
diff --git a/workplans/RPF-WP-0035-credential-lane-implementation.md b/workplans/RPF-WP-0035-credential-lane-implementation.md
index 96ce607..77e4736 100644
--- a/workplans/RPF-WP-0035-credential-lane-implementation.md
+++ b/workplans/RPF-WP-0035-credential-lane-implementation.md
@@ -1391,3 +1391,13 @@ No missing-local-declaration waiver, remote placement, actual stopped fence,
 PV retention, native custody, independent post-key trust or founder/owner
 approval is inferred. Exact successor source/CCR/plan pins and fresh scoped
 reviews remain required; T12 native gates and historical T13 outcome unchanged.
+
+2026-10-16 T12 bounded native plan review: Platform independently approves the
+exact P4/R2 custody/read-lane and existing manual Argo Application freeze/recovery
+proposal only, per docs/evidence/2026-10-16-flex-auth-native-plan-review.json.
+Current observed inventory has no signer Application; root and informed-decision
+manual sync are held during ceremony, while shared openbao-secretstore and legacy
+eso-token-renewer stay unchanged. Exact CCR read grant and one-use custody writer
+remain separate. Actual CCR/founder/entity/expiry/window/fence, native ESO/readback,
+independent Secrets public trust and Access/cluster runtime proofs remain gates.
+No authority/admission field changes; T12 remains progress.