Prepare source-only KEY-WP-0039-T02 owner returns

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 903097@bnt-lap001
Assistant-Session: aa320c8f-c3fa-46e7-8541-0b58e1e45d23

docs/proposals/2026-10-17-key39-t02-owner-returns.md

@@ -0,0 +1,48 @@
+# KEY-WP-0039-T02 owner returns (source-prepared, not admitted)
+
+Date: 2026-10-17. Status: **source-prepared, not admitted**. No live read, no
+admission, custody receipt, owner review or founder go is claimed here.
+Prepared from repo sources at `08c1f03` for key-cape
+`docs/proposals/2026-10-11-key39-next-execution-prerequisites.json`
+(`shortest_next_sequence` steps 1 and 3, Platform-owned parts).
+
+## 1. Coding-client admission for `codex-railiance-platform`
+
+- Existing record: `docs/proposals/2026-10-11-key39-coding-client-custody-proposal.json`
+  (commit `9460f6f`, status `proposed_source_only`), with the bounded inspection
+  in `workplans/ADHOC-2026-10-11.md` and identity notes in
+  `docs/coding-agent-openbao-identity.md`, `openbao/auth/coding-agent-jwt-role.json`.
+- It is a **proposal, not an admission/delivery record**. No admitted custody
+  entry, consumer host/injection binding or value-free metadata receipt for the
+  issuer env reference `KEYCAPE_CODEX_RAILIANCE_PLATFORM_CLIENT_SECRET` exists
+  in this repo. CCR-2026-0040 (create-only generate grant) does not supply
+  consumer delivery and is not reused.
+- No new proposal drafted: the 2026-10-11 proposal is the one narrow
+  proposal; its `missing_admission_gates` remain the owner work. No CCR number
+  is assigned.
+
+## 2. `secrets-engine-openbao` on `auth/keycape-services` as declared in source
+
+- Role source: `openbao/auth/secrets-engine-jwt-role.json`; contract
+  `docs/contracts/secrets-engine-openbao-jwt-login.yaml` (mount `keycape-services`,
+  last change `c924ff2`). Declared: `bound_audiences [secrets-engine-openbao]`,
+  `bound_subject service:secrets-engine`, string bound claims
+  `principal_type=service, tenant=tenant:platform, roles=secrets-engine,
+  scope=openbao:login`, policy `secrets-engine-login-self`, no default policy,
+  `token_type service`, ttl/max/explicit-max `5m`, `token_num_uses 8`.
+- **`expiration_leeway` is not declared** in role or contract (nor
+  `clock_skew_leeway` / `not_before_leeway`); live value is whatever the
+  server default or an out-of-source write set. Unknown from source.
+- **Node-local Bao origin is not declared** in any Platform source checked
+  (contract, lane design, coding-agent identity doc). Unknown from source.
+
+## Needs attended sanitized owner read (live confirmation)
+
+1. Node-local Bao origin on the actual consumer node route, plus public
+   `GET /v1/sys/health` receipt with cluster-ID digest.
+2. Live `auth/keycape-services/role/secrets-engine-openbao` matches the source
+   fields above, and its leeway values (expiration/clock-skew/not-before).
+3. `auth/keycape-services/config` issuer/JWKS binding matches KeyCape's issuer.
+4. For step 1: protected-custody entry/key, admitted consumer identity/host,
+   private injection mechanism and matched versions for the coding client —
+   value-free metadata only, after owner admission.