Record approved metered requester extension and six native creates

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a0e387-534d-70e3-ad53-4ea05676db8c

credential-change-requests/CCR-2026-0025-t03-requester-reader.yaml

@@ -5,7 +5,7 @@ request_type: workload-kv-read
 title: T03 create-only requester attended operator reader
 status: applied
 created: '2026-09-14'
-updated: '2026-09-14'
+updated: '2026-09-27'
 requester:
   agent: codex
   reason: User instructed completion of SECRETS-WP-0010-T03 and explicitly confirmed
@@ -26,13 +26,22 @@ review:
       approval, consume, provider-key access or model-spending scope. Separate reader
       and verifier remain exact to this new path; no old credential or registration
       is widened.
+  - at: '2026-09-27'
+    reviewer: operator in attended Codex session
+    decision: approved
+    comment: Exact six-request extension approved. Packet SHA-256
+      22e640428e3a7ae8fc2363cf193db98381cd94e4be7ab009bc6703658d6fc544;
+      scripts/create-metered-approval-requests.sh creates only apply/verify/exec
+      requests for glas-claude-agent-dev-anthropic and activity-core-metered-worker-token.
+      No approve, consume, workload credential retrieval or execution authority.
+      Receipt docs/evidence/2026-09-27-metered-requester-mandate.json.
 target:
   domain: financials
   tenant: platform
   workload: secrets-engine
   environment: production
-  purpose: T03 create-only requester attended operator reader; execute only the three
-    fixed T03 request records.
+  purpose: Create only the three fixed T03 request records or the six metered
+    records frozen by the explicitly approved 2026-09-27 packet; no arbitrary requests.
 openbao:
   mount: platform
   kv_path: platform/workloads/secrets-engine/approval-requester